PsLogList is a free Microsoft Sysinternals command-line utility for reading Windows Event Log records. It can display local or remote logs, filter records by time, event ID, source, or event type, and format output as delimiter-separated lines for text processing. Its -w option follows new events on the local computer; its -c option clears a log after displaying it, so use that option only when clearing is intentional.
What PsLogList does
PsLogList is part of Microsoft’s PsTools utilities. Microsoft lists version 2.82, released March 30, 2023, with the description “Dump event log records.” It uses the Windows Event Log API to retrieve records and loads message-source modules on the computer where the viewed log resides, helping display event messages correctly.
As an Amazon Associate I earn from qualifying purchases.
It is a command-line reader, not a graphical replacement for every Event Viewer workflow. It is useful when you want to inspect logs from a terminal, apply filters, query remote computers, or send delimited output into another workflow.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Install it and read a local log
Microsoft’s documented setup is to copy PsLogList to a directory on your executable path and run psloglist. With no log argument, it displays the local computer’s System Event Log in a visually formatted view.
#1 Best Overall
To request a particular log, add its name as the event-log argument. For example, psloglist Application requests the local Application log. The documented platform scope is Windows 8.1 and higher on client systems, and Windows Server 2012 and higher on servers.
Query a remote computer
Put the remote computer name, prefixed by two backslashes, before the event-log name:
psloglist \SERVER01 SystemPsLogList uses the current credentials by default. If they do not permit event-log access, the documented -u option supplies an alternate username; -p can supply a password. Microsoft describes remote access with alternate credentials as one of the utility’s distinguishing capabilities. Use those options in line with your organization’s credential-handling practices.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →psloglist \SERVER01 -u DOMAINuser SystemTo query multiple computers, use a comma-separated computer list or provide a file of computer names with @file, as shown in the documented syntax. The -w live-follow option is limited to the local system.
Rank #3
Filter records to find relevant events
PsLogList supports date boundaries, relative time windows, event IDs, event sources, and event-type filtering. Combine filters with the log name to narrow the records returned.
| Goal | Option | Meaning |
|---|---|---|
| Start at a date | -a mm/dd/yy |
Show records after the specified date. |
| Stop at a date | -b mm/dd/yy |
Show records before the specified date. |
| Limit by recent time | -m #, -h #, or -d # |
Restrict to the previous number of minutes, hours, or days. |
| Limit record count | -n # |
Show only the specified number of most recent entries. |
| Include event IDs | -i ID[,ID...] |
Include the specified event IDs; up to 10 IDs are supported. |
| Exclude event IDs | -e ID[,ID...] |
Exclude the specified event IDs; up to 10 IDs are supported. |
| Include sources | -o source[,source...] |
Include the specified event sources. |
| Omit sources | -q source[,source...] |
Omit the specified event sources. |
| Filter event types | -f filter |
Filter by event type, for example warnings. |
For example, to examine recent System log entries from a server while limiting the result to a small number of recent records, use:
psloglist \SERVER01 -d 1 -n 50 SystemHere, -d 1 selects the previous day and -n 50 limits output to the 50 most recent entries. For date-based queries, the documented date form is month/day/two-digit-year; use dates appropriate to that format.
Export delimited output for text processing
Use -s to emit one record per line with comma-delimited fields. Use -t to change the delimiter when a different separator better suits a search or ingestion workflow:
Best Value
psloglist -s -t "|" SystemThis is delimiter-separated text intended to make records easier to search or ingest. The documentation describes comma-delimited fields, but does not establish that the output is a fully escaped CSV format; verify how your downstream tool handles delimiters and field contents before treating it as a general-purpose CSV interchange file.
Follow new events or change output order
Use -w to wait for new events as they are generated. Microsoft documents this mode for the local system only, so it is not a remote live-follow option.
By default, records are displayed in the utility’s normal ordering; -r lists them from least recent to most recent. Use -x when you need extended event data included.
Recommended Free Tools
Use the clear option with care
The -c option clears the event log after displaying it. It is a destructive administrative action, not simply an output or filtering switch. Leave it out for ordinary log review, and use it only when clearing the selected log is explicitly intended.
When to use PsLogList instead of another workflow
PsLogList is a practical choice for command-line log review, repeatable filters, remote queries with alternate credentials, and simple delimited output. For graphical exploration, Event Viewer remains a distinct interface. PowerShell’s Get-WinEvent and centralized log collectors are alternatives to consider when your workflow needs their respective scripting, query, or collection capabilities. The appropriate choice depends on whether you need local or remote scope, credential handling, filtering, automation, live following, message rendering, or a read-only workflow.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
