PowerShell Windows Event Log Monitoring
Switch from WMI based event log monitoring to PowerShell based. The command Get-WinEvent does not require PS-Remoting to be enabled and can use WMI pass-thru credentials (wmi.user and wmi.pass). This is going to be much more efficient than using WMI to grab event log data.
Example to get via JSON (though I was not yet able to get this to work properly with script based eventsource).
$events = Get-WinEvent -ComputerName $hostname -Credential $remotecredential -LogName Application
$events | Select-Object @{Name = "happenedOn"; Expression = {$_.TimeCreated}}, @{Name = "Severity"; Expression = {$_.LevelDisplayName}}, message, @{Name = "Source"; Expression = {$_.ProviderName}} | ConvertTo-Json
$arr=@{}
$arr["events"] = @{}
$arr.events = $events | Select-Object @{Name = "happenedOn"; Expression = {[string]$_.TimeCreated}}, @{Name = "Severity"; Expression = {$_.LevelDisplayName}}, message, @{Name = "Source"; Expression = {$_.ProviderName}}
$arr | ConvertTo-Json