Gaining insight from consolidating and summarising Windows Event Logs.

Trawling event logs, man I’m excited. This is the kind of stuff I dream about and it’s what gets me going in the morning. I can’t wait to get stuck into millions of lines of events with the same error innocuous occurring every hundreds of times a second. With that one critical alert buried in all the noise.

I love it as much as I love grating my knuckles on a cheese grater.. Wait a minute, that sounds awful, hang on reviewing event logs is equally awful!

Now that I’ve wasted your time with my pointless preamble, here is how I’ve made things better. In my years reviewing event logs, I’ve taken a few learnings.

  1. It’s tedious
  2. It’s really tedious
  3. I want the information summarized
  4. I want to know if the error is new, or re-occuring.

Yes I can do all the above stuff manually, but why on earth would anyone want to! So I used powershell to improve things.

Let me set the scene. You’ve just patched a critical server and it’s been rebooted. Some of the first things you should review (yes really you should) is the windows system and application event log. So we RDP, open the event log, clikety clickety click and all is well. Sweet, move on to another 50 servers… Well that sucks. So here is a better way.

I produced the following script to do the following.

  1. Get all System and Application log events that are not Informational, so thats the Critical, Error, and Warning events
  2. Group them. If a certain event has repeated itself 1000 times, just tell me once and let me know how many times it appears
  3. Based on item 2, let me know the last time it appeared
  4. Was this event present before I rebooted the server (let’s look back 7 days as a line in the sand)
  5. Who on earth wants to log on to a server, let it take a ComputerName parameter instead
  6. Alternate credentials need to be specified as well as hey you’re running a best practice shop right 😉

Ok enough talk here is the script, hopefully it makes some sort of sense:

And the result?

 

powershell-get-event-log-stats-example
A thing of beauty! A summarized at a glance view of the Windows event logs, to drive better insight and agile decision making in your environment. Strategic staircases, disruption, top down bottom up view, managerial speak etc.. etc.. Essentially, it good bro.

And there you go, lives saved! (from boredom that is, I’m not some kind of hero.. or am I??)

Hopefully that is of use to somebody, in a later blog I will talk about how you can display stuff like this in fancy HTML pages styled with bootstrap. I find that stuff so much cooler than grating your knuckles.

Cheers!

Setting Proxy settings in Powershell and .Net Windows Applications

There is a problem I have come across a number of times in my career that frustrates me. But I’m no closer to getting a full time barrista on tap to serve me coffee any time I need it. FML as the kids say..

There is also another problem, thats maybe more in line with my blogs so I suppose I should write about that instead!

A forward web proxy server, is a common piece of technology in most organizations where I’ve worked. It’s how we control the minions to ensure they only access the content on the internet we deem acceptable, monitor where they are going and how long they can browse a website etc.. Dance my puppets, muhahaha. I’m not going to argue the pros and cons of proxy servers, but needless to say they are prett standard.

What does bug me, is when business applications come along that say sorry our software doesn’t work through a proxy server… Oh nice one, you never though an application used by businesses may have a proxy server in the mix. Winner… Anyway, I’ve come across sites where there are holes open in the firewall for all manor of websites/ip address ranges etc. because its too hard and the easy out is to just poke a hole in the firewall and say “have at it!” Sure it’s a quick win, and gets you back on to more important things, like what the minions are browsing today. But it doesn’t cut the mustard for me (thats an odd saying, where on earth does that come from…quick google… nothing concrete.. oh well back to blog). Unbeknownst to a number of people, and even the “developers” that write these random third party desktop applications. There is a way to work with the proxy server in some scenarios using application settings.

This process has worked for me approximately 75% of the time, essentially it tells the application to use the proxy settings specified by the user. i.e. what has been configured in IE. I’ve tested it with IP, basic, and NTLM authentaction succesfully.

How to make windows desktop applications work with a proxy server

  • If it’s a modernish windows application. We can assume it has been built on the .NET Framework.
  • If you can search the internet using Internet Explorer via the proxy (that is, it has proxy settings specified somehwere), then thats another tick
  • Navigate to the program files directory. e.g. c:\program files (x86)\CrapVendor\CrapApp
  • Look for the executable (e.g. crapapp.exe)
  • An application settings file will typically have the same name as the executable but end in .config (e.g. crappapp.exe.config)
  • If one exists, great edit it
  • If one does not exist, then create a new file with that name (crapapp.exe.config)
  • Add the below settings

  • If the file already exists, then you may only need to add the defaultproxy line, just ensure its in the system.net tags
  • Save the file, and fingers crossed it now works
  • Job Done! Grab a coffee.