Home/ Questions/Q 926661
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T19:43:14+00:00

Caveat: Without spiking the cpu while a Get-WmiObject call parses the whole event log

  • 0

Caveat: Without spiking the cpu while a Get-WmiObject call parses the whole event log to match my specified filter.

Situation: I am working on a script that remotely runs some checks, then reboots a pc. I want it to check the health once the server reboots (after sleeping for some time) to make sure services that were supposed to start did. I’ve been running into “Automatic” services that start and then shut down (as intended) but then my current version picks them up as failed if they’ve already run. It was suggested that I check the event log for “Service Control Manager” errors, and report on those, the only problem now is that with the below script, we have servers who’s event log can range anywhere from 20K to several hundred thousand events, and on a 2k server with 20K, this takes roughly 20 seconds to complete, and the cpu pegs near 100% while it’s running.

I’m still learning powershell/wmi, so any advice would be appreciated.

function Check_Startup_Events {
    BEGIN {
        $time = [System.Management.ManagementDateTimeConverter]::ToDmtfDateTime((Get-Date).AddMinutes(-15))
    }
    PROCESS { 
        $results = Get-WmiObject Win32_NTLogEvent -computername $_ -Filter "LogFile='System' and SourceName='Service Control Manager' and TimeGenerated>='$time' and EventType=1" |
            Format-Table -Autosize EventCode, Message
        $results
    }

}
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team
    $results = Get-EventLog -ComputerName w2kserver -LogName System -After $time
foreach ($result in $results){
if ($result.Source -eq "Service Control Manager" -and $result.EntryType -eq "Error"){
Write-Host $_.Description}}

    I ran this against a 60k big event log on a W2K server in our environment. It takes a while to run but runs locally and does not tax the server. Not sure how you would want to output the data but I think Get-EventLog will do what you want.

    • 0