Get-EventLog – valid message missing for some event log sources


I’m pulling and filtering System Event Log data using get-eventlog. What I’m finding is that get-event log is not able to correctly return the message associated with some entries. These entries appear normally in the event log viewer. E.g.

returns 8 entries, all of which have a message of the following form:

If I filter the system event log for the same source, I can clearly see the fully formed message. e.g

I ran the following to see if any other providers were unable to return valid event messages:

I checked in the event log viewer to find the corresponding entries for the DCOM, WinRM and Iphlpsvc sources and confirmed that the correct message was visible.

I’ve run the test scripts in a admin-level PowerShell console.

Any ideas?

EDIT: Further research has revealed that PsLogList also appears to suffer from the same problem, whereas WEVTUTIL does not.

EDIT: Following suggestion by Windos, I tried get-winevent. I had tried this previously and found that it would return no Message data at all. I tried again and found the same result. I then tried

which produced the following error

A little googling led me to ‘‘ who had also experienced the same error message. He suggested this was due to regional settings. I’m in Australia, so my ‘format’ setting in Control Panel was ‘English (Australia)’. I changed this to ‘English (United States)’, launched a new PS console, confirmed with get-culture that I was now in the US and re-ran the get-winevent commands.

lo and behold …

Sadly though – no change got get-eventlog


Not sure on the how or why, but it looks like if you opt for Get-WinEvent rather than Get-EventLog you’ll get the info you’re after.

It should be noted that when changing commands the ‘Source’ parameter is known as ‘ProviderName’ so your command becomes:


Get-EventLog – valid message missing for some event log sources by licensed under CC BY-SA | With most appropriate answer!

Leave a Reply