$logs = (Get-WinEvent -ListLog * | Where-Object {$_.IsEnabled}).LogName 2>$null $last = Get-Date while ($true) { $events = Get-WinEvent -FilterHashtable @{ LogName = $logs StartTime = $last } -ErrorAction SilentlyContinue if ($events) { $events = $events | Sort-Object TimeCreated $events | Select TimeCreated, LogName, Id, LevelDisplayName, Message $last = $events[-1].TimeCreated } Start-Sleep -Seconds 2 }