<div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Thanks for explanations. As it is possible to pass in the desired log file names in clientconfig using 'eventlogswanted:' couldn't that be passed to the Get-WinEvent -ListLogs? Something like "$script:EventLogs = Get-WinEvent -Listlog $script:wantedlogs"</div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="background-image:initial;background-position:initial;background-repeat:initial"><font face="comic sans ms, sans-serif" size="4"><b><i>Timothy L. Williams</i></b></font></p><p style="background-image:initial;background-position:initial;background-repeat:initial"><span style="font-family:Arial,sans-serif"><font size="2"><b>Operating Systems Analyst</b><br>Virginia Commonwealth University Computer Center<br>900 East Main St. STE 1141 Richmond VA 23219</font><br><b style="color:rgb(17,85,204)"><font size="2"><a href="tel:(804)%20828-0556" value="+18046282441" style="color:rgb(17,85,204)" target="_blank">804-828-0556</a></font></b></span></p><p style="background-image:initial;background-position:initial;background-repeat:initial"><span style="font-family:Arial,sans-serif"><b style="color:rgb(17,85,204)"><font size="2"><img src="https://docs.google.com/uc?export=download&id=0B2qQ4YudApjzSEtfOGhrMXdLcU0&revid=0B2qQ4YudApjzMnZncGl3bm4yT1E2dkxnZEFzazRvN1dWbFVRPQ"><br></font></b></span></p><p style="background-image:initial;background-position:initial;background-repeat:initial"><span style="font-size:12.8px"> </span><br></p></div></div></div></div></div></div></div></div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Mar 1, 2019 at 5:16 AM Beck, Zak <<a href="mailto:zak.beck@accenture.com">zak.beck@accenture.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-GB">
<div class="gmail-m_-4645567584418397327WordSection1">
<p class="MsoNormal"><span style="color:rgb(3,45,253)">Hi<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">My 2 issues: "-Path" parameter should be the actual path to log file per Help, but the QueryList appears to be using LogName format with name of log not path, is that correct?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">Get-WinEvent -Path is for reading saved event logs e.g. that you have saved from Event Viewer by right-clicking and using Save All Events As.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">You can play with FilterXML in Event Viewer – click Filter Current Log and then switch to the XML tab. The Path we’re using is part of that query XML syntax. If the XML works in event
viewer, it should work in Powershell.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif">eventlogswanted:Windows PowerShell,system,Microsoft-Windows-Windows Defender/Operational:7500:Warning,Critical,Error</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">The problem is in function XymonEventLogs – that runs Get-EventLog -List and that only retrieves the list shown under [EventLogSummary]. That list is then used as the basis for the
main loop in function XymonMsgs.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">If we change two lines - this line in function XymonEventLogs:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"> $script:EventLogs = Get-EventLog -List<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">To<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"> $script:EventLogs = Get-WinEvent -ListLogs *<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">And this line in function XymonMsgs:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"> foreach ($l in ($script:EventLogs | select -ExpandProperty Log))<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">to<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"> foreach ($l in ($script:EventLogs | select -ExpandProperty LogName))<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">Then it works
</span><span style="font-family:"Segoe UI Emoji",sans-serif;color:rgb(3,45,253)">🙂</span><span style="color:rgb(3,45,253)">, but the summary is much longer.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">I don’t actually know what purpose the summary serves, it pre-dates my involvement. I think we only need one of those summaries. I guess it’s useful for checking the configuration (e.g.
max size) of a log is.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">I can release a new version with the above changes in next week.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Max payload value ($maxpayloadlength) and how it is handled. Is that for the total of all the log files together, or per each log?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">Right now, this is the total for all logs, the maximum the client can return. The problem is it’s easy to bust the server max payload length with all this event log data. The idea is
that you use the filtering (ignore / include) to restrict the entries to just the ones that are critical for you.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)">Zak <u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(3,45,253)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Xymon <<a href="mailto:xymon-bounces@xymon.com" target="_blank">xymon-bounces@xymon.com</a>>
<b>On Behalf Of </b>Timothy Williams<br>
<b>Sent:</b> Thursday, 28 February 2019 17:32<br>
<b>To:</b> <a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a><br>
<b>Subject:</b> [External] [Xymon] XymonPS error log handling<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal" align="center" style="text-align:center"><span style="color:red">This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments.</span><u></u><u></u></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" noshade style="color:red" align="center">
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Zak, I know you just worked on the Windows Event log handling. I have a few issues that may need some documentation guidance, or an enhancement. Basically, I'm trying to get
Windows Defender log entries. We will be migrating from a commercial anti-virus platform to using the Defender and need to have alerting.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Most important to me is that it appears that only the top-level logs listed in EventLogSummary can be parsed (example at end). As a test, I included the Windows PowerShell
log in the clientconfig.cfg file.<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">eventlogswanted:Windows PowerShell,system:7500:Warning,Critical,Error<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">It took some experimentation with/without quotes as the code calls "Get-WinEvent -FilterXML $logFilterXML" and the QueryList uses -Path which states in Help file examples to
use quotes if log file name has spaces. I found that the query creates double quotes as illustrated in excerpt below.<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"><start Help file></span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"> -------------------------- EXAMPLE 11 --------------------------</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"> PS C:\>Get-WinEvent -Path 'c:\ps-test\Windows PowerShell.evtx'</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"> </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"> This command gets events from a copy of the Windows PowerShell event log file in a test directory. The path is enclosed in quotation marks because the log name includes a space.</span><u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><end help file><u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">2019-02-28 11:28:56 Processing event log Windows PowerShell<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">2019-02-28 11:28:56 Log filter <QueryList><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"> <Query Id="0" Path="Windows PowerShell"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"> <Select Path="Windows PowerShell">*[System[TimeCreated[timediff(@SystemTime) <= 3600000] and (Level=3 or Level=1 or Level=2)]]</Select><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"> </Query><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"> </QueryList><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">My 2 issues: "-Path" parameter should be the actual path to log file per Help, but the QueryList appears to be using LogName format with name of log not path, is that correct?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">And actually, I am trying to get the entries in the Windows Defender log file which is at "%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx"
by -Path or "Microsoft-Windows-Windows Defender/Operational" by -LogName.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"><br>
eventlogswanted:Windows PowerShell,system,Microsoft-Windows-Windows Defender/Operational:7500:Warning,Critical,Error</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">I don't think the QueryList can handle the /Operational slash. The entry is ignored and no QueryList appears in log. Xymon can read the log; if I manually edit the $logenries
I get the Defender entries in the client file.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:Verdana,sans-serif"> $logentries = @(get-winevent -logname "Microsoft-Windows-Windows Defender/Operational" -MaxEvents 50)</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">I also have a question about the Max payload value ($maxpayloadlength) and how it is handled. Is that for the total of all the log files together, or per each log? If total,
then a chatty log would prevent any entries in the other logs from being reported on? I would rather have most recent from each, and the value be 'per log'.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Lastly as an aside, in the client data file there are two Event Log Summary sections that appear to be redundant. Is there a purpose for one vs. the other? We do have the Summary
show under msgs column data.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">[EventlogSummary]</span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Max(K) Retain OverflowAction Entries Log </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">------ ------ -------------- ------- --- </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">16,384 0 OverwriteAsNeeded 10,046 Application </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">20,480 0 OverwriteAsNeeded 0 HardwareEvents </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"> 512 7 OverwriteOlder 0 Internet Explorer </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">20,480 0 OverwriteAsNeeded 0 Key Management Service </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">15,168 7 OverwriteOlder 2 Microsoft-ServerManagementExperience</span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">16,384 0 OverwriteAsNeeded 10,183 Security </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">16,384 0 OverwriteAsNeeded 45,885 System </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">15,360 0 OverwriteAsNeeded 3,421 Windows PowerShell </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">[msgs:EventlogSummary]</span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Max(K) Retain OverflowAction Entries Log </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">------ ------ -------------- ------- --- </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">16,384 0 OverwriteAsNeeded 10,046 Application </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">20,480 0 OverwriteAsNeeded 0 HardwareEvents </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"> 512 7 OverwriteOlder 0 Internet Explorer </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">20,480 0 OverwriteAsNeeded 0 Key Management Service </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">15,168 7 OverwriteOlder 2 Microsoft-ServerManagementExperience</span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">16,384 0 OverwriteAsNeeded 10,183 Security </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">16,384 0 OverwriteAsNeeded 45,885 System </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">15,360 0 OverwriteAsNeeded 3,421 Windows PowerShell </span><span style="font-size:12pt;font-family:Arial,sans-serif"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Thanks for your continuing support of a valuable tool! I'll keep playing with it, and post an update if I get a version working.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">Tim Williams<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif">VCU Computer Center<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Verdana,sans-serif"><u></u> <u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by
you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of
internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement
at <a href="https://www.accenture.com/us-en/privacy-policy" target="_blank">https://www.accenture.com/us-en/privacy-policy</a>. <br>
______________________________________________________________________________________<br>
<br>
<a href="http://www.accenture.com" target="_blank">www.accenture.com</a><br>
</font>
</div>
</blockquote></div>