Why is Get-WinEvent slower than Get-EventLog when receiving events after a date?

Question

When you receive events after a certain date, Get-WinEvent seems slower than Get-EventLog:

$SourceComputer = "MyServer" $LogName = "Security" $StartDate = (get-date).AddMinutes(-30) $hashquery = @{logname=$LogName; StartTime=$StartDate} (Measure-Command -Expression {Get-WinEvent -ComputerName $SourceComputer -FilterHashTable $hashquery}).TotalSeconds (Measure-Command -Expression {Get-EventLog -Computer $SourceComputer -LogName $Logname -After $StartDate}).TotalSeconds 

Output:

 Get-WinEvent: 128.8475308 Get-EventLog: 4.5299092 

This seems strange since Get-WinEvent should work better than the older Get-EventLog function. Am I doing something wrong?

Answer 1

According to this blog post , Get-EventLog seems to be significantly slower when used with remote hosts.

Answer 2

... Get-WinEvent should work better than older Get-EventLog ...

With most options, this is correct. Get-WinEvent faster than Get-EventLog , because Get-EventLog captures the entire EventLog, then it filters locally.

However, Get-WinEvent has a few caveats, the first of which is -FilterHashtable , which has several errors .

The second is -FilterHashtable very slow, like the bottom of the blog post quoted by Ansgar Wiechers. The recommendation is to use -FilterXML