Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replaces Get-EventLog with Get-WinEvent #159

Merged
merged 1 commit into from
May 17, 2021

Conversation

LordHepipud
Copy link
Collaborator

@LordHepipud LordHepipud commented Apr 28, 2021

Replaces the deprecated function Get-EventLog with Get-WinEvent. In addition, the plugin received a new argument -MaxEntries to allow additional filtering for the number of events fetched to improve performance in addition. The EventLog now also supports an array with list items, allowing easier filtering for severities which are allowed inside the EventLog.

@LordHepipud LordHepipud self-assigned this Apr 28, 2021
@LordHepipud LordHepipud added the enhancement New feature or request label Apr 28, 2021
@LordHepipud LordHepipud added this to the v1.5.0 milestone Apr 28, 2021
@LordHepipud LordHepipud force-pushed the feature/replace_get_eventlog_with_get_winevent branch from fb877ff to 384417a Compare April 28, 2021 07:59
@LordHepipud LordHepipud linked an issue Apr 28, 2021 that may be closed by this pull request
@K0nne
Copy link
Contributor

K0nne commented May 12, 2021

The PR is working great so far. Now we can access all eventlogs.

I made the observation, that with the new version IncludeSource needs to be quoted, if spaces are present. Otherwise an exception occures. Not sure if this is a bug or not.

before: (framework: 1.4.1, plugins: 1.4.0)

icinga> Invoke-IcingaCheckEventlog -LogName System -IncludeEventId 7024 -IncludeSource Service Control Manager -Maxentri
es 3000 -warning 1 -critical 1
[OK] Check package "EventLog"
|
0

after: (framework: current master, plugins: this pr)

exception without quotes

icinga> Invoke-IcingaCheckEventlog -LogName System -IncludeEventId 7024 -IncludeSource Service Control Manager -Maxentries 3000 -warning 1 -critical 1
Exception calling "Translate" with "1" argument(s): "Some or all identity references could not be translated."
At C:\Program Files\WindowsPowerShell\Modules\icinga-powershell-framework\cache\framework_cache.psm1:13400 char:9
+         $SecurityData = $NTUser.Translate([System.Security.Principal. ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : IdentityNotMappedException

ok with quotes

icinga> Invoke-IcingaCheckEventlog -LogName System -IncludeEventId 7024 -IncludeSource 'Service Control Manager' -Maxentries 3000 -warning 1 -critical 1
[OK] Check package "EventLog"
|
0

I still need to test with the new and the old version, if I get the same results. I do this later.

@K0nne
Copy link
Contributor

K0nne commented May 12, 2021

The filtering for eventid and eventsource is also working as expected.
You did great work here 💯

@LordHepipud
Copy link
Collaborator Author

Thanks!

@LordHepipud LordHepipud merged commit 8e0ba01 into master May 17, 2021
@LordHepipud LordHepipud deleted the feature/replace_get_eventlog_with_get_winevent branch May 17, 2021 10:15
yhabteab pushed a commit that referenced this pull request May 20, 2021
…_get_winevent

Replaces Get-EventLog with Get-WinEvent

Replaces the deprecated function `Get-EventLog` with `Get-WinEvent`. In addition, the plugin received a new argument `-MaxEntries` to allow additional filtering for the number of events fetched to improve performance in addition. The EventLog now also supports an array with list items, allowing easier filtering for severities which are allowed inside the EventLog.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Invoke-IcingaCheckEventlog - unable to process Hyper-V eventlogs
2 participants