Viewing Windows 10 event log in "follow" (real-time) mode in terminal?

Question

In Linux, if I want to observe the system log in terminal in real-time, I can use the tail command to output the /var/log/syslog file with the -f or --follow switch, which "output(s) appended data as the file grows", say:

tail -f /var/log/syslog

... or could also use:

dmesg --follow

... where -w, --follow argument for dmesg stands for "Wait for new messages".

In any case, both of these applications in this mode generally block the terminal, and then dump new text lines/messages as they come, until you hit Ctrl-C to exit them.

On Windows, I understand that the equivalent to the system log is the Event (Log) Viewer, which is a GUI application. After a while, I found https://www.petri.com/command-line-event-log - which notes that one can use the WEVTUTIL.EXE command-line application to query the Windows event log.

So, I've tried this:

C:\>wevtutil qe System

... but this simply dumps all events, and then exits (same as if you'd call dmesg on Linux without any arguments).

I looked through the help wevtutil /?, but I cannot see any command line argument that would put wevtutil in "follow" mode (i.e. so it blocks the terminal after it has dumped everything up to that point, and then prints new events/text lines as they are logged).

So - is it possible to get wevtutil to work in follow mode, and if so, how? If not, is there another utility I could use, that would do the same - dump the system Event Log of Windows to terminal in follow mode?

Answer 1

Go to sysinternals.com, then look at the documentation for ProcessExplorer. You can set filters to exe, events, messages and in real-time or duration. You can trace and debug too. Sysinternals Suite gives much better detail than event viewer.

1. ProcessExplorer
2. ProcessMonitor
3. ProcessDump

Once you find the events or objects you need, check the properties to see what you can call in terminal.

Answer 2

OK, so looked up something a bit more; found this:

• https://stackoverflow.com/questions/15262196/powershell-tail-windows-event-log-is-it-possible

... which gives examples of using PowerShell for this behavior. Based on this post, this is what I did:

First, I wanted to create a PowerShell script; the page https://www.windowscentral.com/how-create-and-run-your-first-powershell-script-file-windows-10 notes that the extension for a PowerShell script is .ps1.

Then, I wanted to specifically create the script in root of drive C:. Turns out, this is protected in Windows 10 - you must have Administrator privileges to do this (else you get Access is denied.). So, I fired up Command Prompt in administrator mode ("Run as administrator"), and created these two files:

C:\WINDOWS\system32>cd C:\
C:\>echo > wevent_tail_01.ps1
C:\>echo > wevent_tail_02.ps1

Note that these files will not be empty, but will have the text line ECHO is on. in them - however, that line can b deleted; or ( https://ss64.com/ps/syntax-comments.html ) prefixed with # which is the comment character in PowerShell.

Then, I opened those files in Notepad to edit them - from the same terminal, so the Administrative privileges are kept (otherwise one will get access denied when trying to save the files from Notepad):

C:\>notepad wevent_tail_01.ps1
C:\>notepad wevent_tail_02.ps1

Then, I pasted this code from the SO:15262196 as wevent_tail_01.ps1:

$idx = (get-eventlog -LogName System -Newest 1).Index

while ($true)
{
  start-sleep -Seconds 1
  $idx2  = (Get-EventLog -LogName System -newest 1).index
  get-eventlog -logname system -newest ($idx2 - $idx) |  sort index
  $idx = $idx2
}

... and I pasted the code from the other answer in wevent_tail_02.ps1, but I couldn't quite get it to work. So in the rest of this post, I'll only use wevent_tail_01.ps1.

Now, it's time to run this script in PowerShell; the windowscentral post points out that scripts are ran by prefixing their path with ampersand and space &; however, if you just start PowerShell normally, and try it, you'll get:

PS C:\> & "C:\wevent_tail_01.ps1"
& : File C:\wevent_tail_01.ps1 cannot be loaded because running scripts is disabled on this system. For more
information, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:3
+ & "C:\wevent_tail_01.ps1"
+   ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : SecurityError: (:) [], PSSecurityException
    + FullyQualifiedErrorId : UnauthorizedAccess

The windowscentral post recommends that you use Set-ExecutionPolicy RemoteSigned to fix this - but to have this command complete, you'll again need to run PowerShell with administrative privileges; however, you can also limit it to the current user, in which case you can keep the normally started PowerShell:

PS C:\> Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic at
https:/go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "N"): A
PS C:\>

So, at this point, we should have a permission to run our script:

PS C:\> & "C:\wevent_tail_01.ps1"

... and nicely, the script will block the terminal, but most likely, no text will be dumped. So, we'd like to test and see if this works.

For this, we'll need to open another PowerShell, but with administrative properties; I found the right info on https://mcpmag.com/articles/2016/09/08/powershell-to-write-to-the-event-log.aspx - in brief: to write arbitrary stuff in Windows Event Logs, we need to specify a "source":

PS C:\WINDOWS\system32> New-EventLog -LogName System -Source 'MySysTest'

... and then, we can use Write-EventLog to write into the event log:

PS C:\WINDOWS\system32> Write-EventLog -LogName "System" -Source "MySysTest" -EventID 3001 -EntryType Information -Message "MyApp added a user-requested feature to the display." -Category 1 -RawData 10,20
PS C:\WINDOWS\system32> Write-EventLog -LogName "System" -Source "MySysTest" -EventID 3001 -EntryType Warning -Message "MyApp added a user-requested feature to the display." -Category 1 -RawData 10,20
PS C:\WINDOWS\system32> Write-EventLog -LogName "System" -Source "MySysTest" -EventID 3001 -EntryType Error -Message "MyApp added a user-requested feature to the display." -Category 1 -RawData 10,20

If we now switch to the first PowerShell, where the C:\wevent_tail_01.ps1 was running and blocking, we should see something like:

PS C:\> & "C:\wevent_tail_01.ps1"

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
    2577 Jun 27 10:34  Information MySysTest                    3001 MyApp added a user-requested feature to the dis...
    2578 Jun 27 10:35  Warning     MySysTest                    3001 MyApp added a user-requested feature to the dis...
    2579 Jun 27 10:35  Error       MySysTest                    3001 MyApp added a user-requested feature to the dis...

In fact, at first I did not see this when switching to this terminal, but then I think I right-clicked it once, and it "woke up", and then it started dumping lines in realtime.

Well, I guess this is what I wanted - though I did kinda hope that this would have been a bit easier ...

---

EDIT: if you want to "tail" both System and Application log, here is the PowerShell script:

$sidx = (get-eventlog -LogName System -Newest 1).Index
$aidx = (get-eventlog -LogName Application -Newest 1).Index

while ($true)
{
  start-sleep -Seconds 1
  $sidx2  = (Get-EventLog -LogName System -newest 1).index
  $aidx2  = (Get-EventLog -LogName Application -newest 1).index
  get-eventlog -logname system -newest ($sidx2 - $sidx) |  sort index
  get-eventlog -logname application -newest ($aidx2 - $aidx) |  sort index
  $sidx = $sidx2
  $aidx = $aidx2
}

... and to test, you have to make a new provider, with a unique name, registered to Application log, so:

New-EventLog -LogName Application -Source 'MyAppTest'

... which you can test/fire up with:

Write-EventLog -LogName "Application" -Source "MyAppTest" -EventID 3001 -EntryType Error -Message "MyApp added a user-requested feature to the display." -Category 1 -RawData 10,20