Event log reading in PowerShell - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the PowerShell cmdlet used to read Windows event logs?

The cmdlet is <code>Get-EventLog</code>. It lets you read entries from Windows event logs like Application, System, and Security.

beginner

How do you specify which event log to read in PowerShell?

Use the -LogName parameter with Get-EventLog. For example, Get-EventLog -LogName System reads the System log.

beginner

What parameter limits the number of event log entries returned?

The -Newest parameter limits how many recent entries you get. For example, -Newest 10 returns the last 10 events.

intermediate

How can you filter event logs by event ID in PowerShell?

Use the -InstanceId parameter with Get-EventLog. For example, Get-EventLog -LogName Application -InstanceId 1000 shows events with ID 1000.

intermediate

What is a simple way to read event logs and display only the message and time generated?

You can pipe Get-EventLog to Select-Object like this: Get-EventLog -LogName System -Newest 5 | Select-Object TimeGenerated, Message. This shows only the time and message of the last 5 events.

Which cmdlet reads Windows event logs in PowerShell?

A Show-Log

B Read-Event

C Get-EventLog

D Fetch-Event

Get-EventLog is the correct cmdlet to read event logs.

How do you get the last 20 entries from the System log?

A Get-EventLog -LogName System -Newest 20

B Get-EventLog -LogName System -Last 20

C Get-EventLog -System -Count 20

D Get-EventLog -Log System -Top 20

The -Newest parameter limits the number of entries returned.

Which parameter filters events by event ID?

A -EventId

B -Id

C -FilterId

D -InstanceId

The -InstanceId parameter filters events by their event ID.

What does this command do? Get-EventLog -LogName Application | Select-Object TimeGenerated, Message

A Shows all Application events with only time and message

B Deletes Application events

C Creates a new event log

D Filters events by time

It reads Application log events and shows only the time and message fields.

Which log name is NOT a default Windows event log?

A System

B UserEvents

C Security

D Application

UserEvents is not a default Windows event log.

Explain how to read the last 10 entries from the System event log using PowerShell.

Think about the cmdlet and parameters to specify log and number of entries.

Describe how to filter event log entries by event ID in PowerShell.

Which parameter helps select events by their ID?