Get Windows Event Log Age with PowerShell script

The Windows Event Logs should at least stay on the system for 7 days so you can look into them for troubleshooting or any other purposes. By default, event logs will be overwritten when the maximum event log size is reached. This means that you will not have enough log history, which can cause problems. In this article, you will learn how to get the Windows Event Log Age with PowerShell script.

Windows Event Log Age PowerShell script

The Get-EventLogAge.ps1 PowerShell script will check all the event log folders on the system and provide you a report with the information below:

1. LogName
2. OldestEventDate
3. NewestEventDate
4. DaysSinceOldestEvent
5. MaxSizeMB
6. PercentageUsed

Download Windows Event Log Age PowerShell script

Create two folders on the (C:) drive:

Download and place Get-EventLogAge.ps1 PowerShell script on the system C:\scripts folder. If you don’t have a scripts folder, create one.

Ensure that the file is unblocked to prevent any errors when running the script. Read more in the article Not digitally signed error when running PowerShell script.

Another option is to copy and paste the below code into Notepad. Give it the name Get-EventLogAge.ps1 and place it in the C:\scripts folder.

<#
    .SYNOPSIS
    Get-EventLogAge.ps1

    .DESCRIPTION
    Export the oldest and newest event logs dates to a CSV file.

    .LINK
    www.alitajran.com/get-windows-event-log-age-powershell-script/

    .NOTES
    Written by: ALI TAJRAN
    Website:    www.alitajran.com
    LinkedIn:   linkedin.com/in/alitajran

    .CHANGELOG
    V1.00, 08/22/2024 - Initial version
#>

# CSV file path to export
$CsvPath = "C:\temp\EventLogAgeReport.csv"

# Get the current date
$currentDate = Get-Date

# Get all log names
$logNames = Get-WinEvent -ListLog * | Select-Object -ExpandProperty LogName

# Create an array to hold the results
$results = @()

# Iterate through each log and find the oldest and newest events
foreach ($logName in $logNames) {
    # Get the oldest event directly
    $oldestEvent = Get-WinEvent -LogName $logName -MaxEvents 1 -Oldest -ErrorAction SilentlyContinue |
    Select-Object -Property TimeCreated

    # Get the newest event directly
    $newestEvent = Get-WinEvent -LogName $logName -MaxEvents 1 -ErrorAction SilentlyContinue |
    Select-Object -Property TimeCreated

    # Get the log's maximum size and current size
    $logInfo = Get-WinEvent -ListLog $logName

    $maxSize = [math]::Round($logInfo.MaximumSizeInBytes / 1048576, 2)
    $currentSize = [math]::Round($logInfo.FileSize / 1048576, 2)

    if ($maxSize -ne 0) {
        $percentageUsed = [math]::Round(($currentSize / $maxSize) * 100, 2)
    }
    else {
        $percentageUsed = "N/A"
    }

    if ($oldestEvent) {
        # Calculate the number of days since the oldest event
        $daysAgo = ($currentDate - $oldestEvent.TimeCreated).Days

        $results += [PSCustomObject]@{
            LogName              = $logName
            OldestEventDate      = $oldestEvent.TimeCreated
            NewestEventDate      = $newestEvent.TimeCreated
            DaysSinceOldestEvent = "$daysAgo"
            MaxSizeMB            = "$maxSize MB"
            PercentageUsed       = "$percentageUsed %"
        }
    }
    else {
        $results += [PSCustomObject]@{
            LogName              = $logName
            OldestEventDate      = "No events found"
            NewestEventDate      = "No events found"
            DaysSinceOldestEvent = "N/A"
            MaxSizeMB            = "$maxSize MB"
            PercentageUsed       = "$percentageUsed %"
        }
    }
}

# Export the results to a CSV file
$results | Export-Csv -Path $CsvPath -NoTypeInformation

This is how it looks.

Run Get Windows Event Log Age PowerShell script

Export the Windows Event Logs age report to CSV file.

Run PowerShell as administrator and run the below command.

C:\scripts\.\Get-EventLogAge.ps1

Find the file EventLogAgeReport.csv in the path C:\temp.

Open the CSV file with your favorite application. In our example, it’s Microsoft Excel.

The report looks great!

Read more: Active Directory health check with PowerShell script »

Conclusion

You learned how to get Windows Event Log Age with PowerShell script. Run the script and look at the report for all the details. Remember to have at least 7 days of event logs history available for the folders that are important to you.

Did you enjoy this article? You may also like Check free disk space on Windows with PowerShell script. Don’t forget to follow us and share this article.