If you need to export the System or Application event log from host which is running Windows Server Core you can follow the steps below:
- Navigate to the host where the Windows Server Core is running
- Open PowerShell with elevated permissions
- Paste one the following command in the PowerShell console:
- System event log
wevtutil epl System C:\System_Event_Log.evtx
- Application event log
wevtutil epl Application C:\Application_Event_Log.evtx
-
Hyper-V VMMS event log
wevtutil epl Microsoft-Windows-Hyper-V-VMMS-Admin C:\VMMS_Admin_Log.evtx
- System event log
4. Once completed the commands will export full unfiltered event logs (System or Application) in the root of C:\ drive.