Event log reading in PowerShell - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this PowerShell command reading event logs?

Given this command, what will it output?

PowerShell

Get-EventLog -LogName System -Newest 3 | Select-Object -Property EventID, Source

A Error: The term 'Get-EventLog' is not recognized as the name of a cmdlet

B [{EventID=1001; Source=Application Error}, {EventID=7000; Source=Service Control Manager}, {EventID=6005; Source=EventLog}]

C [{EventID=1001; Source=Service Control Manager}, {EventID=7000; Source=Service Control Manager}, {EventID=6005; Source=EventLog}]

D [{EventID=4624; Source=Microsoft-Windows-Security-Auditing}, {EventID=4625; Source=Microsoft-Windows-Security-Auditing}, {EventID=4634; Source=Microsoft-Windows-Security-Auditing}]

💡 Hint

The System log contains events from system components like Service Control Manager.

The command fetches the 3 newest events from the System log. Typical EventIDs include 1001, 7000, and 6005 with sources like Service Control Manager and EventLog.

📝 Syntax

intermediate

Which option correctly filters Application log events with EventID 1000?

Select the PowerShell command that correctly gets Application log events where EventID equals 1000.

A Get-EventLog -LogName Application | Where { EventID == 1000 }

B Get-EventLog -LogName Application | Where-Object { $_.EventID -eq 1000 }

C Get-EventLog -LogName Application | Where-Object { EventID = 1000 }

D Get-EventLog -LogName Application | Where-Object { $_.EventID = 1000 }

💡 Hint

Remember to use $_ to refer to the current object and -eq for comparison.

Option B uses correct syntax: $_.EventID -eq 1000 inside Where-Object. Options A, C, and D have syntax errors or wrong operators.

🔧 Debug

advanced

Why does this script fail to get Security log events?

This script returns an error: Get-EventLog -LogName Security -Newest 5 Error: Access is denied. What is the cause?

A The user lacks administrative privileges required to read the Security log.

B The Security log does not exist on this system.

C The -Newest parameter is not valid for the Security log.

D The Get-EventLog cmdlet cannot read any logs on this system.

💡 Hint

Security logs require special permissions to access.

Reading the Security event log requires running PowerShell as administrator. Without it, access is denied.

🚀 Application

advanced

How to export the last 10 System log events to a CSV file?

Which command exports the last 10 events from the System log to a CSV file named systemlog.csv?

A Get-EventLog -LogName System -Newest 10 > systemlog.csv

B Get-EventLog -LogName System | Select-Object -Last 10 | Export-Csv systemlog.csv

C Get-EventLog -LogName System -Last 10 | Export-Csv -Path systemlog.csv

D Get-EventLog -LogName System -Newest 10 | Export-Csv -Path systemlog.csv -NoTypeInformation

💡 Hint

Use the -Newest parameter and Export-Csv with -NoTypeInformation to avoid extra type info.

Option D correctly uses -Newest 10 and exports to CSV with no type info. Option D uses Select-Object -Last which is less efficient. Option D redirects output as text, not CSV. Option D uses invalid parameter -Last.

🧠 Conceptual

expert

What is the main difference between Get-EventLog and Get-WinEvent for reading event logs?

Choose the correct statement about the difference between Get-EventLog and Get-WinEvent.

A Get-WinEvent supports newer event logs and XML filtering, while Get-EventLog only supports classic logs.

B Get-EventLog can read all event logs including Security, but Get-WinEvent cannot.

C Get-EventLog is faster and more efficient than Get-WinEvent for all logs.

D Get-WinEvent only works on Windows Server editions, not on client Windows.

💡 Hint

One cmdlet is newer and more powerful with advanced filtering.

Get-WinEvent is the newer cmdlet that supports both classic and newer event logs with XML queries. Get-EventLog is older and limited to classic logs.