WIP logging

Author: SingleAccretion

eng/build.ps1

@@ -352,6 +352,24 @@ foreach ($config in $configuration) {
   foreach ($singleArch in $arch) {
     $argumentsWithArch =  "/p:TargetArchitecture=$singleArch " + $argumentsWithConfig
     Invoke-Expression "& `"$PSScriptRoot/common/build.ps1`" $argumentsWithArch"
+
+    $StartTime = (Get-Date).AddMinutes(-5)
+    Get-WinEvent -FilterHashtable @{LogName="Security"; StartTime=$StartTime; Id=4688} -ErrorAction Ignore | ForEach-Object {
+        [xml]$EventXml = [xml]$_.ToXml()
+        $Event = [ordered]@{
+            TimeCreated = $_.TimeCreated
+    #       Id          = $_.Id
+    #       Provider    = $_.ProviderName
+    #       Message     = $_.Message
+    #       Computer    = $_.MachineName
+        }
+        $EventXml.Event.EventData.Data |
+            Where-Object { $_.Name -in @("NewProcessId", "NewProcessName", "ProcessId", "CommandLine", "ParentProcessName") } |
+            Sort-Object Name |
+            ForEach-Object { $Event[$_.Name] = $_.'#text' }
+        [PSCustomObject]$Event
+    } | Sort-Object TimeCreated | Format-List -Force
+
     if ($lastExitCode -ne 0) {
         $failedBuilds += "Configuration: $config, Architecture: $singleArch"
     }