OK, so the difference here is:
Get-WinEvent -LogName 'Microsoft-Windows-DNSServer/Analytical' -Oldest
This will throw error about busy channel.
Get-WinEvent : The requested operation cannot be performed over an enabled direct channel. The channel must first be disabled before performing the requested operation
At line:1 char:2
+ Get-WinEvent -LogName 'Microsoft-Windows-DNSServer/Analytical' -Olde ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], EventLogException
+ FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWinEventCommand
And code below would work perfectly fine:
Get-WinEvent -Path C:\Windows\System32\winevt\Logs\Microsoft-Windows-DNSServer%4Analytical.etl -Oldest
... View more