PowerShell Genie

Review large log files before touching them

A disk-space alert needs a review list, not an automatic deletion. Find the largest log files first, then decide what evidence you would need before archiving or removing anything.

Interactive guide 9 min practice Windows PowerShell 5.1 and PowerShell 7

Editable pipeline · fictional data · Microsoft documentation

Written and tested by Dhrub Bharali · Updated

The task

Get-ChildItem -File returns file objects. Extension includes its leading dot, and Length is a byte count. In real PowerShell, 10MB is 10 × 1024 × 1024 bytes. The lab uses the equivalent integer 10485760 so the supported syntax is visible.

  • Compare Length as a numeric byte count.
  • Filter the extension before ranking the files.
  • Distinguish matching bytes from trust in the source.

Genie tip: Compare Length as a numeric byte count.

See the objects move

Inspect this authored example with fictional data in the bounded browser model. The numbered stages show how its objects change.

Get-ChildItem -File | Select-Object -First 2 | Sort-Object Length -Descending
  1. Stage 1Get-ChildItem-File
  2. Stage 2Select-Object-First
  3. Stage 3Sort-Object-Descending

    Build the reasoning

    List the files

    1PS> Get-ChildItem -File

    The fixture contains log files, a text file and an archive. The 40 MiB archive is large, but the requested report is about logs.

    Keep logs and rank size

    1PS> Where-Object Extension -eq '.log' | Sort-Object Length -Descending

    errors.log, app.log and trace.log appear in that order. Filtering first stops a large non-log file taking a report slot.

    Select a useful review record

    1PS> Select-Object Name,Length

    Length remains numeric, so a later threshold comparison or export does not need to parse a formatted string.

    Try it: predict, run and explain

    Fictional input objects · 5 rows
    NameExtensionLength
    app.log.log12582912
    readme.txt.txt2048
    errors.log.log26214400
    trace.log.log524288
    archive.zip.zip41943040

    Select your predicted objects before revealing the output. Then edit one stage and inspect the change.

    Predict which objects survive the worked pipeline

    Ctrl / Command + Enter runs the editor. This bounded model uses the displayed fixture; it does not run PowerShell on a computer.

    Predict first, then run the pipeline.

      Find the mistake

      Taking the first rows too soon

      1PS> Get-ChildItem -File | Select-Object -First 2 | Sort-Object Length -Descending

      This only sorts the first two returned files. Sort the whole filtered result before selecting a top-N list.

      Treating a matching hash as a safety verdict

      1PS> Get-FileHash -LiteralPath './download.ps1' -Algorithm SHA256

      A matching hash supports byte equality against that reference. It does not establish that the publisher is trustworthy or that the script is safe to execute.

      Two copies have the same SHA256 value, but the reference came from an unknown mirror. What have you established?

      Prove it: write it alone

      Return .log files larger than 10485760 bytes (10 MiB), largest first. Return exactly Name and Length. Do not delete, truncate or rename any file.

      The checker also runs your command against a fresh fixture. Matching today’s names alone is not enough.

      Show a worked solution
      1PS> Get-ChildItem -File | Where-Object Extension -eq '.log' | Where-Object Length -gt 10485760 | Sort-Object Length -Descending | Select-Object Name,Length

      Read the stages, close this explanation, then write and test your own attempt.

      Take it to a real environment

      For a real inventory, choose a specific LiteralPath and decide whether recursion is intended. Protect filenames containing wildcard characters. Before cleanup, check retention requirements, active file handles and the recovery plan. Hash files separately when verifying a copy against a trusted reference.

      Real environment example · not executed here

      1PS> Get-ChildItem -LiteralPath 'C:\Logs' -File | Where-Object Extension -eq '.log' | Where-Object Length -gt 10MB | Sort-Object Length -Descending | Select-Object FullName,Length

      Verify the details

      Final challenge not completedChoose another guide

      Practise this

      Find large log files

      Return Name and Length for .log files larger than 10,000,000 bytes.

      Review the lesson

      Genie guideReview large log files before touching them

      A disk-space alert needs a review list, not an automatic deletion. Find the largest log files first, then decide what evidence you would need before archiving or removing anything.

      Explore PowerShell Genie

      Related