{"id":13371,"date":"2011-07-09T00:01:00","date_gmt":"2011-07-09T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2011\/07\/09\/use-powershell-to-troubleshoot-windows\/"},"modified":"2011-07-09T00:01:00","modified_gmt":"2011-07-09T00:01:00","slug":"use-powershell-to-troubleshoot-windows","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-troubleshoot-windows\/","title":{"rendered":"Use PowerShell to Troubleshoot Windows"},"content":{"rendered":"

<\/a>Summary<\/b>: Learn how to use Windows PowerShell to troubleshoot Windows by working with ETW logs.<\/p>\n

 <\/p>\n

Weekend Scripter: Troubleshooting Windows<\/h2>\n

Microsoft Scripting Guy Ed Wilson here. I do not know about you, but I enjoy troubleshooting Microsoft Windows. There is something rewarding about seeing a problem, diagnosing the problem, and resolving the issue. With Windows 7, troubleshooting is quite a bit easier than it was in previous versions. One reason for this is because of all the new diagnostic logs that are available (these logs first became available with Windows Vista and Windows Server 2008; they are also available in Windows Server 2008 R2). The Event Tracing for Windows (ETW) logs are visible in Event Viewer as seen in the figure that follows.<\/p>\n

\"Image<\/a><\/p>\n

Two things must happen before using the analytic and debug logs. The first is to make them visible. To do this, open Event Viewer by typing eventvwr in Windows PowerShell; or, click the Start<\/b> button, click Control Panel<\/b>, click Administrative Tools<\/b>, and then click Event Viewer<\/b>. On the View<\/b> menu in Event viewer, click Show Analytic and Debug Logs<\/b>, which is shown in the following figure.<\/p>\n<\/p>\n

The second thing that must happen before using one of the analytic and debug logs is enabling the specific log. In most cases, these advanced analytic and debug logs are disabled because of performance reasons, so they must be specifically enabled. To enable a trace log, right-click the specific log and click Enable Log<\/b> in the shortcut menu, as shown in the following figure.<\/p>\n

\"Image<\/a><\/p>\n

Note<\/b>   Keep in mind that enabling a trace log requires administrator rights. If you attempt to enable the trace log without administrator rights, an “Access is denied” will be displayed. You must click OK<\/b>, and restart Event Viewer with administrator rights. If the account you used to click Show Analytic and Debug Logs<\/b> in the View<\/b> menu is different from the one with administrator rights, you will need to reselect the option to show the analytic and debug logs.   <\/p>\n

The best way to see how to work with the ETW logs is to “play around” with them. Enable the WMI-Activity Trace log by right clicking the log name and choosing Enable Log<\/b> from the shortcut menu. A warning message appears that states that you might lose events when enabled, but there are no events in the log anyway, so the message doesn’t apply in this case. The warning appears in the following figure.<\/p>\n

\"Image<\/a><\/p>\n

After the WMI-Activity Trace log is enabled, generate some WMI activity by performing a query via the Get-WMIObject<\/b> cmdlet. Here is the command I use:<\/p>\n

Get-WmiObject win32_bios<\/p>\n

Now disable the WMI-Activity Trace log by right clicking it in Event Viewer and then clicking Disable Log<\/b>. Press F5 to refresh the view of the WMI-Activity Trace log, and the logging activity seen in the following figure is shown.<\/p>\n

\"Image<\/a> <\/p>\n

The Get-WinEvent<\/b> Windows PowerShell cmdlet is used to query ETW logs. The first task is to find the WMI-Activity Trace log.<\/p>\n

It is possible to use wild cards to assist in finding trace logs. Unfortunately, when I attempt this nothing is returned. This command and its associated error output are shown here:<\/p>\n

PS C:\\Windows\\system32> Get-WinEvent -ListLog *wmi* | select logname<\/p>\n

Get-WinEvent : There is not an event log on the localhost computer that matches “*wmi*”.<\/p>\n

At line:1 char:13<\/p>\n

+ Get-WinEvent <<<<  -ListLog *wmi* | select logname<\/p>\n

    + CategoryInfo          : ObjectNotFound: (:) [Get-WinEvent], Exception<\/p>\n

    + FullyQualifiedErrorId : NoMatchingLogsFound,Microsoft.PowerShell.Commands.GetWinEventCommand<\/p>\n

 <\/p>\n

PS C:\\Windows\\system32><\/p>\n

 <\/p>\n

An error appears because you must make analytic and debug logs visible to the Get-WinEvent<\/b> cmdlet by using the force<\/i> switched parameter. The revised command and associated output are shown here:<\/p>\n

PS C:\\Windows\\system32> Get-WinEvent -ListLog *wmi* -force | select logname<\/p>\n

 <\/p>\n

LogName<\/span><\/p>\n

Microsoft-Windows-EventLog-WMIProvider\/Debug<\/p>\n

Microsoft-Windows-WMI-Activity\/Trace<\/p>\n

 <\/p>\n

There are two logs that match the wildcard character pattern *wmi*<\/b>. No problem! I add the word trace<\/b> to the end of my wildcard character pattern, and now I retrieve only the log name I am interested in viewing. The command and associated output are shown here:<\/p>\n

PS C:\\Windows\\system32> Get-WinEvent -ListLog *wmi*trace -force | select logname<\/p>\n

 <\/p>\n

LogName<\/p>\n

——-<\/p>\n

Microsoft-Windows-WMI-Activity\/Trace<\/p>\n

 <\/p>\n

Because the wildcard character pattern only returns a single item, it is possible to retrieve the log name directly by using a dotted notation. When completed, I can use the Get-WinEvent<\/b> cmdlet to retrieve contents from the WMI trace log file. Unfortunately, an error occurs. The command and associated error are shown here:<\/p>\n

PS C:\\Windows\\system32> $wmiLog = (Get-WinEvent -ListLog *wmi*trace -force).logname<\/p>\n

PS C:\\Windows\\system32> Get-WinEvent -LogName $wmilog<\/p>\n

Get-WinEvent : The Microsoft-Windows-WMI-Activity\/Trace event log can be read only in the forward chronological order because it is an analytical or a debug log. To see events from the Microsoft-Windows-WMI-Activity\/Trace event log, use the Oldest parameter in the command.<\/p>\n

At line:1 char:13<\/p>\n

+ Get-WinEvent <<<<  -LogName $wmilog<\/p>\n

    + CategoryInfo          : InvalidArgument: (Microsoft-Windows-WMI-Activity\/Trace:String) [Get-WinEvent], Exception<\/p>\n

    + FullyQualifiedErrorId : SpecifyOldestForLog,Microsoft.PowerShell.Commands.GetWinEventCommand<\/p>\n

 <\/p>\n

The needed clue appears in the error message, “…use the Oldest parameter in the command.” After I modify the command, the command works. The revised command and associated output are shown here:<\/p>\n

PS C:\\Windows\\system32> Get-WinEvent -LogName $wmilog -Oldest<\/p>\n

 <\/p>\n

TimeCreated<\/span>                               ProviderName<\/span>                                         Id Message<\/span><\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 398; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 402<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 403<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 401<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 404<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 405<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 406; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 406<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 407<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               1 GroupOperationId = 399; Op…<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 408<\/p>\n

7\/6\/2011 6:03:51 PM                  Microsoft-Windows-WMI-Acti…               2 ProviderInfo for GroupOper…<\/p>\n

7\/6\/2011 6:04:01 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 400<\/p>\n

7\/6\/2011 6:04:42 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 387<\/p>\n

7\/6\/2011 6:04:42 PM                  Microsoft-Windows-WMI-Acti…               3 Stop OperationId = 398 <\/p>\n

 <\/p>\n

PS C:\\Windows\\system32><\/p>\n

 <\/p>\n

Well, that is enough for a Saturday. Tomorrow, I have a great guest article by James Brundage. On Monday, I will pick up where we left off today, and we will begin to analyze the WMI trace log. For more information about using the Get-WinEvent<\/b> cmdlet, refer to this collection of Hey, Scripting Guy! Blog posts<\/a>.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy <\/b><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Learn how to use Windows PowerShell to troubleshoot Windows by working with ETW logs.   Weekend Scripter: Troubleshooting Windows Microsoft Scripting Guy Ed Wilson here. I do not know about you, but I enjoy troubleshooting Microsoft Windows. There is something rewarding about seeing a problem, diagnosing the problem, and resolving the issue. With Windows […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[97,98,31,60,3,4,134,61,45,6],"class_list":["post-13371","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-event-logs","tag-logs-and-monitoring","tag-operating-system","tag-performance","tag-scripting-guy","tag-scripting-techniques","tag-troubleshooting","tag-weekend-scripter","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"

Summary: Learn how to use Windows PowerShell to troubleshoot Windows by working with ETW logs.   Weekend Scripter: Troubleshooting Windows Microsoft Scripting Guy Ed Wilson here. I do not know about you, but I enjoy troubleshooting Microsoft Windows. There is something rewarding about seeing a problem, diagnosing the problem, and resolving the issue. With Windows […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/13371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=13371"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/13371\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=13371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=13371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=13371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}