Monitoring system errors is vital to maintain the stability and reliability of your Windows system. PowerShell offers a powerful way to query system logs directly from the Event Viewer. This article will demonstrate how to write a PowerShell script to retrieve the 20 most recent system errors and display their timestamps.

Prerequisites

You’ll need:

• Basic understanding of PowerShell
• Administrator access on your Windows system

PowerShell Script

Here’s a simple script to achieve the task:

# Define the number of errors to retrieve
$ErrorCount = 20

# Use the Get-WinEvent cmdlet to fetch the recent system errors
$RecentErrors = Get-WinEvent -LogName System -ErrorAction SilentlyContinue | 
                Where-Object {$_.LevelDisplayName -eq 'Error'} | 
                Sort-Object TimeCreated -Descending | 
                Select-Object -First $ErrorCount

# Display the errors with their timestamps
foreach ($Error in $RecentErrors) {
    Write-Host "Time: $($Error.TimeCreated) - Message: $($Error.Message)"
}
    

Explanation

The script breaks down into the following parts:

• Define the number of errors to retrieve: Specify how many errors you want to fetch with the $ErrorCount variable. Here, it’s set to 20.
• Fetch recent system errors: The Get-WinEvent cmdlet retrieves entries from the System log. It filters out only the error-level events and sorts them by the time they were created in descending order to get the most recent ones. The -ErrorAction SilentlyContinue parameter ensures that any errors encountered during the process don’t stop the script.
• Display errors with timestamps: A simple foreach loop iterates over the retrieved errors and prints their timestamp and message to the console.

Running the Script

To run the script:

1. Open PowerShell as Administrator.
2. Copy the script into the PowerShell window or save it as a .ps1 file and run it.
3. The script will display the 20 most recent system errors along with their timestamps.

Conclusion

Using PowerShell to monitor system errors is a quick and efficient way to keep your system healthy. By leveraging the Get-WinEvent cmdlet, you can easily fetch and display critical error information right from the Event Viewer. This proactive approach helps in identifying and addressing issues before they escalate.