← script library

Check Event Log Errors with PowerShell

Checks & DiagnosticsAugust 17, 2026

Collects critical and error events from the System and Application logs over a lookback window, then groups them by source and shows the ten worst offenders with the newest message of each. That turns a wall of events into a handful of lines that tell you what is actually broken.

powershell
# Check Event Log Errors
# Single use case: summarize System/Application errors of the last N hours
#-----------------------------------------------------------------

function Write-Log {
    param($Message)
    Write-Host "<WRITE-LOG = `"*$Message*`">"
}

# --- Parameters (replace via ServerEngine API parameters if needed) ---
$LookbackHours = 24

$since = (Get-Date).AddHours(-[int]$LookbackHours)
$total = 0

foreach ($logName in @("System", "Application")) {
    $events = Get-WinEvent -FilterHashtable @{ LogName = $logName; Level = 1,2; StartTime = $since } -ErrorAction SilentlyContinue
    $count = @($events).Count
    $total += $count
    Write-Log "================ $logName ($count errors in ${LookbackHours}h) ================"
    if ($count -eq 0) { continue }

    # group by source, worst offenders first
    $groups = $events | Group-Object ProviderName | Sort-Object Count -Descending | Select-Object -First 10
    foreach ($g in $groups) {
        $newest = ($g.Group | Sort-Object TimeCreated -Descending | Select-Object -First 1)
        $msg = if ($newest.Message) { ($newest.Message -split "`n")[0].Trim() } else { "(no message)" }
        if ($msg.Length -gt 100) { $msg = $msg.Substring(0, 100) + "..." }
        Write-Log "x$($g.Count.ToString().PadLeft(4))  [$($g.Name)] last: $msg"
    }
}

if ($total -eq 0) {
    Write-Log "Event log check complete: no errors in the last $LookbackHours hours."
} else {
    Write-Log "Event log check complete: $total error(s) found in the last $LookbackHours hours."
}

Run it across your fleet

This script runs as-is on a single host. Paste it into ServerEngine to schedule it, run it on a whole server group in parallel, and keep the credentials out of the file — see the scripts documentation and the credential store.

Ready when you are.

Try ServerEngine free for 7 days.