Question

For this assignment, you will need any computer running PowerShell v5 or later. Your answer should only include the function or the script files that generate the results.

1. For this question, your challenge is to create a PowerShell function that accesses all the log files stored under C:\Windows\System32\winevt\Logs. The function should display only those event logs whose size is more than 1MB. Sort the result by LastWriteTime in descending order.

Answer 1

solution;

script.ps1
***********

$path = "C:\Windows\System32\winevt\Logs"
$destination = "C:\Users\Administrator\Desktop\output.txt"

$results = Get-ChildItem $path -Recurse | where {$_.extension -in ".evtx"} | Where-Object {$_.length/1MB -gt 1} | Select-Object Name, Extension, @{Name="Mbytes";Expression={ "{0:N0}" -f ($_.Length / 1mb) }}
$results | sort LastWriteTime -Descending | Out-File $destination