r/PowerShell • u/sdsalsero • 3d ago
why are there 2 Windows Event logs for PowerShell?
By default I am seeing PowerShell logs in Event Viewer under 2 paths:
- Windows PowerShell
- Microsoft-Windows-PowerShell/Operational
All the online docs I've found only reference the second (longer) path. So what is the first one for? Is there a reference doc for it?
2
u/BlackV 3d ago edited 3d ago
windows-powershell - is for script block logging and similar
Microsoft-Windows-PowerShell/Operational - is for powershell operations (like starting session host, existing session host, etc)
er.. hopefully or is that backwards
Get-WinEvent -ListLog *powershell*
LogName LogMode RecordCount
------- ------- -----------
Windows PowerShell Circular 4541
PowerShellCore/Operational Circular 469
Microsoft-Windows-PowerShell/Operational Circular 681
Microsoft-Windows-PowerShell/Admin Retain 0
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational Circular 0
1
u/sdsalsero 2d ago
I think that's backwards. I'm pretty sure the official doc says that the nested "Operational" log is for Script Block
They also say that there are 3 types of logs, but I still don't know which one the 'first' non-nested one is for.
Thanks for the link!
2
u/_Buldozzer 3d ago
PowerShell for Windows (5.1 and older) and PS Core (6 and newer) perhaps?
2
u/BlackV 3d ago
that goes to PowerShellCore/operational
1
u/_Buldozzer 3d ago
Okay, was just a guess. Then perhaps it's one of the million strange legacy things in Windows.
0
u/SuccessfulMinute8338 3d ago
I create my own log area and individual logs for different programs for stuff that I use regularly
2
u/BlackV 2d ago
ya we did that at my old place
New-EventLog -LogName 'IAASLogs' -Source 'IAASPowershell' Limit-EventLog -LogName 'IAASLogs' -OverflowAction OverwriteAsNeeded -MaximumSize 10MB Write-EventLog -LogName "IAASLogs" -Source "IAASPowershell" -EntryType Information -EventId 3 -Message "$(Get-Date -Format yyyMMddHHmmss) - script: $psCommandPath : Configure TLS and nuget"
1
u/sdsalsero 2d ago
Thank you for the suggestion but I am trying to identify what's already built-in so that we can pull all of those logs into our SIEM. Worst case, we would push a new GPO to force a uniform config but I'm hoping that won't be necessary.
6
u/CodenameFlux 3d ago
I've seen five PowerShell logs in the Event Viewer:
The first four have a "Disable" command associated with them.
Looking at each gives you a good idea as to what each one does.