Powershell Get-EventLog returning events one at a time

Question

EDIT 9/26/2011: Still looking for an answer, if you have any ideas please post and let me know!

Summary of problem

When I run Get-EventLog against my own computer or a nearby computer, I don't see anything unusual and everything works as expected.

When I run it against a computer that is further away (average ping of 108ms) it starts to act in a way that I wouldn't expect. There is a long pause between each event that is returned, and it takes an excessively long time to complete.

Here is the command I am using:

Get-EventLog -ComputerName [computername] -LogName Application -newest 100

I would expect the command to gather all the information on the remote computer and then send it back to me in one bunch, but it doesn't seem to be doing this.

When I execute the command normally and use something like online-stopwatch for rough measurements, the result is about 4 minutes and 3 seconds.

When I measure it using:

Measure-Command {Get-EventLog -ComputerName yanhong03 -LogName Application -newest 100}

The result is about 31 seconds (but none of the information is printed out).

So, two questions:

Why are events (seemingly) retrieved one at a time?
Why is using Measure-Command actually changing the amount of time the command takes to finish?

Miscellaneous Details:

I am running powershell v2, and am using the shell in the Powershell ISE for executing these commands. OS is Windows XP.

I just noticed that I hadn't answered any of your questions and truly, I can only guess. I'm thinking that fetching this information remotely is just a poor performing option where telling the remote computer to do the work and just send it back (my example) is simply more efficient. I suspect that measure-command is masking the time lost in displaying the result and going back for another go and may be allowing the remote machine to keep pushing results. — Kevin Buchan
That's okay, thanks for providing an alternate way to get these! I am still interested in concrete answers to these questions so I'll keep the question open for now, but I appreciate the information. — Nick Knowlson

Kevin Buchan Kevin Buchan · Accepted Answer · 2011-04-25T18:50:09

Since you're using PowerShell 2, you can take advantage of remoting.

Try this:

Invoke-Command -ComputerName atliis03 -ScriptBlock { Get-EventLog -LogName Application -newest 100 }

If you are doing many servers, you may want to kick off the process as a background job:

$job = Invoke-Command -ComputerName atliis03 -ScriptBlock { Get-EventLog -LogName Application -newest 100 } -AsJob

Then, you can come back and get the results:

Receive-Job $job

The Get-Job command will show you the status of all running jobs.

Hope this helps.

Powershell Get-EventLog returning events one at a time

1 Answers