I wanted to display only the EventLogLevels related to ActiveSync. I thought I would type: Get-EventLogLevel *Active* That does not work. Yet, Get-Service *Exch* works just fine. --------------------------------------------------------- [PS] C:\>Get-Service *Exch* Status Name DisplayName ------ ---- ----------- Running MSExchangeADTop... Microsoft Exchange Active Directory... Running MSExchangeAntis... Microsoft Exchange Anti-spam Update Running MSExchangeEdgeSync Microsoft Exchange EdgeSync Running MSExchangeFDS Microsoft Exchange File Distribution Stopped MSExchangeImap4 Microsoft Exchange IMAP4 Running MSExchangeIS Microsoft Exchange Information Store Running MSExchangeMailb... Microsoft Exchange Mailbox Assistants Running MSExchangeMailS... Microsoft Exchange Mail Submission Stopped MSExchangeMonit... Microsoft Exchange Monitoring Stopped MSExchangePop3 Microsoft Exchange POP3 Running MSExchangeRepl Microsoft Exchange Replication Service Running MSExchangeSA Microsoft Exchange System Attendant Running MSExchangeSearch Microsoft Exchange Search Indexer Running MSExchangeServi... Microsoft Exchange Service Host Running MSExchangeTrans... Microsoft Exchange Transport Running MSExchangeTrans... Microsoft Exchange Transport Log Se... Running msftesql-Exchange Microsoft Search (Exchange) Stopped wsbexchange Microsoft Exchange Server Extension... [PS] C:\>Get-EventLogLevel *Active* Get-EventLogLevel : The operation could not be performed because '*Active*' could not be found. At line:1 char:18 + Get-EventLogLevel <<<< *Active* [PS] C:\>Get-EventLogLevel *Act* Identity EventLevel -------- ---------- MSExchange Cluster\Action Lowest [PS] C:\>Get-EventLogLevel *ActiveSync* Get-EventLogLevel : The operation could not be performed because '*ActiveSync*' could not be found. At line:1 char:18 + Get-EventLogLevel <<<< *ActiveSync*

Get-eventloglevel gives you the details about different logging levels set. To filter eventlogs related to any particular property, try get-eventlog you can find examples by executing get-help get-eventlog get-help get-eventlog -examples get-help get-eventlog -full get-help get-eventlog -detailed. Sumanth G

[PS] C:\>get-eventloglevel "MSExchange ActiveSync\Requests" Identity -------- MSExchange ActiveSync\Requests ####################### So it's OK with complete name ####################### [PS] C:\>get-eventloglevel | where {$_.Identity -like "ActiveSync"} [PS] C:\>get-eventloglevel | where {$_.Identity -contains "ActiveSync"} [PS] C:\>get-eventloglevel | where {$_.Identity -contains ActiveSync} You must provide a value expression on the right-hand side of the '-contains' operator. At line:1 char:49 + get-eventloglevel | where {$_.Identity -contains <<<< ActiveSync} ?????????????????????????????? ############################ OK, got it on match. ########################### [PS] C:\>get-eventloglevel | where {$_.identity -match "ActiveSync"} Identity -------- MSExchange ActiveSync\Requests MSExchange ActiveSync\Configuration

get-eventloglevel |? {$_.identity -like "*activesync*"} | ft -auto[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

So what is, exactly, the difference between: -like -contains - match ???

-like and -match are string operators. -like is a wildcard operator. It uses wildcard matches like * and ?. -match uses a regular expression match. -contains is an array operator, it checks to see if an array contains a specified element.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "