Event log reading in PowerShell - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to get the last 5 entries from the Application event log.

PowerShell

Get-EventLog -LogName Application -Newest [1]

Drag options to blanks, or click blank then click option'

A3

B10

C1

D5

Attempts:

3 left

💡 Hint

Common Mistakes

Using a number other than 5 for the -Newest parameter.

Omitting the -Newest parameter and getting all entries.

The -Newest parameter specifies how many recent entries to retrieve. Here, 5 entries are requested.

2fill in blank

medium

Complete the code to filter event log entries with EntryType 'Error'.

PowerShell

Get-EventLog -LogName System | Where-Object { $_.EntryType -eq '[1]' }

Drag options to blanks, or click blank then click option'

AWarning

BError

CInformation

DSuccessAudit

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Warning' or 'Information' instead of 'Error'.

Forgetting to quote the string 'Error'.

The EntryType property filters events by type. 'Error' selects error events.

3fill in blank

hard

Fix the error in the code to get event logs from the Security log.

PowerShell

Get-EventLog -LogName [1] -Newest 10

Drag options to blanks, or click blank then click option'

ASecurity

BSetup

CSystem

DApplication

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'security' with lowercase s (PowerShell is case-insensitive but best to use correct casing).

Using 'System' or 'Application' instead of 'Security'.

The Security log is named 'Security'. Using the correct log name avoids errors.

4fill in blank

hard

Fill both blanks to get the count of Error entries in the System log.

PowerShell

$count = (Get-EventLog -LogName [1] | Where-Object { $_.EntryType -eq '[2]' }).Count

Drag options to blanks, or click blank then click option'

ASystem

BApplication

CError

DWarning

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up log names and entry types.

Using 'Warning' instead of 'Error'.

We want to count Error entries in the System log, so use 'System' and 'Error'.

5fill in blank

hard

Fill all three blanks to create a hashtable of event counts by EntryType from the Application log.

PowerShell

$counts = @{ [1] = (Get-EventLog -LogName Application -EntryType Error).Count; [2] = (Get-EventLog -LogName Application -EntryType Warning).Count; [3] = (Get-EventLog -LogName Application -EntryType Information).Count }

Drag options to blanks, or click blank then click option'

AError

BWarning

CInformation

DApplication

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Application' as a key instead of an EntryType.

Mixing up the order of keys.

The hashtable keys should be the EntryType names: 'Error', 'Warning', and 'Information'.