Parse Events via PowerShell into table. Ever have need to parse an event, and grab a field from the event description, then perform some action after that?
Here’s some PowerShell that may help you first to create a table, then setup columns, gather data, then parse what you need, and run a command to then output to the table
Mining Ore from the Windows Event Log and finding a way to make it portable
Use Get-WinEvent to use XML and filters from event viewer, to mine an event, including examples for a specific string, from a specific event, in a specific event log?
Hopefully this post will help with a few tips to simplify monitoring for events, whether in AzMon, SCOM, or via PowerShell.
Let’s start with the Dr Scripto blog post from quite a while ago –
Use Get-WinEvent to use XML and filters from event viewer
The Tip or Trick part of this – leverage your Event Viewer Filter as a query to use with get-WinEvent
Credit for this tip comes from Andrew Blumhardt!
See below for examples to ‘use Get-WinEvent to use XML and filters from event viewer’
Navigating via Event Viewer:
Hop onto your favorite server, or connect to another server via Event Viewer
Go to the Event Log > Click Filter Current Log
Build out your filter (i.e. choose specific Event Sources, exclude events, include severities, timeframe (start/end), etc.)
SCVMM Application Log Event ID 25933
Switch to the XML tab (and note you can edit your query further!)
Event Viewer filter XML tab
You can copy the query from the Event Viewer into your Get-WinEvent syntax
$query = @”
<QueryList> <Query Id=”0″ Path=”Application”> <Select Path=”Application”>*[System[Provider[@Name=’Microsoft.SystemCenter.VirtualMachineManager.2012.Monitor.UserRoleQuotaUsageMonitor’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2012.Report.ServiceUsageCollection’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2012.Report.VMUsageCollection’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.EnableCredSSPClient’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.Monitor.UserRoleQuotaUsageMonitor’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.Report.ServiceUsageCollection’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.Report.VMUsageCollection’] and (Level=2 or Level=3) and (EventID=25933)]]</Select> </Query> </QueryList>
“@
Get-WinEvent -FilterXml $query
PowerShell output
SCVMM query example screenshot
Example 3
Grab System Event Log, Event ID 5827 (NetLogon denied events)
Security hotfix for SCOM 2016 web console released before your information is stolen
SCOM 2016 web console hot fix
Security teams may be contacting you for CVE-2020-1331 vulnerability on the 2016 web console. In my example, the Tenable scanner listed ALL SCOM management group servers – under SCOM2016/2019).
NOTE KB does not install on server, so does not show up under ‘Installed Updates’
Background
HotFix DLL comes with a readme to replace the DLL for the SCOM 2016 WebConsole role
If you don’t already know this, the roles each get their own directory on your SCOM server
Security scanners run scripts to help validate if system is vulnerable. It is possible that the scanner is just looking for some string for the install of SCOM, NOT the actual role that is vulnerable.
SCOM 2016 typically installs @ (‘\Program Files\Microsoft System Center 2016’)
SCOM 2019 typically installs @ (‘\Program Files\Microsoft System Center’)
Identify SCOM roles
Open PowerShell window to identify roles
cd “D:\Program Files\Microsoft System Center 2016\Operations Manager”
# Change Drive letter if you hopefully installed SCOM on D: drive (non-system drive)
copy “C:\Program Files\Microsoft System Center 2016\Operations Manager\WebConsole\MonitoringView\bin\Microsoft.EnterpriseManagement.OperationsManager.MonitoringViews.dll” “C:\Program Files\Microsoft System Center 2016\Operations Manager\WebConsole\MonitoringView\bin\Microsoft.EnterpriseManagement.OperationsManager.MonitoringViews-old.dll”
# Replace DLL
copy “C:\MonAdmin\Microsoft*.dll” “C:\Program Files\Microsoft System Center 2016\Operations Mana ger\WebConsole\MonitoringView\bin”
# Verify
cd “D:\Program Files\Microsoft System Center 2016\Operations Manager\WebConsole\MonitoringView \bin”
Back again, I’m going to ‘Identify orphaned agent properties’. For instance, does an agent still show up under Windows Computer, or more classes, like Windows Operating System? Typically we have handled this by using Holman’s purge blog.
First, my thanks to Kevin H, Mihai S from the SCOM PG, & Premier Support CSS, for their help. Let’s begin the ‘Identify orphaned agent properties’ discussion with ‘how’. First, how do you get an orphaned property? Second, how to you resolve?
Some example scenarios
Server rebuilt with same name. New agent runs discovery, and creates new set of GUID’s in the database.
The Monitoring Tab > Windows Computer view contains unhealthy <gray> server objects. Upon further inspection, the server does NOT show up in the Administration > Agent Managed view.
Custom management pack authoring extends the Windows Computer class, or others (via SDK or PowerShell)
‘Identify and resolve’ orphaned agent properties
Check for COMMIT or Overrides in management packs
PG recommended looking at Windows Computer extended class properties, and Connector Framework discoveries.
Hey guys, don’t forget python as pre-req for agent install! Came across this again, where the docs site doesn’t mention python-ctypes as pre-req for agent install. Let’s flip to GitHub for the agent. GitHub lists the python pre-req here. Otherwise, it’s Openssl 1.1.0 is only supported on x86_64 platforms (64-bit).
Let’s begin by starting with a Linux server. I’ve used Ubuntu in my lab, specifically, Ubuntu v16.04.
Login and check if you have latest, or have the package installed (Debian Linux)
Regular user run ‘sudo apt-get install python-ctypes‘
Super user/root ‘apt-get install python-ctypes‘
screen capture of python install
As of 1 July, v1.13.7.0 is current (latest) 64 bit OMS for Linux agent released.
His blog brings up SQL MP Disk Latency performance counters.
His blog got me thinking about SQL DB and DB file design, where multiple DB files are on the same Drive, causes duplicate performance counters (SCOM workflows) on the agent, and will typically be one of the culprits for HealthService restarts.
XLS sheets to allow you to go to the SQL team and ask them what performance counters they use
Manage Cookie Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
