Last active
September 9, 2019 07:01
-
-
Save bgelens/2746ef6ab08268a2f0caec4e0d39994a to your computer and use it in GitHub Desktop.
Run on a Windows Event Collector to enumerate the subscriptions and parse out lot's of details with the `-Detailed` switch and get objects instead
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
function Get-WECSubscription { | |
param ( | |
[Parameter(ValueFromPipeline, ValueFromPipeLineByPropertyName)] | |
[ValidateNotNullOrEmpty()] | |
[string] $Name, | |
[switch] $Detailed | |
) | |
begin { | |
$wecUtilPresent = ($null -ne (Get-Command -CommandType Application -Name wecutil -ErrorAction SilentlyContinue)) | |
function GetSubDetails { | |
param ( | |
[Parameter(ValueFromPipeline)] | |
[string] $Name | |
) | |
$subXML = wecutil gs $Name /f:xml | |
$subXML[0] = $subXML[0] -replace "^[^<]*" | |
$subInfo = ([xml]$subXML).subscription | |
$subTerse = ((wecutil gs $Name | Out-String) -split "`n`r")[-1].Trim() -split "`n" | |
$subRuntime = wecutil gr $Name | |
$subRuntime[0] = $subRuntime[0] -replace "^[^a-z]*" | |
$subRuntime = ($subRuntime| Out-String).Trim() -split "`n" | |
$eventSource = $subTerse | Select-String -Pattern "^EventSource.*" | ForEach-Object -Process { | |
$address = ($subTerse[$_.LineNumber] -split ' ')[-1] | |
$runtimeStartLine = ($subRuntime | Select-String -Pattern $address).LineNumber | |
[pscustomobject]@{ | |
Address = $address | |
ComputerName = ($address -split '\.')[0].ToUpper() | |
Enabled = [bool]::Parse(($subTerse[$_.LineNumber + 1] -split ' ')[-1]) | |
RunTimeStatus = ($subRuntime[$runtimeStartLine] -split ' ')[-1] | |
LastError = ($subRuntime[$runtimeStartLine + 1] -split ' ')[-1] | |
LastHeartbeatTime = [datetime]($subRuntime[$runtimeStartLine + 2] -split ' ')[-1] | |
} | |
} | |
[pscustomobject]@{ | |
Name = $subInfo.SubscriptionId | |
SubscriptionId = $subInfo.SubscriptionId | |
SubscriptionType = $subInfo.SubscriptionType | |
Description = $subInfo.Description | |
ConfigurationMode = $subInfo.ConfigurationMode | |
RunTimeStatus = ($subRuntime[1] -split ' ')[-1].Trim() | |
Enabled = [bool]::Parse($subInfo.Enabled) | |
EventSource = $eventSource | |
} | |
} | |
} | |
process { | |
if ($wecUtilPresent) { | |
$subs = wecutil es | |
foreach ($sub in $subs) { | |
$sub = $sub -replace "^[^a-z]*" | |
if ([string]::IsNullOrEmpty($sub)) { | |
# potential for bom with PSv6 comming from wecutil | |
continue | |
} | |
if ($PSBoundParameters.ContainsKey('Name') -and $sub -ne $Name) { | |
continue | |
} | |
if ($Detailed) { | |
$sub | GetSubDetails | |
} | |
else { | |
$sub | |
} | |
} | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment