diff --git a/src/Microsoft.PowerShell.Commands.Diagnostics/GetEventCommand.cs b/src/Microsoft.PowerShell.Commands.Diagnostics/GetEventCommand.cs
index c7a07bab6ec..0ce68a31d73 100644
--- a/src/Microsoft.PowerShell.Commands.Diagnostics/GetEventCommand.cs
+++ b/src/Microsoft.PowerShell.Commands.Diagnostics/GetEventCommand.cs
@@ -518,9 +518,11 @@ private void ProcessListLog()
||
(wildLogPattern.IsMatch(logName)))
{
+ EventLogConfiguration logObj;
+ EventLogInformation logInfoObj;
try
{
- EventLogConfiguration logObj = new(logName, eventLogSession);
+ logObj = new EventLogConfiguration(logName, eventLogSession);
//
// Skip direct channels matching the wildcard unless -Force is present.
@@ -533,19 +535,25 @@ private void ProcessListLog()
continue;
}
- EventLogInformation logInfoObj = eventLogSession.GetLogInformation(logName, PathType.LogName);
-
- PSObject outputObj = new(logObj);
+ bMatchFound = true;
+ logInfoObj = eventLogSession.GetLogInformation(logName, PathType.LogName);
+ }
+ catch (UnauthorizedAccessException exc)
+ {
+ string exceptionMsg = string.Format(CultureInfo.InvariantCulture, GetEventResources.LogInfoNoAccess, logName);
+ var newExc = new UnauthorizedAccessException(exceptionMsg, exc);
- outputObj.Properties.Add(new PSNoteProperty("FileSize", logInfoObj.FileSize));
- outputObj.Properties.Add(new PSNoteProperty("IsLogFull", logInfoObj.IsLogFull));
- outputObj.Properties.Add(new PSNoteProperty("LastAccessTime", logInfoObj.LastAccessTime));
- outputObj.Properties.Add(new PSNoteProperty("LastWriteTime", logInfoObj.LastWriteTime));
- outputObj.Properties.Add(new PSNoteProperty("OldestRecordNumber", logInfoObj.OldestRecordNumber));
- outputObj.Properties.Add(new PSNoteProperty("RecordCount", logInfoObj.RecordCount));
+ string recommendationMsg = GetEventResources.SuggestElevation;
+ var eRecord = new ErrorRecord(newExc, "LogInfoNoAccess", ErrorCategory.PermissionDenied, logName)
+ {
+ ErrorDetails = new ErrorDetails(string.Empty)
+ {
+ RecommendedAction = recommendationMsg
+ }
+ };
- WriteObject(outputObj);
- bMatchFound = true;
+ WriteError(eRecord);
+ continue;
}
catch (Exception exc)
{
@@ -556,6 +564,16 @@ private void ProcessListLog()
WriteError(new ErrorRecord(outerExc, "LogInfoUnavailable", ErrorCategory.NotSpecified, null));
continue;
}
+
+ PSObject outputObj = new(logObj);
+ outputObj.Properties.Add(new PSNoteProperty("FileSize", logInfoObj.FileSize));
+ outputObj.Properties.Add(new PSNoteProperty("IsLogFull", logInfoObj.IsLogFull));
+ outputObj.Properties.Add(new PSNoteProperty("LastAccessTime", logInfoObj.LastAccessTime));
+ outputObj.Properties.Add(new PSNoteProperty("LastWriteTime", logInfoObj.LastWriteTime));
+ outputObj.Properties.Add(new PSNoteProperty("OldestRecordNumber", logInfoObj.OldestRecordNumber));
+ outputObj.Properties.Add(new PSNoteProperty("RecordCount", logInfoObj.RecordCount));
+
+ WriteObject(outputObj);
}
}
diff --git a/src/Microsoft.PowerShell.Commands.Diagnostics/resources/GetEventResources.resx b/src/Microsoft.PowerShell.Commands.Diagnostics/resources/GetEventResources.resx
index f8f41ecc2f5..53bf9afe0e3 100644
--- a/src/Microsoft.PowerShell.Commands.Diagnostics/resources/GetEventResources.resx
+++ b/src/Microsoft.PowerShell.Commands.Diagnostics/resources/GetEventResources.resx
@@ -255,6 +255,12 @@ The defined template is following:
To access the '{0}' log start PowerShell with elevated user rights. Error: {1}
+
+ Access denied for log: '{0}'.
+
+
+ Launch PowerShell with elevated user rights.
+
Cannot retrieve event message text.