If you need to export the System or Application event log from host which is running Windows Server Core you can follow the steps below:


  1. Navigate to the host where the Windows Server Core is running

  2. Open PowerShell with elevated permissions

  3. Paste one the following command in the PowerShell console:
    1. System event log
      wevtutil epl System C:\Altaro_System_Event_Log.evtx


    2. Application event log
      wevtutil epl Application C:\Altaro_Application_Event_Log.evtx


    3. Hyper-V VMMS event log

      wevtutil epl Microsoft-Windows-Hyper-V-VMMS-Admin C:\Altaro_VMMS_Admin_Log.evtx


4. Once completed the commands will export full unfiltered event logs (System or Application) in the root of C:\ drive.