--- title: "Decipher SCCM Client Logs with PowerShell" description: "Read and interpret SCCM client logs effortlessly using PowerShell. Step-by-step guide inside." canonical: "https://adamtheautomator.com/sccm-client-logs/" --- # Decipher SCCM Client Logs with PowerShell > Read and interpret SCCM client logs effortlessly using PowerShell. Step-by-step guide inside. Source: https://adamtheautomator.com/sccm-client-logs/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Decipher SCCM Client Logs with PowerShell](https://adamtheautomator.com/wp-content/uploads/2019/06/5d238ae5c824b514689ea5b1.jpg) # Decipher SCCM Client Logs with PowerShell [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)30 June 20194 min. read Categories: [IT Ops](/category/it-ops/) Tags:[PowerShell](/tag/powershell/)[SCCM](/tag/sccm/) Table of Contents * [Reading SCCM Client Logs with PowrShell](#h-reading-sccm-client-logs-with-powrshell) * [Creating Your own SCCM Client Logs](#h-creating-your-own-sccm-client-logs) * [Start-Log](#start-log) * [Write-Log](#write-log) * [How it Works](#how-it-works) If you’re an SCCM admin, you’re probably familiar with the [CMtrace](https://docs.microsoft.com/en-us/mem/configmgr/core/support/cmtrace) log-reading tool. CMTrace knows the specific schema of SCCM client logs but did you know you can use PowerShell much like CMTrace? Using PowerShell, you can read: * SCCM client software install logs * SCCM client software update logs * SCCM client hardware inventory logs ..and just about all the rest of them! SCCM client logs follow a certain schema. To get some kind of standardized output from them, you have to understand that schema. Luckily, for you, that’s already been done. ## Reading SCCM Client Logs with PowrShell Take a look at the PowerShell code below that queries SCCM client logs. This `Get-SCCMClientLog` PowerShell function has two parameters; `ComputerName` and `LogName` allowing you to query remote computers and specify the log name you’d like to view. **_Related: [PowerShell Function Introduction](https://adamtheautomator.com/powershell-functions/)_** Once you make this function available in your PowerShell console, you can then run it like below. The example below would query the remote computer called PC and retrieve the execmgr log file. ```powershell Get-SccmClientLog -ComputerName PC -LogName execmgr ``` All of the heavy-lifting has already been done for you in the function. ## Creating Your own SCCM Client Logs What if you want to use the `Get-SCCMClientLog` function but for other purposes. You can create your own SCCM client-like log files too! ![](https://adamtheautomator.com/wp-content/uploads/2020/12/image-1.png) CMTrace example Just look at the beauty of the sortable columns and the red highlighting! At first, you might think that you can view any kind of text log in CMTrace and you’d be right. However, let’s a look at the _WindowsUpdate.log_ file in CMTrace. ![](https://adamtheautomator.com/wp-content/uploads/2020/12/image-2.png) WindowsUpdate.log file Notice all the columns are gone? CMTrace will still view regular log files but you won’t get some of the features that make CMTrace great. You’ll soon find that a text file has to be properly formatted in order to get all of those helpful columns to show up and to properly define which lines should be highlighted yellow vs. red. vs. nothing at all. I’d like to show you a couple of PowerShell functions called `Write-Log` and `Start-Log`. These functions were specifically built to record your script’s activity to a log file which can then be read in CMTrace. By the end of this post, you will have a function that you can call in your scripts to build log files in a way for CMTrace to read them properly. ### Start-Log To prevent having to specify the same SCCM client log file path over and over again I chose to create a function called `Start-Log`. This function is intended to be called at the top of your script. This function simply creates a text file and (the important part) sets a global variable called `ScriptLogFilePath`. ```powershell [CmdletBinding()] param ( [ValidateScript({ Split-Path $_ -Parent | Test-Path })] [string]$FilePath ) try { if (!(Test-Path $FilePath)) { ## Create the log file New-Item $FilePath -Type File | Out-Null } ## Set the global variable to be used as the FilePath for all subsequent Write-Log calls in this session $global:ScriptLogFilePath = $FilePath } catch { Write-Error $_.Exception.Message } ``` This function is super-simple. However, is required to prevent us from having to pass `LogFile` every, single time we need to call our `Write-Log` function in our scripts. By simply creating a global variable ahead of time, we can then simply call `Write-Log` and it will know the log file path. ### Write-Log Once you’ve called `Start-Log` in your script, you are now able to run `Write-Log` to write SCCM client log messages to the log file. `Write-Log` has two parameters; `Message` and `LogLevel`. `Message` is easy. That’s simply what you’d like to write to the log. `LogLevel` requires some explaining. To get CMTrace to highlight lines as red or yellow the line needs to be recorded a certain way. More specifically, it needs to have a string like this: `type="1"`. This type of key can be 1,2 or 3. These indicate levels of severity in your script. For example, if I’d like to log a simple informational message, then that’d be a `1`. If I’d like to log a more severe activity then I might use `2` which would get highlighted yellow. Finally, I might choose `3` if I’d like that line highlighted red in CMTrace. ```powershell param ( [Parameter(Mandatory = $true)] [string]$Message, [Parameter()] [ValidateSet(1, 2, 3)] [int]$LogLevel = 1 ) ``` Notice the `LogLevel` parameter? By default, it will set that to a `1` but you are always able to override that if necessary if you’d like to write some more severe activity that happens during your script’s execution. Next, you need that handy date/time column to show up right. To do this required a specific date/time format that is achieved by this string manipulation wizardry. ```powershell $TimeGenerated = "$(Get-Date -Format HH:mm:ss).$((Get-Date).Millisecond)+000" ``` Next is where I’ll build a log line’s template using all of the appropriate format that the line needs to have to show up correctly in CMTrace. ```powershell $Line = '' ``` After you’ve got the template it’s then a matter of building what’s going to go in the `{}` ‘s. Here, I build an array which I will then pass into the `$Line` to replace all of our `{}` ‘s with real information. ```powershell $LineFormat = $Message, $TimeGenerated, (Get-Date -Format MM-dd-yyyy), "$($MyInvocation.ScriptName | Split-Path -Leaf):$($MyInvocation.ScriptLineNumber)", $LogLevel ``` These are in the same order as the `{}` ‘s above. `{0}` will get converted to `$Message`, `{1}` will get converted to `$TimeGenerated`, `{2}` will get converted to today’s date and `{4}` will get converted to `$LogLevel`. Notice I skipped `{3}` ? This is where I get all ninja on you. CMTrace has a component column that I never used much so I decided to make something out of it. I wanted to see the script’s name and the line number in which `Write-Log` was called. This string: `"$($MyInvocation.ScriptName | Split-Path -Leaf):$($MyInvocation.ScriptLineNumber)"` is what makes that happen. I then bring these two variables together using PowerShell’s string formatting to build `$Line`. ```powershell $Line = $Line -f $LineFormat ``` It’s then just a matter of writing `$Line` to a text file that’s already been defined by `Start-Log`. ```powershell Add-Content -Value $Line -Path $ScriptLogFilePath ``` ### How it Works Let’s say I build a script that looks something like this called _LogDemo.ps1_: ```powershell Start-Log -FilePath C:\MyLog.log Write-Host "Script log file path is [$ScriptLogFilePath]" Write-Log -Message 'simple activity' Write-Log -Message 'warning' -LogLevel 2 Write-Log -Message 'Error' -LogLevel 3 ``` This script creates our log file at _C:\\MyLog.log_ and then proceeds to write 3 levels of severity to the log through using the `LogLevel` parameters I explained above. When I check out the output of this file with [`Get-Content`](https://adamtheautomator.com/powershell-get-content/ "Get-Content") it looks pretty ugly. ```powershell ``` However, let’s break this open in CMTrace and see what it looks like. ![](https://adamtheautomator.com/wp-content/uploads/2020/12/image-3.png) CMTrace fields generated by PowerShell Isn’t that beautiful? Even if you’re not an SCCM admin I highly recommend using CMTrace for all your log viewing needs. Once you’ve got the log files in the appropriate format (and you now have no excuse not to) simply open them up in CMTrace and observe the beauty of all that is CMTrace! Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fsccm-client-logs%2F&text=Decipher%20SCCM%20Client%20Logs%20with%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fsccm-client-logs%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fsccm-client-logs%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/06/26995-troubleshoot-dns-issues-powershell-codex.webp) ### [Troubleshoot DNS Issues with PowerShell](/troubleshoot-dns-issues-powershell/) Troubleshoot DNS issues with PowerShell by testing name resolution, DNS client settings, cache entries, and network connectivity in a repeatable workflow. ![](https://adamtheautomator.com/wp-content/uploads/2025/10/image_2025-10-24_095322075.png) ### [Migrating from PowerShell 6 to 7.5: Breaking Changes/New Features](/migrating-powershell-6-to-7-5/) Migrate from PowerShell Core 6 to 7.5: breaking changes, features, and testing tips. ![](https://adamtheautomator.com/wp-content/uploads/2025/06/featured-image-6.png) ### [How to Add Timeouts to Pester Tests with PowerShell Runspaces](/pester-test-timeout-runspaces/) Prevent Pester tests from hanging indefinitely using PowerShell runspaces. Learn to handle variable scoping, module loading, TestDrive access, and stream capture challenges with timeout protection. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)