Add an event log source in Windows with PowerShell

Open Windows PowerShell as administrator and register the source in the Application log:

New-EventLog -LogName Application -Source "TestApi"

Now an app or a script can write events with the source TestApi. Run the window as administrator: to check that the name is unique, New-EventLog searches every log, including Security, which a regular user can't read.

In PowerShell 7 this command doesn't exist, and you get The term 'New-EventLog' is not recognized. What to do there is below.

Check that the source exists

# True or False; also needs an elevated window
[System.Diagnostics.EventLog]::SourceExists("TestApi")

# Works without admin rights: a source is a registry key
Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\TestApi"

A second New-EventLog with the same name fails with an error that the source is already registered. To make a script safe to rerun:

if (-not [System.Diagnostics.EventLog]::SourceExists("TestApi")) {
    New-EventLog -LogName Application -Source "TestApi"
}

Write and read events

Write-EventLog -LogName Application -Source "TestApi" `
    -EventId 1000 -EntryType Information -Message "TestApi started"

# The last five events from this source, in Windows PowerShell and PowerShell 7
Get-WinEvent -MaxEvents 5 -FilterHashtable @{
    LogName = 'Application'; ProviderName = 'TestApi'
}

-EntryType takes Error, Warning, Information, SuccessAudit or FailureAudit. -EventId goes up to 65535.

PowerShell 7 has no New-EventLog

Microsoft removed all the *-EventLog cmdlets from PowerShell 7. Use the .NET class directly or call Windows PowerShell 5.1, which ships with Windows:

# .NET API, in an elevated PowerShell 7 window on Windows
[System.Diagnostics.EventLog]::CreateEventSource("TestApi", "Application")
[System.Diagnostics.EventLog]::WriteEntry(
    "TestApi", "TestApi started", "Information", 1000)

# Or run the old command in Windows PowerShell
powershell.exe -NoProfile -Command `
    "New-EventLog -LogName Application -Source TestApi"

Microsoft points to New-WinEvent as the replacement, but it writes events for ETW providers with a manifest, not for a classic source like TestApi.

Without PowerShell: eventcreate

The eventcreate command in cmd writes an event and registers the source if it doesn't exist yet. It writes only with sources it registered itself: with TestApi from New-EventLog above it fails with ERROR: Source parameter is used to identify custom applications/scripts only (not installed applications). Give it its own name:

eventcreate /L APPLICATION /SO TestApiCmd /T INFORMATION /ID 1 ^
    /D "TestApiCmd registered"

It writes only to the Application and System logs, and the event ID must be from 1 to 1000.

Remove a source

# Windows PowerShell 5.1
Remove-EventLog -Source "TestApi"

# PowerShell 7
[System.Diagnostics.EventLog]::DeleteEventSource("TestApi")

Rules for source names

• The name is unique on the computer and can't match the name of a log.
• A source writes to one log. If you move it to another log, the change takes effect after a reboot.
• Register the source when installing the app, not right before the first write. Until Windows refreshes its list of sources, writes with a new source fail.
• If -LogName names a log that doesn't exist, New-EventLog creates it. The log appears after the first event is written, and the first eight characters of its name must differ from those of every other log.