New events in event viwer

Hi to u all,
I try to find way to process new events which arriving to the
application log in event viewer.
there is a script which search all the time for new events (in
powerShell) ?

Thanks
Didi

You can do this with Oisin's excelent Eventing library :

PoSH> Add-PSSnapin pseventing
PoSH>
PoSH> $el = new-Object System.Diagnostics.EventLog("Application")
PoSH> $el.EnableRaisingEvents = $true
PoSH>
PoSH> Connect-EventListener el EntryWritten -verbose
VERBOSE: Target is a EventLog
VERBOSE: Now listening for 'EntryWritten' events from $el
PoSH>
PoSH> $el.Source = 'mow'
PoSH> $el.WriteEntry('foo','Information',10)
PoSH>
PoSH> Sleep 1
PoSH>
PoSH> $event = Get-Event
PoSH>
PoSH> $event

Occurred Source Name
Args
-------- ------ ----
----
2007-05-29 4:46:52 PM variable:el
EntryWritten System.Diagnostics.EntryWritten...


PoSH> $event.args.entry

Index Time Type Source EventID Message
----- ---- ---- ------ ------- -------
2533 May 29 16:46 Info mow 10 foo

for another example :

http://thepowershellguy.com/blogs/po...-released.aspx

and you can find this library here :
http://www.codeplex.com/PSEventing

Enjoy,

Greetings /\/\o\/\/
http://thePowerShellGuy.com


"Did" wrote:

> Hi to u all,
> I try to find way to process new events which arriving to the
> application log in event viewer.
> there is a script which search all the time for new events (in
> powerShell) ?
>
> Thanks
> Didi
>
>

Did wrote:
> Hi to u all,
> I try to find way to process new events which arriving to the
> application log in event viewer.
> there is a script which search all the time for new events (in
> powerShell) ?
>
> Thanks
> Didi
>

Are you looking for something like /\/\o\/\/ provided or for something
more like this:
http://www.microsoft.com/technet/scr.../lgevvb17.mspx

Keep in mind the above is written in VBScript, but porting is easy.

Marco

The example Marco gave, can also take advantage of the PSeventing library ,
the example I give here shows also how to convert the VbScript sample to
PowerShell ( the only difference is the Clasname and type of event )

http://thepowershellguy.com/blogs/po...-released.aspx

without the http://www.codeplex.com/PSEventing library you can only wait for
a change

I made also an example on my blog how to use the eventlog in that case (also
using WMI) see :

http://thepowershellguy.com/blogs/po...fic-words.aspx

Greetings Marc

"Marco Shaw" <marco.shaw@_NO_SPAM_gmail.com> wrote in message
news:Ocsh44goHHA.4960@TK2MSFTNGP02.phx.gbl...
> Did wrote:
>> Hi to u all,
>> I try to find way to process new events which arriving to the
>> application log in event viewer.
>> there is a script which search all the time for new events (in
>> powerShell) ?
>>
>> Thanks
>> Didi
>>
>
> Are you looking for something like /\/\o\/\/ provided or for something
> more like this:
> http://www.microsoft.com/technet/scr.../lgevvb17.mspx
>
> Keep in mind the above is written in VBScript, but porting is easy.
>
> Marco