{"id":72591,"date":"2015-10-22T00:01:00","date_gmt":"2015-10-22T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2015\/10\/22\/check-performance-of-event-log-queries\/"},"modified":"2019-02-18T09:34:49","modified_gmt":"2019-02-18T16:34:49","slug":"check-performance-of-event-log-queries","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/check-performance-of-event-log-queries\/","title":{"rendered":"Check Performance of Event Log Queries"},"content":{"rendered":"

Summary<\/b>: Ed Wilson, Microsoft Scripting Guy, talks about checking the performance of various event log queries.<\/span><\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. One of the great things about Windows PowerShell is that I can use Windows PowerShell to see how it is doing and how to optimize it. Sometimes the difference between one query and another query can be remarkable.<\/p>\n

So how can I do performance monitoring for a command? I use the Measure-Command<\/b> cmdlet. Here is an example of such a command:<\/p>\n

Measure-Command -Expression {Get-EventLog -LogName application}<\/p>\n

This command uses the Get-EventLog<\/b> cmdlet to read the entire contents of the application log. The output from the command is shown here:<\/p>\n

\"Image<\/a><\/p>\n

If I want to compare this with the Get-WinEvent<\/b> log command, I use a filter hash table that selects all entries from the application log:<\/p>\n

Measure-Command -Expression {Get-WinEvent @{logname='application'}}<\/p>\n

The output from this command is shown here:<\/p>\n

\"Image<\/a><\/p>\n

The first command takes less than a second, and the second command takes nearly 20 seconds. Dude, that is significant.<\/p>\n

What if I filter on event types? I only want errors. Here is the first command:<\/p>\n

Measure-Command -Expression {Get-EventLog -LogName application -EntryType error}<\/p>\n

The output is shown here:<\/p>\n

\"Image<\/a><\/p>\n

It is a little bit faster than the original command, but basically they are the same—less than a second difference.<\/p>\n

Here is the same command for the Get-WinEvent<\/b> cmdlet:<\/p>\n

Measure-Command{Get-WinEvent @{logname='application';level=2 }}<\/p>\n

The output is shown here:<\/p>\n

\"Image<\/a><\/p>\n

Interestingly enough, although the “get everything from the application log” command of Get-WinEvent<\/b> was really slow, it speeds up considerably when also filtering for the entry type. In fact, it came out a little faster than the Get-EventLog<\/b> command.<\/p>\n

What about when filtering with the event ID in addition to the event level? Well, here is the command for Get-EventLog<\/b>:<\/p>\n

Measure-Command -Expression {Get-EventLog -LogName application -EntryType error -InstanceId 490}<\/p>\n

The output tells me that basically it does not make much difference for the Get-EventLog<\/b> cmdlet. 827 milliseconds or 767 milliseconds are essentially the same.<\/p>\n

\"Image<\/a><\/p>\n

What about adding the event log event ID to the Get-WinEvent<\/b> cmdlet?<\/p>\n

Measure-Command -Expression {Get-EventLog -LogName application -EntryType error -InstanceId 490}<\/p>\n

Here is the output:<\/p>\n

\"Image<\/a><\/p>\n

By adding an event ID to the query, we again speed it up a lot. 61 milliseconds as opposed to 709 milliseconds.<\/p>\n

Note<\/b>  Subsecond comparisons for Measure-Command<\/b> are not really very accurate, and therefore, they should be taken with a grain of salt<\/a>. The key is that it again appears to be faster.<\/p>\n

If I add a date to the filter with Get-EventLog<\/b>, it does not appear to make much difference:<\/p>\n

Measure-Command -Expression {Get-EventLog -LogName application -EntryType error -InstanceId 490 -After 10\/1\/2015}<\/p>\n

Adding the start time to the Get-WinEvent<\/b> query also does not make much difference:<\/p>\n

Measure-Command{Get-WinEvent @{logname='application';level=2;id=490;Starttime='10\/1\/2015'}}<\/p>\n

The two commands and their associated output are shown here:<\/p>\n

\"Image<\/a><\/p>\n

That is all there is to using Measure-Command<\/b> to check the performance of different queries. Join me tomorrow when I will begin a video recap of event log querying. <\/span><\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Ed Wilson, Microsoft Scripting Guy, talks about checking the performance of various event log queries. Microsoft Scripting Guy, Ed Wilson, is here. One of the great things about Windows PowerShell is that I can use Windows PowerShell to see how it is doing and how to optimize it. Sometimes the difference between one query […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[632,98,3,45],"class_list":["post-72591","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-events","tag-logs-and-monitoring","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Ed Wilson, Microsoft Scripting Guy, talks about checking the performance of various event log queries. Microsoft Scripting Guy, Ed Wilson, is here. One of the great things about Windows PowerShell is that I can use Windows PowerShell to see how it is doing and how to optimize it. Sometimes the difference between one query […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/72591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=72591"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/72591\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=72591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=72591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=72591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}