Tomcat logs events into the system log. You can use the get-wmiobject commandlet to see events. Here, we’ll look at a JSS and view only system events:
Get-WmiObject Win32_NTLogEvent -ComputerName $jss -Filter "LogFile='system'
We can then use AND to further constrain to specific messages, in this case those containing Tomcat:
Get-WmiObject Win32_NTLogEvent -ComputerName $jss -Filter "LogFile='system' AND (Message like '%Tomcat%')
We can then further constrain output to those with a specific EventCode with another compound statement:
Get-WmiObject Win32_NTLogEvent -ComputerName $jss -Filter "LogFile='system' AND (Message like '%Tomcat%') AND (EventCode=1024)
For a comprehensive list of Windows event codes, see https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx.
You could instead use get-eventlog to see system logs. For example, the following will list the latest 100 entries in the system log:
Get-Eventlog -LogName system -Newest 1000
And the following lists the number of unique entries in descending order using Sort-Object, along with the -Property option set to count:
Get-Eventlog -LogName system -Newest 1000 | Sort-Object -Property count -Descending
And the following would additionally constrain the output to entries with the word Tomcat using the -Message option:
Get-Eventlog -LogName system -Newest 1000 -Message "*Tomcat*" | Sort-Object -Property count -Descending
And to focus on a server called jss, use the -ComputerName option:
Get-Eventlog -LogName system -Newest 1000 -Message "*Tomcat*" -ComputerName "localhost" | Sort-Object -Property count -Descending