Get-EventLog -after is slow

[l33t]

Hi all..

I'm using the Get-EventLog -After (Get-Date).AddHours(-24) command.
Some machines it runs relatively quick (2-3min) while others it hangs
for a long time. It's like PS is looking at the entire log...not
sure.

Anyone know of a faster way to query the past days events?

Thanks,
Danny

[jason.s....@gmail.com]

Get-EventLog actually gets the whole log before it parses the date. Use Get-WinEvent. Performance is a lot better.

Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-1)}

Thanks,
Jason