Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Friday, February 26, 2016

Finding Your DSC Event Log Messages

Happy Friday!!!

Often when I am writing large amounts of code, I like to enter items into an event log of some type.  For those of you who have been sitting in my Advanced PowerShell classes where we use SAPIEN PowerShell Studio, you may have noticed that I will sometimes include a tabbed page where I have a log file.   

In DSC we have an Analytic log that we can send messages to using a DSC resource called Log,
PS C:\WINDOWS\system32> Get-DscResource -Name Log

ImplementedAs   Name   ModuleName                     Version    Properties        
-------------   ----   ----------                     -------    ----------        
Binary          Log    PSDesiredStateConfiguration    1.1        {Message, Depend...

This log file contains all of the verbose messages sent to the Analytic log.  

Look for Event ID 4098 with a ‘Warning’ level. 

Warnings are represented with the value of 3. Unfortunately, not all event 4098 will be yours.  Take a look at this configuration:

# Create your configuration.
Configuration TestMessage
{
    Import-DscResource -ModuleName PSDesiredStateConfiguration

    $Message = "`n `nConfigEventID: 001`n"
    $Message += "Task XYZ Completed`n"
    $Message += "`nAdd Whatever else you need to add"
    Node "localHost"
    {

        Log TestMessage
        {
            # This will write a message to the event log with event
            # ID 4098.

            Message = "$Message"
        }
    }
}

You can see that I am creating a custom message that I want to make sure is visually separated from the rest of the metadata presented in the events message.  My next set of code allows me to filter out all of the other information and just see my message.

# Create a hash for Get-WinEvent
$EventHash = @{LogName = 'Microsoft-Windows-DSC/Analytic'
              ID = 4098
              Level = 3}

# View the log files for our message.
(Get-WinEvent -FilterHashTable $EventHash -Oldest |
    Where-Object Message -Like "*ConfigEventID: 001*" |
    Select-Object -ExpandProperty Message).Split("`n")[6..10]

The result is:
ConfigEventID: 001
Task XYZ Completed


Add Whatever else you need to add

This may be a bit easier to read than this:
PS C:\PS> Get-WinEvent -FilterHashTable $EventHash -Oldest


   ProviderName: Microsoft-Windows-DSC

TimeCreated            Id   LevelDisplayName Message                                                                                                                      
-----------            --   ---------------- -------                                                                                                                      
2/25/2016 3:20:07 PM   4098 Warning          Job {4D5478C7-DC16-11E5-80BA-00155D130217} : ...                                                                                     
2/25/2016 3:22:02 PM   4098 Warning          Job {92101197-DC16-11E5-80BA-00155D130217} : ...                                                                                    
2/25/2016 3:23:51 PM   4098 Warning          Job {CEA254D0-DC16-11E5-80BA-00155D130217} : ...                                                                                    
2/25/2016 3:23:51 PM   4098 Warning          Job {CEA254D0-DC16-11E5-80BA-00155D130217} : ...                                                                                     
2/25/2016 3:24:32 PM   4098 Warning          Job {EBAAF632-DC16-11E5-80BA-00155D130217} : ...                                                                                     
2/25/2016 3:38:38 PM   4098 Warning          Job {E4202499-DC18-11E5-80BA-00155D130217} : ...   

Or this:
Job {1791C5F3-DC1F-11E5-80BA-00155D130217} :
Displaying messages from built-in DSC resources:
        WMI channel 1
        ResourceID: [Log]TestMessage
        Message : [S1]:                            [[Log]TestMessage]

ConfigEventID: 001
Task XYZ Completed


Add What ever else you need to
Job {2930B945-DC1F-11E5-80BA-00155D130217} :
Displaying messages from built-in DSC resources:
        WMI channel 1
        ResourceID: [Log]TestMessage
        Message : [S1]:                            [[Log]TestMessage]

ConfigEventID: 001
Task XYZ Completed

Add Whatever else you need to add

Just remember to enable the analytic and debug logs first.  Also, this may not be the best way to log information.  Remember that all verbose information will be kept in this log as well.




No comments: