You would like to create a filtered Event Viewer file with specific PDQ information, include Event Viewer files (.EVTX) with your support ticket, or would like to filter PDQ events in Event Viewer.
Option 1: The easy way
You can use the following PowerShell script created by one of our devs to automagically gather PDQ event logs into an EVTX file.
$OutputPath = $env:TEMP #xPathQuery for wevutil to grab event logs from Deploy, Inventory, Inventory Agent, and .NET Runtime from the last 30 days: $xPathQuery = "*[System[Provider[@Name='PDQ Deploy' or @Name='PDQ Inventory' or @Name='.NET Runtime'] and TimeCreated[timediff(@SystemTime) <= 2592000000]]]" wevtutil export-log Application $OutputPath\PDQEventLogs.evtx /query:"$xPathQuery" /overwrite:true #export event logs to evtx file based on xPathQuery $wshell = New-Object -ComObject Wscript.Shell # Create message box $wshell.Popup("Log files saved at $OutputPath\PDQEventLogs.evtx.`n`nClick Ok to open containing folder.", 0, "PDQ Event Logs", 0x0) Invoke-Item $OutputPath #Open up the Log folder in explorer for easy access to PDQEventLogs.evtx
The script "Get-PDQEventLogs.ps1" can also be found hosted for use on our Github:
Option 2: The manual way
- Open Event Viewer (Run > eventvwr)
- Expand Windows Logs > select Application log.
- With Application log selected, in the right-hand navigation pane (Actions), select Filter Current Log...
- In the Filter Current Log window, use the Event sources drop-down to select the following three items (if they exist): PDQ Deploy, PDQ Inventory, and .NET Runtime.
- Leave everything else as-is unless you want to further filter by Event Level, and click OK.
- You should now see a filtered log view.
- Click on Action in the upper left-hand menu and select Save Filtered Log File As... or Save Selected Events...
- In the Save As window, choose a File Name (e.g. the error, the date, or your ticket number) and keep the Save as type set to Event Files (*.evtx).
- Save the <FileName>.evtx log file.
- Keep for your records or submit with your PDQ.com support ticket.