How to Create Custom Windows Event Logs and Write Events Using PowerShell

System administrators and DevOps engineers regularly develop PowerShell automation scripts to handle backup routines, database synchronisation, user onboarding, and system maintenance. While outputting execution details to flat text files is common, text logs lack structured filtering, automated alerting, and native integration with centralized Security Information and Event Management (SIEM) systems.

Windows includes a high-performance event subsystem accessible directly through PowerShell. Using the New-EventLog and Write-EventLog cmdlets, you can create dedicated custom Windows Event Logs, register application sources, and write structured operational telemetry with custom event IDs and severity classifications.

Auditing Existing Event Logs and Administrative Requirements

Creating custom event logs modifies the Windows Registry under HKLM\SYSTEM\CurrentControlSet\Services\EventLog. Consequently, PowerShell must be launched as an Administrator. You can query existing standard and custom logs using Get-EventLog:

Get-EventLog -List

Creating a Custom Event Log and Source

The New-EventLog cmdlet creates both a new log category (the container visible in Event Viewer) and an associated source (the application identifier):

New-EventLog -LogName "AutomationTasks" -Source "BackupRoutine"

Parameter Definitions:

• -LogName: The name of the event log container (e.g., AutomationTasks). This appears as an independent node under Applications and Services Logs in Windows Event Viewer.
• -Source: The specific process or script name responsible for publishing entries.

To verify that the event source was registered successfully in the system registry:

[System.Diagnostics.EventLog]::SourceExists("BackupRoutine")

Writing Informational, Warning, and Error Events

Use Write-EventLog to record operational events. The cmdlet supports standard event types (Information, Warning, Error), custom event IDs, and category codes.

1. Logging a Successful Informational Event

Write-EventLog -LogName "AutomationTasks" -Source "BackupRoutine" -EntryType Information -EventId 1001 -Message "Database backup completed successfully. Volume archived: 14.8 GB."

2. Logging a Non-Fatal Warning Event

Write-EventLog -LogName "AutomationTasks" -Source "BackupRoutine" -EntryType Warning -EventId 2001 -Message "Backup completed with warnings: 3 temporary locks encountered during snapshot."

3. Logging a Critical Error Event

Write-EventLog -LogName "AutomationTasks" -Source "BackupRoutine" -EntryType Error -EventId 3001 -Message "Backup failed: Destination storage volume unreachable (Network timeout)."

Querying and Filtering Events with Get-WinEvent

While Get-EventLog remains available for basic lookups, modern PowerShell scripts should query custom logs using Get-WinEvent, which offers superior filtering performance:

# Retrieve the 10 most recent entries from the custom log
Get-WinEvent -LogName "AutomationTasks" -MaxEvents 10 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

You can filter specifically for error events using a hashtable filter:

Get-WinEvent -FilterHashtable @{
    LogName = "AutomationTasks"
    Level = 2 # 2 represents Error, 3 represents Warning, 4 represents Information
} | Select-Object TimeCreated, Id, Message

Removing Event Sources and Deleting Custom Logs

When decommissioning an automated workflow or testing script, clean up your custom log configuration:

# Remove a specific event source
Remove-EventLog -Source "BackupRoutine"

# Delete the entire custom event log and all contained events
Remove-EventLog -LogName "AutomationTasks"

Windows immediately removes the log container from Event Viewer and cleans up the corresponding registry keys.