| 用途 | 枚举日志通道、大小与启用状态 |
|---|---|
| 语法 | Get-WinEvent -ListLog *；-ListLog <名称> |
| 关注 | IsEnabled、RecordCount、MaximumSizeInBytes、LogMode |
常用示例
常用示例
Get-WinEvent -ListLog * | Where-Object RecordCount -gt 0 | Sort-Object RecordCount -Descending | Select-Object -First 20 LogName, RecordCount, IsEnabled, MaximumSizeInBytes
Get-WinEvent -ListLog 'Microsoft-Windows-GroupPolicy/Operational' | Format-List LogName, IsEnabled, LogMode, MaximumSizeInBytesOperational 类日志默认常是关闭的：排特定组件时先确认并开启再复现。