> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Find Application Errors in Event Log
- URL: https://www.filipkonopik.com/powershell-find-application-errors-in-event-log/
- Published: 2026-07-27T10:27:46.000Z
- Updated: 2026-08-06T05:44:36.000Z
- Author: Filip Konopík
- Tags: Event Logs & Monitoring

Need to check for application crashes and errors - for troubleshooting a misbehaving program or general system health checks? This one-liner filters the Application log for the relevant events.

Prerequisites:

- Privileges: None
- Module: Built-in, no import needed

Quick Command:

```Powershell
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001} -MaxEvents 5
```

Example Output:

```Powershell
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
7/27/2026 10:49:42 AM         1001 Information      Fault bucket , type 0...
7/27/2026 7:16:25 AM          1001 Information      Fault bucket 2057962395181865010, type 5...
7/27/2026 7:16:22 AM          1001 Information      Fault bucket , type 0...
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- \-LogName='Application' targets the Application log, where program-level crashes and errors get recorded - separate from System (OS/driver events) or Security (logon/audit events).
- Id=1000,1001 filters for two related Event IDs at once: 1000 is a general application crash event, and 1001 is the Windows Error Reporting entry that follows it with additional fault details ("fault bucket" info used to identify the specific crash signature).
- \-MaxEvents 5 limits the output to the most recent matches, since crash-prone systems can generate a large number of these entries.

Pro Tip:

The Message field often gets truncated in the default table view. Pipe to Select-Object -ExpandProperty Message to see the full crash details for a specific entry:

```Powershell
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001} -MaxEvents 5 | Select-Object -ExpandProperty Message
```