Centralized logs

[mtengmo]

Would be great to have a central repository of logs ?
Using Log Analytics together would be a great solution, some idea how to code it:
https://wintellisys.com/store-custom-logs-in-azure-log-analytics-workspace-using-powershell/

[mtengmo]

I made a quick test, and this is the results is like that:

Quick and dirty code, just added it to Write-Log function.

function Write-Log ($LogMsg, $LogColor = "White") {

#Get log
$Log = "$(Get-Date -UFormat "%T") - $LogMsg"

#Echo log
$Log | Write-host -ForegroundColor $LogColor

#Write log to file
$Log | Out-File -FilePath $LogFile -Append

# Log analytics 
# https://wintellisys.com/store-custom-logs-in-azure-log-analytics-workspace-using-powershell/
$Body = [pscustomobject]@{
    Requester    = $env:USERNAME
    ComputerName = $env:COMPUTERNAME
    Id           = (New-Guid).Guid
    Message      = $LogMsg
} | ConvertTo-Json
Write-Output $body

$CustomerId = "xxxxx"  #workspace id
$SharedKey = "X1wyilNJxL/xxxxxxx=="  #primary key
$StringToSign = "POST" + "`n" + $Body.Length + "`n" + "application/json" + "`n" + $("x-ms-date:" + [DateTime]::UtcNow.ToString("r")) + "`n" + "/api/logs"
$BytesToHash = [Text.Encoding]::UTF8.GetBytes($StringToSign)
$KeyBytes = [Convert]::FromBase64String($SharedKey)
$HMACSHA256 = New-Object System.Security.Cryptography.HMACSHA256
$HMACSHA256.Key = $KeyBytes
$CalculatedHash = $HMACSHA256.ComputeHash($BytesToHash)
$EncodedHash = [Convert]::ToBase64String($CalculatedHash)
$Authorization = 'SharedKey {0}:{1}' -f $CustomerId, $EncodedHash

$Uri = "https://" + $CustomerId + ".ods.opinsights.azure.com" + "/api/logs" + "?api-version=2016-04-01"
$Headers = @{
    "Authorization"        = $Authorization;
    "Log-Type"             = "CUSTOMLOG";
    "x-ms-date"            = [DateTime]::UtcNow.ToString("r");
    "time-generated-field" = $(Get-Date)
}
Write-Output $Headers
Write-Output $body
$Response = Invoke-WebRequest -Uri $Uri -Method Post -ContentType "application/json" -Headers $Headers -Body $Body -UseBasicParsing
if ($Response.StatusCode -eq 200) {
    Write-Information -MessageData "Logs are Successfully Stored in Log Analytics Workspace" -InformationAction Continue
}

}

[Romanitho]

Nice first draft. It was a feature already requested. Haven't had time to work on, but you made a first interesting piece of work. Thanks.

[lapta]

This looks great, have you progressed with this any more?

[KnifMelti]

Nice!

But...
$CustomerId = "????" #workspace id
$SharedKey = "????" #primary key

...security in an PS script (maybe it's nothing critical...)?

[mtengmo]

Probably good to store them more secure than in a ps script. Registry? The secret can´t read data, only insert data to workspace. So not super critical.

Some more feedback on the logging part, I see some part in the script is not using the Write-Log function, so I have improved it on my side:
#& $Winget upgrade --id $($app.Id) --accept-package-agreements --accept-source-agreements -h | Tee-Object -file $LogFile -Append
$log = & {Winget upgrade --id $($app.Id) --accept-package-agreements --accept-source-agreements -h }
$log | Tee-Object -file $LogFile -Append
$log = $log | Convertto-json
Write-log "$log" "json"

Also, would be good to split out appname and maybe rename color to more usefully information as separate columns in logging.

[mtengmo]

` & $Winget install --id $($app.Id) --accept-package-agreements --accept-source-agreements -h | Tee-Object -Variable 'log'
$log = $log | Convertto-json
Write-log2 "$log" "pink" "$($App.Id)"
Remove-Variable -name log

`

It´s working :)

[Romanitho]

looks nice :)

[mtengmo]

Yes, works perfect, weekly updates is going out.

[madijk1969]

Looks really great! Any idea when this feature will be embedded in the WAU? Is it on the backlog?

[RonBartsch]

Is there an update of the possibility to use Log Analytics for the centralized logging?

[KnifMelti]

@Romanitho is on paternity leave from this project, and I am too inexperienced in PS5 to try...
...maybe someone else @RedEchidnaUK?

[RedEchidnaUK]

Not something I’ve ever done before, but I like the idea. Not sure when I’ll get the time, so no promises, but if I do have some spare time I’ll try and take a look.