Knowing is better than guessing, that is an indisputable fact as far as I know and since we try to automate more and more (someone wrote –automating the world, line by line and that is so darn correct) we now need to monitor much more. OS Deployment has been possible to automate for many years, but the level of monitoring to see if everything is working correctly is in place and there are many reasons for that, some solutions just takes forever to deploy and configure and some takes forever to understand how they work.
The Problem:
We need to be able to see if everything works as expect, we all work in the Service Sector, we are suppose to service our organizations and help our users so they can do whatever they are suppose to do (I know, working in IT is not that cool anymore). If you have MDT you could enable the monitoring feature, but it will only tell you ongoing deployments and if they went well or not, you cannot see the issues, only the number of issues. If you have SCCM it is far better, but, better could be better…
The Solution
In MDT there is a monitoring feature and what not so many know about is that it is actually writing to the event log.
$MDTevents = Get-EventLog -LogName Application -Source MDT_Monitor -EntryType Warning,Error
$MDTevents | Select Message
Output from running the commands above.
So, if we could create script that dumps that, split the message into 3 objects, machine name, type of error, and message, add the path to the logs for each machine we have a solution, right?
Issue Number one
The event log is fantastic, it has so many parameters to work with, but in this case it does not work, since all data is just a string in the event it self, so we need to extract that and “bend the rules a bit”, this is what we get if we don’t do anything at all
As you can see, it is all in the EventData, just as a dumb string.
With this little function we can now dump the data, turn the string into 3 objects, flip them around so that the computer name comes first (like to sort it on computer name), remove junk
Issue Number two
Converting to HTML with links to the logs, well that can be done rather easy using this part
Here you can see that we dump out the data running the Function Get-MDTIssues with a select statement that on the first position creates a new object called “link” and it will add a href tag on the computer name, so now we have a nice HTML page, well not really. there is another problem
Issue Number three
ConvertTo-HTML does not like HTML, it will of course convert everything to HTML, including HTML and the HTML we had is no HTML anymore…
But, Convertto-html is an object, so we can of course convert that on the fly using –replace and at the same time we can add the computer name correctly to the server we are running this on
Issue Number four
Now everything works, Yeah, well no, as soon as you have this “not-so-very-designed-web-page” you will be able to click the links and THAT works, you will end up in the log folders
So let us click one of them:
So far so good:
But you cannot click any of the links until you add a mime type for .log in IIS
Install and Configure
- Download file from here: http://sdrv.ms/1h4WrD7
- Store it locally on the MDT server (The server with the Deployment workbench, it is possible to run the script from an other machine, but then you need to modify the script to read the log from another computer)
- Make sure that MDT Monitoring is enabled
- Make sure that CustomSettings.ini is correctly configured to store the logs and to enable to send monitor data
- SLShare=\\SRVMGT01\Logs$
- EventService=http://SRVMGT01:9800
- Add the IIS Feature
- Add two Web Applications
- Enable Directory Browsing for Logs and MDT (If you call the file default.htm or similar you don’t need that)
- Schedule the script to run (You could a be smart, schedule a task based on the MDT_Monitor to run the script for warnings and errors
- Testing could be done in two ways, you could either deploy a machine and hope it fails or you could run this POSH command:
Write-EventLog -LogName Application -Source MDT_Monitor -EntryType Warning -EventId 2000 -Message "Error logged for computer TEST01: Application Install – HP Support Pack returned an unexpected return code: 1"
and if everything works correct, well you should be able to see that in the webpage
Happy “Warnings, errors and failures”
/mike
