Mining Exchange 2007 & 2010 Events to a HTML File using Powershell

Whereas the Windows event viewer allows for you to filter events, it can be a little time consuming whilst working out the various settings that you wish to have in order to get the information that you want.
The following Powershell script is simple to use and only needs two items of information which it asks for upon execution:

1.       A value that appears in the “Event Source” part of the event log entry – e.g.  MSExchange ADAccess

2.       The type of event that you would like to mine – e.g. Information, Warning, Error

In order to use the script – copy it into a new PS1 file on the Exchange server that you would like to mine, and then execute it from either the Exchange Management Console or the Powershell console.

$date = Get-Date


$Outfile = "c:\ExchangeRep{0}{1:d2}{2:d2}-{3:d2}{4:d2}.htm" -f $date.year,$date.month,$,$date.hour,$date.minute


$htmFormat = ""

$htmFormat = $htmFormat + "BODY{background-color:white;}"

$htmFormat = $htmFormat + "TABLE{border-width: 1px;border-style: solid;border-color: black;border-collapse: collapse;}"

$htmFormat = $htmFormat + "TH{border-width: 1px;padding: 1px;border-style: solid;border-color: black;background-color:white;font-family: Tahoma}"

$htmFormat = $htmFormat + "TD{border-width: 1px;padding: 1px;border-style: solid;border-color: black;background-color:white;font-family: Tahoma;font-size: 12px}"

$htmFormat = $htmFormat + ""


Write-Host "Exchange Event Log Miner Example"

Write-Host ""


$eventSource = Read-Host "Please enter in part of the Event Source – e.g. Transport,Mailbox,Search,Assistants "


Write-Host ""

Write-Host "What type of event would you like to report on?"

Write-Host ""

Write-Host "1. Information"

Write-Host "2. Warning"

Write-Host "3. Error"

Write-Host ""

$Choice = Read-Host "Please make a numerical choice from above"



If($Choice -eq 1){


      $evtType = "Information"


}elseif($Choice -eq 2){


      $evtType = "Warning"         


}elseif($Choice -eq 3){


      $evtType = "Error"




            Write-Host "You have made an incorrect choice – please try again!" -ForegroundColor Red




Get-EventLog -LogName "Application" | Select EventID,Time,EntryType,Source,Message | Where {$_.EntryType -eq $evtType -and $_.Source -like "*$eventSource*"} | ConvertTo-Html -Head $htmFormat -Title "Exchange Event Log Report" | Out-File $Outfile


Invoke-Expression $Outfile

About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top