Eventlog sources

Collecting system events for a specific source

 
# Store the current System log in the variable TempSystemLog
$TempSystemLog = (Get-WinEvent -LogName System)                                                                      
Then pipe the variable to the appropriate filter

($TempSystemLog | ? {$_.ProviderName -eq "NTFS"   })         
($TempSystemLog | ? {$_.ProviderName -eq "Volsnap"})         
($TempSystemLog | ? {$_.ProviderName -eq "Disk"   })   
 
 Add “FT –Autosize” it will display more of the message text on the screen 
| FT –Autosize

For users of the iSCSI Initiator, the following events sources are interesting:

• iSCSI
• iSCSIPrt
• MSiSCSI

For users of MPIO:

• MPIO
• MSDSM

Other Storage events of interest:

• Partition Manager (partmgr)
• Volume Manager (volmgr)
• ClassPNP