PowerShell: how to get detailed information about a WMI event? - windows

I'm learning PowerShell 2.0 on Windows 7.
My task is simple: I want to listen for a WMI event and then display some information about it.
Here is what I'm currently doing:
Register-WmiEvent -class win32_ProcessStartTrace -sourceIdentifier processStart
Wait-Event
It seems to work. Indeed, I get this when I start a process:
ComputerName :
RunspaceId : bb0f38b9-2f2e-4f7c-98ec-ec3811e8e601
EventIdentifier : 11
Sender : System.Management.ManagementEventWatcher
SourceEventArgs : System.Management.EventArrivedEventArgs
SourceArgs : {System.Management.ManagementEventWatcher, System.Management.EventArrivedEventArgs}
SourceIdentifier : processStart
TimeGenerated : 26/09/2009 15:19:25
MessageData :
Problem is, I don't know how to get detailed information about the event. For example, how do I get the name of the process that just started? Ideally, I would have something like this:
__GENUS : 2
__CLASS : Win32_ProcessStartTrace
__SUPERCLASS : Win32_ProcessTrace
__DYNASTY : __SystemClass
__RELPATH :
__PROPERTY_COUNT : 7
__DERIVATION : {Win32_ProcessTrace, Win32_SystemTrace, __ExtrinsicEvent, __Event...}
__SERVER :
__NAMESPACE :
__PATH :
ParentProcessID : 1480
ProcessID : 6860
ProcessName : notepad++.exe
SECURITY_DESCRIPTOR :
SessionID : 1
Sid : {1, 5, 0, 0...}
TIME_CREATED : 128984449371986347
I can get the above information when I do
(get-event).sender.waitfornextevent()
But, obviously, that's not really what I had in mind - I don't want to wait for another event, I want info on the current one.

Take a gander here:
http://blogs.msdn.com/powershell/archive/2009/08/30/exploring-wmi-with-powershell-v2.aspx

Related

Windows MDM update management

I'm trying to figure out Windows update management via MDM (https://learn.microsoft.com/en-us/windows/client-management/mdm/device-update-management) and I would like to show installed and installable updates details for clients.
So following this guide, I'm getting installed/installable/... update GUIDs from the client using Update-CSP, then try to query GUID from sws.update.microsoft.com to get the metadata.
The problem is, the client is reporting update GUIDs that cannot be found in sws.update.microsoft.com. For example the device returns an update id: "1f36097b-e8c9-41a3-bcc3-baae597f692d" as an installed update.
When I query this Using GetUpdateData, it doesn't exists.
I queried installed updated on the client and found the detail:
PS C:\Windows\system32> $session.CreateUpdateSearcher().Search("UpdateID='1f36097b-e8c9-41a3-bcc3-baae597f692d'").Updates
Title : 2021-09 Cumulative Update for Windows 10 Version 20H2 for x64-based Systems (KB5005565)
AutoSelectOnWebSites : True
BundledUpdates : System.__ComObject
CanRequireSource : False
Categories : System.__ComObject
Deadline :
DeltaCompressedContentAvailable : True
DeltaCompressedContentPreferred : True
Description : Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.
EulaAccepted : True
EulaText :
HandlerID : http://schemas.microsoft.com/msus/2016/01/UpdateHandlers/OSInstaller
Identity : System.__ComObject
Image :
InstallationBehavior : System.__ComObject
IsBeta : False
IsDownloaded : True
IsHidden : False
IsInstalled : True
IsMandatory : False
IsUninstallable : False
Languages : System.__ComObject
LastDeploymentChangeTime : 9/14/2021 12:00:00 AM
MaxDownloadSize : 110963910278
MinDownloadSize : 0
MoreInfoUrls : System.__ComObject
MsrcSeverity :
RecommendedCpuSpeed : 0
RecommendedHardDiskSpace : 0
RecommendedMemory : 0
ReleaseNotes :
SecurityBulletinIDs : System.__ComObject
SupersededUpdateIDs : System.__ComObject
SupportUrl : https://support.microsoft.com/help/5005565
Type : 1
UninstallationNotes :
UninstallationBehavior :
UninstallationSteps : System.__ComObject
KBArticleIDs : System.__ComObject
DeploymentAction : 1
DownloadPriority : 2
DownloadContents : System.__ComObject
RebootRequired : False
IsPresent : True
CveIDs : System.__ComObject
BrowseOnly : False
PerUser : False
AutoSelection : 1
AutoDownload : 2
But when I look up this update by its name or KB article, I find the correct update id is: 9a11c8f1-525f-4088-8fb7-33d7b56dd6dc
catalog page
I'm not sure why client reports an incorrect (or deprecated?) update id.
Is there a way to make client to correct it?

Injecting structured json logs into journald

I get the impression that there might be a way to write to the systemd journal, json data directly without first converting it to the format the sd_journal* functions expect. Is this possible or not?
My suspicion is because of some comments about an inbuilt json parser. However the man pages suggest otherwise.
Also, I note that if your write to stdout in the format
<priority> message
The priority will end up in the PRIORITY="priority" field and message will end up in MESSAGE="message" field. But can other structured field data be input?
Note: The man pages do not talk about the last feature I mention. So I wouldn't be surprised if they are slightly out of date which is why I am asking.
journald doesn't accept arbitary JSON. Just Key/Value pairs. So it's not possible to send nested data structures. You can send data directly via the Unix Domain socket:
echo -e "MESSAGE=Hello\nFOO=BAR\nMY_ID=12345\n" |socat - UNIX-SENDTO:/run/systemd/journal/socket
results in:
{
"__CURSOR" : "s=46dc1bd66d0e4a48a6809e45228511e2;i=84cc;b=fd9144999d6846c8827d58f56c2635db;m=850161136;t=55669a307fdd6;x=887a021a37840789",
"__REALTIME_TIMESTAMP" : "1502386590318038",
"__MONOTONIC_TIMESTAMP" : "35703361846",
"_BOOT_ID" : "fd9144999d6846c8827d58f56c2635db",
"_TRANSPORT" : "journal",
"_UID" : "1001",
"_GID" : "1001",
"_CAP_EFFECTIVE" : "0",
"_SYSTEMD_OWNER_UID" : "1001",
"_SYSTEMD_SLICE" : "user-1001.slice",
"_SYSTEMD_USER_SLICE" : "-.slice",
"_MACHINE_ID" : "6e7b40640bf6473189165f19f8be2536",
"_HOSTNAME" : "samson",
"_SYSTEMD_UNIT" : "user#1001.service",
"_SYSTEMD_INVOCATION_ID" : "e5ed32fbb1004545b1ddf73a0d928d87",
"_SYSTEMD_CGROUP" : "/user.slice/user-1001.slice/user#1001.service/gnome-terminal-server.service",
"_SYSTEMD_USER_UNIT" : "gnome-terminal-server.service",
"_COMM" : "socat",
"_EXE" : "/usr/bin/socat",
"_CMDLINE" : "socat - UNIX-SENDTO:/run/systemd/journal/socket",
"FOO" : "BAR",
"MESSAGE" : "Hello",
"MY_ID" : "12345",
"_PID" : "19868",
"_SOURCE_REALTIME_TIMESTAMP" : "1502386590317991"
}

Can't access FileCodeModel from Powershell console in Visual Studio 2017 DTE

I'm trying to automate some code-related routines in VisualStudio 2017 using integrated Powershell console and VS Automation model (DTE). When I'm working on Solution/Project/File level, things are ok, e.g.
PS> $dte.ActiveDocument.ProjectItem
IsDirty : False
FileCount : 1
Name : FeaturesComposition.cs
Collection : System.__ComObject
Properties : System.__ComObject
DTE : System.__ComObject
Kind : {6BB5F8EE-4483-11D3-8BCF-00C04F8EC28C}
ProjectItems : System.__ComObject
Object : System.__ComObject
ExtenderNames : {}
ExtenderCATID : {610D4615-D0D5-11D2-8599-006097C68E81}
Saved : True
ConfigurationManager :
FileCodeModel : System.__ComObject
Document : System.__ComObject
SubProject :
ContainingProject : System.__ComObject
But when I come to the code model of some particular file, there is nothing to work with:
PS> $dte.ActiveDocument.ProjectItem.FileCodeModel | Format-List -Property *
System.__ComObject
PS> $dte.ActiveDocument.ProjectItem.FileCodeModel | gm
PS>
Is it possible to get access to such submodels? Is there any easy way of dispatching EnvDTE.DTE interface to the existing $dte instance? I've tried some ideas below, but without no success.
Add-Type -Path "$env:VSAPPIDDIR\PublicAssemblies\envdte.dll"
PS> # Explicit cast doesn't work
PS> [EnvDTE.DTE]$dte
[ERROR] Cannot convert the "System.__ComObject" value of type "System.__ComObject#{04a72314-32e9-48e2-9b87-a63603454f3e}" to type "EnvDTE.DTE".
PS> # Wrapper works but it's useless
PS> $wrapped = [Runtime.InteropServices.Marshal]::CreateWrapperOfType($dte, [EnvDTE.DTEClass])
PS> $wrapped.ActiveDocument.ProjectItem.FileCodeModel
System.__ComObject
PS> # GetComInterfaceForObject gives the same IntPtr as IUnknown:QueryInterface
PS> # different from the call to GetComInterfaceForObject for example,
PS> # so I hoped to get another casting results. But it is the same.
PS> $contract = [Runtime.InteropServices.Marshal]::GetComInterfaceForObject($dte, [EnvDTE.DTE])
PS> [EnvDTE.DTE][Runtime.InteropServices.Marshal]::GetObjectForIUnknown($contract)
[ERROR] Cannot convert the "System.__ComObject" value of type "System.__ComObject#{04a72314-32e9-48e2-9b87-a63603454f3e}" to type "EnvDTE.DTE".
Try this:
$fileCodeModel = Get-Interface $dte.ActiveDocument.ProjectItem.FileCodeModel ([ENVDTE80.FileCodeModel2])

HDFS Visulization of block distribution

I'm trying to create a visulaization of the HDFS block distribution of a cluster.
I plan to create this using Tableau but was wondering what type of visualizations would be able to give you an idea of what nodes need re-balancing, and also an efficient way to get the server log data into tableau?
Before investing too much time in this, you might want to take a look at Twitter's open source HDFS-DU project. This provides a view of utilization based on paths within the file system rather than DataNodes within the cluster, but perhaps that's still helpful for your requirements.
If the goal is just to identify nodes in need of rebalancing, then this information is already accessible on the NameNode web UI "Datanodes" tab. You could also run hdfs dfsadmin -report to get utilization stats for each node in a script.
If none of the above meets your requirements, and you need to proceed with integrating the information into an external reporting tool like Tableau, then a helpful integration point might be the JMX metrics exposed via HTTP on the NameNode. See below for an example curl command that queries some of this information from the NameNode. Note in particular the LiveNodes section, which contains capacity information about each DataNode.
Some additional information about these metrics is available in the Apache Hadoop Metrics documentation.
> curl 'http://127.0.0.1:9870/jmx?qry=Hadoop:service=NameNode,name=NameNodeInfo'
{
"beans" : [ {
"name" : "Hadoop:service=NameNode,name=NameNodeInfo",
"modelerType" : "org.apache.hadoop.hdfs.server.namenode.FSNamesystem",
"Threads" : 46,
"Version" : "3.0.0-alpha2-SNAPSHOT, rdf497b3a739714c567c9c2322608f0659da20cc4",
"Used" : 5263360,
"Free" : 884636377088,
"Safemode" : "",
"NonDfsUsedSpace" : 114431086592,
"PercentUsed" : 5.266863E-4,
"BlockPoolUsedSpace" : 5263360,
"PercentBlockPoolUsed" : 5.266863E-4,
"PercentRemaining" : 88.52252,
"CacheCapacity" : 0,
"CacheUsed" : 0,
"TotalBlocks" : 50,
"NumberOfMissingBlocks" : 0,
"NumberOfMissingBlocksWithReplicationFactorOne" : 0,
"LiveNodes" : "{\"192.168.0.117:9866\":{\"infoAddr\":\"127.0.0.1:9864\",\"infoSecureAddr\":\"127.0.0.1:0\",\"xferaddr\":\"127.0.0.1:9866\",\"lastContact\":2,\"usedSpace\":5263360,\"adminState\":\"In Service\",\"nonDfsUsedSpace\":114431086592,\"capacity\":999334871040,\"numBlocks\":50,\"version\":\"3.0.0-alpha2-SNAPSHOT\",\"used\":5263360,\"remaining\":884636377088,\"blockScheduled\":0,\"blockPoolUsed\":5263360,\"blockPoolUsedPercent\":5.266863E-4,\"volfails\":0}}",
"DeadNodes" : "{}",
"DecomNodes" : "{}",
"BlockPoolId" : "BP-1429209999-10.195.15.240-1484933797029",
"NameDirStatuses" : "{\"active\":{\"/Users/naurc001/hadoop-deploy-trunk/data/dfs/name\":\"IMAGE_AND_EDITS\"},\"failed\":{}}",
"NodeUsage" : "{\"nodeUsage\":{\"min\":\"0.00%\",\"median\":\"0.00%\",\"max\":\"0.00%\",\"stdDev\":\"0.00%\"}}",
"NameJournalStatus" : "[{\"manager\":\"FileJournalManager(root=/Users/naurc001/hadoop-deploy-trunk/data/dfs/name)\",\"stream\":\"EditLogFileOutputStream(/Users/naurc001/hadoop-deploy-trunk/data/dfs/name/current/edits_inprogress_0000000000000000862)\",\"disabled\":\"false\",\"required\":\"false\"}]",
"JournalTransactionInfo" : "{\"MostRecentCheckpointTxId\":\"861\",\"LastAppliedOrWrittenTxId\":\"862\"}",
"NNStartedTimeInMillis" : 1485715900031,
"CompileInfo" : "2017-01-03T21:06Z by naurc001 from trunk",
"CorruptFiles" : "[]",
"NumberOfSnapshottableDirs" : 0,
"DistinctVersionCount" : 1,
"DistinctVersions" : [ {
"key" : "3.0.0-alpha2-SNAPSHOT",
"value" : 1
} ],
"SoftwareVersion" : "3.0.0-alpha2-SNAPSHOT",
"NameDirSize" : "{\"/Users/naurc001/hadoop-deploy-trunk/data/dfs/name\":2112351}",
"RollingUpgradeStatus" : null,
"ClusterId" : "CID-4526ea43-52e6-4b3f-9ddf-5fd4412e322e",
"UpgradeFinalized" : true,
"Total" : 999334871040
} ]
}

Scaffolding Get-ProjectType not recognized as the name of a cmdlet

just tried to get the basic basics up and running and getting some fancy error conditions - most probably some basic steps are screwed up but I don't see the point - so some hints are highly appreciated.
So whats the setup?
VS2010
MVC3 or MVC4 Project - no strings attached, just the templates
Create a really simple Model-Class Team like shown on http://blog.stevensanderson.com/2011/01/13/scaffold-your-aspnet-mvc-3-project-with-the-mvcscaffolding-package/
What happens?
Try (after installing MvcScaffolding through NuGet Console) to call:
Scaffold Controller Team
And get the following error:
PM> Scaffold Controller Team
Scaffolding TeamsController...
Invoke-Scaffolder : The term 'Get-ProjectType' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or
if a path was included, verify that the path is correct and try again.
At O:\Code\Resource\packages\MvcScaffolding.1.0.7\tools\Controller\MvcScaffolding.Controller.ps1:66 char:40
+ $dbContextScaffolderResult = Scaffold <<<< DbContext -ModelType $foundModelType.FullName -DbContextType $DbContextType -Area $Area -Project $Project -CodeLang
uage $CodeLanguage -BlockUi
+ CategoryInfo : NotSpecified: (:) [Invoke-Scaffolder], CommandNotFoundException
+ FullyQualifiedErrorId : T4Scaffolding.Cmdlets.InvokeScaffolderCmdlet
Fancy thing: of course Get-ProjectType itself seems to work (see below), so I'm kind of stuck right now - as this looks like a powershell issue somehow but the cmdlet itself works at least if called directly but not when inside the script? Any hints would be greatly appreciated!
Thanks a lot.
PM> Get-ProjectType
cmdlet Get-ProjectType at command pipeline position 1
Supply values for the following parameters:
Type: Team
DTE : System.__ComObject
Collection : System.__ComObject
Name : Team
FullName : Resource.Models.Team
ProjectItem : System.__ComObject
Kind : 1
IsCodeType : True
InfoLocation : 1
Children : System.__ComObject
Language : {B5E9BD34-6D3E-4B5D-925E-8A43B79820B4}
StartPoint : System.__ComObject
EndPoint : System.__ComObject
ExtenderNames :
ExtenderCATID :
Parent : System.__ComObject
Namespace : System.__ComObject
Bases : System.__ComObject
Members : System.__ComObject
Access : 1
Attributes : System.__ComObject
DocComment : <doc>
</doc>
Comment :
DerivedTypes :
ImplementedInterfaces : System.__ComObject
IsAbstract : False
ClassKind : 1
PartialClasses : System.__ComObject
DataTypeKind : 1
Parts : System.__ComObject
InheritanceKind : 0
IsGeneric : False
IsShared : False
PM>
With Kind Regards,
Ives

Resources