Get-Eventlog is the legacy Windows log querying command. Its advanced filtering is limited. Whereas Get-WinEvent, as a newer command, could make use of advanced XPath and XML filters. It only matches the exact records by filtering at source. The resulting object would be indexed; hence, in theory, targeted events can be returned very quickly and efficiently. However, Get-EventLog isn’t always slower than Get-WinEvent as shown in the illustrations below:
# Get-WinEvent Method
$logType='Application'
$source='Waveaccess - CRM Integration Service'
$message="Can't connect to Trixbox"
$eventId=0
$minutesRelevancy=20000
$limit=1
$filter = @{
LogName = 'Application'
ID = 0
StartTime = [datetime]::Now.AddMinutes(-$minutesRelevancy)
}
measure-command { Get-WinEvent -FilterHashTable $filter -ComputerName $env:computername -EA Ignore|?{$_.Message -match $message}|select -first $limit }
# Testing on a Server with True-positives
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 274
Ticks : 2748585
TotalDays : 3.18123263888889E-06
TotalHours : 7.63495833333333E-05
TotalMinutes : 0.004580975
TotalSeconds : 0.2748585
TotalMilliseconds : 274.8585
# Testing on a Server with True-negatives
Days : 0
Hours : 0
Minutes : 0
Seconds : 22
Milliseconds : 11
Ticks : 220112284
TotalDays : 0.000254759587962963
TotalHours : 0.00611423011111111
TotalMinutes : 0.366853806666667
TotalSeconds : 22.0112284
TotalMilliseconds : 22011.2284
# Get-EventLog Method
$logType='Application'
$source='Waveaccess - CRM Integration Service'
$message="Can't connect to Trixbox"
$eventId=0
$minutesRelevancy=20000
$limit=1
measure-command {Get-EventLog -LogName $logType -InstanceId $eventId -source $source -message "*$message*" -Newest $limit|?{$_.TimeWritten -ge [datetime]::Now.AddMinutes(-$minutesRelevancy)} }
# Testing on a Server with True-positives
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 151
Ticks : 1513339
TotalDays : 1.75154976851852E-06
TotalHours : 4.20371944444444E-05
TotalMinutes : 0.00252223166666667
TotalSeconds : 0.1513339
TotalMilliseconds : 151.3339
# Testing on a server with True-negatives
Days : 0
Hours : 0
Minutes : 1
Seconds : 20
Milliseconds : 884
Ticks : 808844706
TotalDays : 0.000936162854166667
TotalHours : 0.0224679085
TotalMinutes : 1.34807451
TotalSeconds : 80.8844706
TotalMilliseconds : 80884.4706
Conclusion: the run-time speed on True-positives are similar. Yet, on a True-negative results, Get-WinEvent is 267% faster than Get-EventLog.
Categories:
