Given below command giving the output as object
$output = (Invoke-AzVMRunCommand -ResourceGroupName $rgname -Name $vmname -CommandId 'RunPowerShellScript' -ScriptPath authoring.ps1).value
Output
Mode : Process
ContextDirectory :
ContextFile :
CacheDirectory :
CacheFile :
Settings : {}
Code : ComponentStatus/StdOut/succeeded
Level : Info
DisplayStatus : Provisioning succeeded
Message : #{cluster_name=test01; status=green; timed_out=False; number_of_nodes=3;
number_of_data_nodes=3;
active_primary_shards=25; active_shards=50; relocating_shards=0;
initializing_shards=0;
unassigned_shards=0; delayed_unassigned_shards=0; number_of_pending_tasks=0;
number_of_in_flight_fetch=0; task_max_waiting_in_queue_millis=0;
active_shards_percent_as_number=100.0}
Time :
Code : ComponentStatus/StdErr/succeeded
Level : Info
DisplayStatus : Provisioning succeeded
How to get the Message ==> number_of_nodes = 3 and number_of_data_nodes=3 in some variable so based on this value I need to perform some action.
Thanks
Ok, if as you tested $Output.Message is a multiline string like
#{cluster_name=test01; status=green; timed_out=False; number_of_nodes=3;
number_of_data_nodes=3;
active_primary_shards=25; active_shards=50; relocating_shards=0;
initializing_shards=0;
unassigned_shards=0; delayed_unassigned_shards=0; number_of_pending_tasks=0;
number_of_in_flight_fetch=0; task_max_waiting_in_queue_millis=0;
active_shards_percent_as_number=100.0}
you can convert this into a Hashtable like this:
$data = $Output.Message.Trim("#{}") -replace ';', [environment]::NewLine | ConvertFrom-StringData
If you print that out to screen with $data | Format-Table -AutoSize it looks like this:
Name Value
---- -----
number_of_nodes 3
task_max_waiting_in_queue_millis 0
number_of_data_nodes 3
status green
initializing_shards 0
active_shards_percent_as_number 100.0
cluster_name test01
delayed_unassigned_shards 0
active_shards 50
unassigned_shards 0
active_primary_shards 25
number_of_in_flight_fetch 0
timed_out False
relocating_shards 0
number_of_pending_tasks 0
With this Hashtable format, it is easy to get the values of the different keys.
For instance:
$data.number_of_nodes # --> 3
$data.number_of_data_nodes # --> 3
$data.cluster_name # --> test01
Related
I'm trying to get the disk config, amongst other information from the guest OS (windows) and I can't seem to work out how to get the information using Azure DevOps, this is required as we would like to Automate the task at the point of migration to see what size disks are added and what spare capacity there is. Also we'll be expanding on this with further WMI queries, but I think once I can run a script against the guest OS I can pull out most of the details I need.
Azure DevOps has Contributor on the subscription
I'm using an inline script:
Invoke-AzVMRunCommand -ResourceGroupName "$(ResourceGroupName)' -Name '$(VMName)' -CommandId 'RunPowerShellScript' -ScriptPath ".\_snapshots\drop\CSV\disk.ps1" -Confirm:$false
The disk.ps1 script is:
$lists = Get-WmiObject Win32_LogicalDisk | ? {$_.VolumeName -ne "Temporary Storage"}
$Report = #()
foreach ($list in $lists) {
$info = "" | Select-Object DeviceID,"Size (GB)","FreeSpace (GB)","% FreeSpace",VolumeName
$info.DeviceID = $list.DeviceID
$info.'Size (GB)' = [math]::Round($list.size / 1GB)
$info.'FreeSpace (GB)' = [math]::Round($list.FreeSpace / 1GB)
$info.'% FreeSpace' = [math]::Round((($info.'FreeSpace (GB)' * 100) / $info.'Size (GB)'),0)
$info.VolumeName = $list.VolumeName
$report+=$info
}
$report
The output I get is:
Value : {Microsoft.Azure.Management.Compute.Models.InstanceViewStatus,
Microsoft.Azure.Management.Compute.Models.InstanceViewStatus}
Name :
StartTime :
EndTime :
Status : Succeeded
Error :
Output :
Capacity : 0
Count : 0
Item :
What should I get is:
Value[0] :
Code : ComponentStatus/StdOut/succeeded
Level : Info
DisplayStatus : Provisioning succeeded
Message : DeviceID : C:
Size (GB) : 127
FreeSpace (GB) : 117
% FreeSpace : 92
VolumeName : Windows
I get this when I run the script through PowerShell, same version in both cases.
Can anyone see what I'm missing or where I'm going wrong?
Thanks in advance :)
Try to change the inline script as below:
$run = Invoke-AzVMRunCommand -ResourceGroupName "$(ResourceGroupName)' -Name '$(VMName)' -CommandId 'RunPowerShellScript' -ScriptPath ".\_snapshots\drop\CSV\disk.ps1" -Confirm:$false
Write-Host $run.Value[0]
If you want to get the specific message, you could also use:
Write-Host $run.Value[0].Message
passing by value or reference : powershell
more information :
PSVersion 5.1.19041.906
All files can be found here : [*]https://drive.google.com/drive/folders/1Ya0Xyxewgo6FtUHVbGqSASqXOFSlXvbR?usp=sharing
I would like to try to pass an object by reference, variable. In this object I would like to pass a bunch of information (containing different other variables/data).
Sometimes there's a need to return it back (one variable), by return $menuObjts.
At paragraphs 'INFO' are $menuObjts and $menuObjts[‘MENUS’] shown.
More information about these object I have tried to figure it out by gettype().fullname.
REMARK : in the code here I've used $global: for allowing to ACCESS and CHANGE the variable and be able to make a screenshot and use it for test purpose.
So my problem is to ACCESS and CHANCE values in $menuObjts[‘MENUS’], which is a part, element of $menuObjts.
Thanks to #Santiago Squarzon for his patience and quick reaction.
The idea is to create dynamically menus from the CSV file (what works) and calls the selected functions by name - $menus_.FUNCTION which are retrieved.
But now I would like to extend it and be able to create multi sub menus.
There are two seperate MENU_GRP elements :
$menuObjts.MENU_GRP
-- contains info about the current/active/selected one
($menuObjts.**MENUS** | Where-Object {[int]**$($_).MENU_GRP** -eq ...
-- $menuObjts.MENUS : contains all posible menus (CSV)
So I import a range menu-items by a CSV file.
So these $menus_ are added to $menuObjts.MENUS / $menuObjts[‘MENUS’]
There are other features in $menus_ such as MENU, PARENT, MENU_GRP, MENU_IDX, MENU_OFFSET, MENU_SEL_TYPE, nrElems, FUNCTION, info, status , SEL, RESTART, STOP
$global:menus_ = Import-Csv -Delimiter "," $($curPath)
$menuGRP_ = 0 # 0 - MAIN
$menus_.MENU
$nrRestarts = #($menus_ | Where-Object { [int]$_.RESTART -eq 1 -and [int]$_.MENU_GRP -eq 0 }).Count
write-host (" info : - nrRestarts: {0}" -f ($nrRestarts))
# SET : values in one object : $menuObjts
$global:menuObjts =[ordered]#{
MENUS = $menus_;
MENU_GRP = $menuGRP_;
MENU_SEL_TYPE = $null;
MENU_OFFSET = $null;
nrElems = $null;
sel_input = $null;
MENU_IDX = $null}
$menuObjts.MENUS?MENU_GRP = 0 or $menuObjts.MENUS?MENU_GRP = 6
$menuObjts.MENUS?MENU_OFFSET = -1 or $menuObjts.MENUS?MENU_OFFSET = 12
$menuObjts.MENUS?nrElems = 13 or $menuObjts.MENUS?nrElems = 4
$menuObjts.MENUS ? - ? because I don't know how to retrieve the underlying object and their features/data
So my problem is how to retrieve each element of $menus_ in $menuObjts.MENUS again.
The idea is that via one variable, the next one will be calculated ([*]see function updateMenuObjtsInfo )
So my question is how can I see by type, how to get the wanted data ...
information of variables/object Get-Variable
gettype()
$menuObjts
$menuObjts.MENUS
$menuObjts.MENUS | select -first 1
These are a few things I want to achieve, but this doesn't work proper ($_).MENU_GRP
$1stElementGrp_ = $($menus_ | Where { [int]$($_).MENU_GRP -eq $menuObjts.MENU_GRP }| Select -First 1 )
$menuOFFSET_ = $($1stElementGrp_).MENU_OFFSET
$menuNrElems_ = $($1stElementGrp_).nrElems
##### where $($menuObjts.MENUS).MENU_GRP -eq $menuObjts.MENU_GRP -> .MENU_OFFSET
$menuObjts.MENU_OFFSET = $($menuObjts.MENUS | Where-Object { [int]$($_).MENU_GRP -eq $menuObjts.MENU_GRP}| Select -First 1 ).MENU_OFFSET
$menuObjts.nrElems = #($menuObjts.MENUS | Where-Object { [int]$($_).MENU_GRP -eq $menuObjts.MENU_GRP -and [int]$($_).SEL -eq 1}).Count
Another idea … was adding methods, but I’m struggling with my (little) knowledge of Powershell.
(based on 4 Ways to Create PowerShell Objects | RidiCurious.com )
$menuObjts | Add-Member -MemberType ScriptMethod -Name "getMENUS_RESTART" -Value $( this.MENUS | Where-Object { [int]$_.RESTART -eq 1 -and [int]$_.MENU_GRP -eq $menuGRP_ })
INFO - $menuObjts :
Name Value
---- -----
MENUS {#{MENU;PARENT;MENU_GRP;MENU_IDX;MENU_OFFSET;MENU_SEL_TYPE;nrElems;FUNCTION;info;status;SEL;RESTART;STOP=typeInstallation;LICENSE;0;0;-1;0;13;f1;Windows-Defende...
MENU_GRP 0
MENU_SEL_TYPE
MENU_OFFSET
nrElems
sel_input
MENU_IDX
INFO - $menuObjts.MENUS :
MENU;PARENT;MENU_GRP;MENU_IDX;MENU_OFFSET;MENU_SEL_TYPE;nrElems;FUNCTION;info;status;SEL;RESTART;STOP
-----------------------------------------------------------------------------------------------------
typeInstallation;LICENSE;0;0;-1;0;13;f1;Windows-Defender has to be uninstalled
activate;;0;1;-1;0;13;f2;Windows has to be upgraded if working with an EVALUATION prod key;-1;0;0;0
NAME;HOST;0;2;-1;0;13;f3;F-SEC has to be configured as an isolated machine on the CSI server;-1;0;0;0
IP;;0;3;-1;0;13;f4;disable default Windows NTP service;-1;0;1;0
routes;;0;4;-1;0;13;f5;disable default Windows NTP service;-1;0;0;0
users;;0;5;-1;0;13;f6;disable default Windows NTP service;-1;0;0;0
ANTI VIRUS;SERVICEs;0;6;-1;0;13;f7;disable default Windows NTP service;-1;0;0;0
NTP;;0;7;-1;0;13;f8;;-1;0;0;0
MEINBERG;;0;8;-1;0;13;f9;;-1;0;0;0
addPATH;postgres;0;9;-1;0;13;f10;;-1;0;0;0
check;after CSI;0;10;-1;0;13;f11;;-1;0;0;0
execute;;0;11;-1;0;13;f12;;-1;0;0;1
quite;;0;12;-1;0;13;f13;;-1;0;0;1
WINDOWS DEFENDER;ANTI VIRUS;6;13;12;1;4;f14;;-1;0;0;0
F-SEC;;6;14;12;1;4;f15;;-1;0;0;0
execute;;6;15;12;1;4;f16;;-1;0;0;1
quite;;6;16;12;1;4;f17;;-1;0;0;1
Additional information [2021/05/04]
PS C:\Users\Administrator> $menuObjts.MENUS | Get-Member
TypeName: System.Management.Automation.PSCustomObject
Name MemberType Definition
---- ---------- ----------
Equals Method bool Equals(System.Object obj)
GetHashCode Method int GetHashCode()
GetType Method type GetType()
ToString Method string ToString()
FUNCTION NoteProperty string FUNCTION=f1
info NoteProperty string info=Windows-Defender has to be uninstalled, before installing an other anti-virus program
MENU NoteProperty string MENU=typeInstallation
MENU_GRP NoteProperty string MENU_GRP=0
MENU_IDX NoteProperty string MENU_IDX=0
MENU_OFFSET NoteProperty string MENU_OFFSET=-1
...
PS C:\Users\Administrator> $menuObjts.MENUS
MENU : typeInstallation
PARENT : LICENSE
MENU_GRP : 0
MENU_IDX : 0
MENU_OFFSET : -1
MENU_SEL-TYPE :
nrElems : 13
FUNCTION : f1
info : Windows-Defender has ...
status : -1
SEL : 0
RESTART : 1
STOP :
MENU : activate
PARENT :
MENU_GRP : 0
...
I have the impression that $menus_ is added as a 'value' instead as an object to $menuObjts - Value : {#{MENU=
PS C:\Users\Administrator> $menuObjts.MENUS.PSobject.Properties
ReferencedMemberName : Length
ConversionType :
MemberType : AliasProperty
TypeNameOfValue : System.Int32
IsSettable : False
IsGettable : True
Value : 17
Name : Count
IsInstance : False
MemberType : Property
Value : 17
IsSettable : False
IsGettable : True
TypeNameOfValue : System.Int32
Name : Length
IsInstance : True
...
MemberType : Property
Value : {#{MENU=typeInstallation; PARENT=LICENSE; MENU_GRP=0; MENU_IDX=0; MENU_OFFSET=-1; MENU_SEL-TYPE=; nrElems=13;FUNCTION=f1; info=Windows-Defender has to be uninstalled, before installing an other anti-virus program;status=-1; SEL=0; RESTART=1; STOP=},
#{MENU=activate; PARENT=; MENU_GRP=0; MENU_IDX=1; MENU_OFFSET=-1; MENU_SEL-TYPE=; nrElems=13; FUNCTION=f2; info=Windows has to be upgraded if working with an EVALUATION prod key;status=-1; SEL=0; RESTART=0; STOP=},
#{MENU=NAME; PARENT=HOST; MENU_GRP=0; MENU_IDX=2; MENU_OFFSET=-1;MENU_SEL-TYPE=; nrElems=13; FUNCTION=f3; info=F-SEC has to be configured as an isolated machine on the CSI server;status=-1; SEL=0; RESTART=0; STOP=},
#{MENU=IP; PARENT=; MENU_GRP=0; MENU_IDX=3; MENU_OFFSET=-1; MENU_SEL-TYPE=;nrElems=13; FUNCTION=f4; info=disable default Windows NTP service; status=-1; SEL=0; RESTART=1; STOP=}...}
IsSettable : False
IsGettable : True
TypeNameOfValue : System.Object
Name : SyncRoot
IsInstance : True
...
First of all, I would recommend a good read on: Where-Object, about_Arrays and this good article on PS Objects
# Storing the CSV in the $csv var
$csv = #'
MENU;PARENT;MENU_GRP;MENU_IDX;MENU_OFFSET;MENU_SEL_TYPE;nrElems;FUNCTION;info;status;SEL;RESTART;STOP
typeInstallation;LICENSE;0;0;-1;0;13;f1;Windows-Defender has to be uninstalled
activate;;0;1;-1;0;13;f2;Windows has to be upgraded if working with an EVALUATION prod key;-1;0;0;0
NAME;HOST;0;2;-1;0;13;f3;F-SEC has to be configured as an isolated machine on the CSI server;-1;0;0;0
IP;;0;3;-1;0;13;f4;disable default Windows NTP service;-1;0;1;0
routes;;0;4;-1;0;13;f5;disable default Windows NTP service;-1;0;0;0
users;;0;5;-1;0;13;f6;disable default Windows NTP service;-1;0;0;0
ANTI VIRUS;SERVICEs;0;6;-1;0;13;f7;disable default Windows NTP service;-1;0;0;0
NTP;;0;7;-1;0;13;f8;;-1;0;0;0
MEINBERG;;0;8;-1;0;13;f9;;-1;0;0;0
addPATH;postgres;0;9;-1;0;13;f10;;-1;0;0;0
check;after CSI;0;10;-1;0;13;f11;;-1;0;0;0
execute;;0;11;-1;0;13;f12;;-1;0;0;1
quite;;0;12;-1;0;13;f13;;-1;0;0;1
WINDOWS DEFENDER;ANTI VIRUS;6;13;12;1;4;f14;;-1;0;0;0
F-SEC;;6;14;12;1;4;f15;;-1;0;0;0
execute;;6;15;12;1;4;f16;;-1;0;0;1
quite;;6;16;12;1;4;f17;;-1;0;0;1
'#|convertfrom-csv -Delimiter ';'
Get the first element of the array
$1stElementGrp_ = $csv[0] # Like this
$1stElementGrp_ = $csv | Select-Object -First 1 # Or Like this
Get the value of the property MENU_OFFSET and nrElems of the variable $1stElementGrp_
$menuOFFSET_ = $1stElementGrp_.MENU_OFFSET # $menuOFFSET_ returns -1
$menuNrElems_ = $1stElementGrp_.nrElems # $menuNrElems_ returns 13
Not sure what you're trying filter here
# $menuObjts.MENU_OFFSET = ($menuObjts.MENUS | Where-Object {
# [int]$($_).MENU_GRP -eq $menuObjts.MENU_GRP
# }| Select -First 1).MENU_OFFSET
#
# $menuObjts.nrElems = #($menuObjts.MENUS | Where-Object {
# [int]$($_).MENU_GRP -eq $menuObjts.MENU_GRP -and [int]$($_).SEL -eq 1}).Count
# }
Example: If you want to filter all the rows where MENU_OFFSET = -1
$csv | Where-Object {$_.MENU_OFFSET -eq -1} |
Select-Object MENU, PARENT, MENU_GRP, MENU_IDX, MENU_OFFSET |
Format-Table
Returns
MENU PARENT MENU_GRP MENU_IDX MENU_OFFSET
---- ------ -------- -------- -----------
typeInstallation LICENSE 0 0 -1
activate 0 1 -1
NAME HOST 0 2 -1
IP 0 3 -1
routes 0 4 -1
users 0 5 -1
ANTI VIRUS SERVICEs 0 6 -1
NTP 0 7 -1
MEINBERG 0 8 -1
addPATH postgres 0 9 -1
check after CSI 0 10 -1
execute 0 11 -1
quite 0 12 -1
Example: If you want to filter all the rows where MENU_GRP = 6 AND MENU matches the word 'WINDOWS'
$csv | Where-Object {$_.MENU_GRP -eq 6 -and $_.MENU -match 'Windows'} |
Select-Object MENU, PARENT, MENU_GRP, MENU_IDX, MENU_OFFSET |
Format-Table
Returns:
MENU PARENT MENU_GRP MENU_IDX MENU_OFFSET
---- ------ -------- -------- -----------
WINDOWS DEFENDER ANTI VIRUS 6 13 12
How to get from applocker winevent only path of file and name of file (file.exe), i mean how to filter this info
Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL"
Have a look at the below, to see if this helps your use case. I too, don't have this on a system I can test at this point.
<#
Pull all AppLocker logs from the live AppLocker event log
(requires Applocker)
#>
Get-WinEvent -logname "Microsoft-Windows-AppLocker/EXE and DLL"
<#
Search for live AppLocker EXE/MSI block events: "(EXE) was prevented
from running":
#>
Get-WinEvent -FilterHashtable #{
logname = 'MicrosoftWindows-Applocker/EXE and DLL'
id = 8004
}
<#
Search for live AppLocker EXE/MSI audit events: "(EXE) was allowed
to run but would have been prevented from running if the AppLocker
the policy was enforced":
#>
Get-WinEvent -FilterHashtable #{
logname = 'MicrosoftWindows-Applocker/EXE and DLL'
id = 8003
}
Get-AppLockerEvent - Get event details related to AppLocker
activity
AppLocker events include a number of helpful details that are buried
within the event object or XML. This function will extract helpful
information like the username, rule name, file path, file hash, and
file signature details for easy viewing.
Download: Get-AppLockerEvent.ps1
That log is empty on my machine, but maybe you can do something with the xml from the event:
[xml]$xml = get-winevent application | select -first 1 |
foreach { $_.toxml() }
$xml.event
xmlns System EventData
----- ------ ---------
http://schemas.microsoft.com/win/2004/08/events/event System EventData
Oh I see, you have to restart the appidsvc after setting the group policy. You can use the filepath or fullfilepath properties:
$a = get-winevent "microsoft-windows-applocker/exe and dll" |
select -first 1
[xml]$xml = $a.toxml()
$xml.event.userdata.RuleAndFileData
xmlns : http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0
PolicyNameLength : 3
PolicyName : EXE
RuleId : {fd686d83-a829-4351-8ff4-27c7de5755d2}
RuleNameLength : 24
RuleName : (Default Rule) All files
RuleSddlLength : 53
RuleSddl : D:(XA;;FX;;;S-1-5-32-544;(APPID://PATH Contains "*"))
TargetUser : S-1-5-21-1528843147-373324174-1919417754-1001
TargetProcessId : 3876
FilePathLength : 51
FilePath : %PROGRAMFILES%\GOOGLE\CHROME\APPLICATION\CHROME.EXE
FileHashLength : 0
FileHash :
FqbnLength : 1
Fqbn : -
TargetLogonId : 0x4d253a0
FullFilePathLength : 59
FullFilePath : C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
I have this Select-String using a regex containing a named group
$m=Select-String -pattern '(?<mylabel>error \d*)' -InputObject 'Some text Error 5 some text'
Select-String does its job:
PS > $m.Matches.groups
Groups : {0, mylabel}
Success : True
Name : 0
Captures : {0}
Index : 10
Length : 7
Value : Error 5
Success : True
Name : mylabel
Captures : {mylabel}
Index : 10
Length : 7
Value : Error 5
I can get the value of the matching named group by using the index of the group, no problem:
PS > $m.Matches.groups[1].Value
Error 5
But I have no success in getting the same result by using the named regex group (mylabel). I found statements like $m.Matches.groups["mylabel"].Value but that doesn't work on my machines (W10/W2012, PS 5.1)
You got one correct answer in the comment above, but here is how to do it without using the 0 match index:
$m.Matches.groups | ? { $_.Name -eq 'mylabel' } | Select-Object -ExpandProperty Value
I have obtained this JSON from the AppVeyor API:
$build = Invoke-WebRequest -Uri https://ci.appveyor.com/api/projects/XXX/XXX/branch/master | ConvertFrom-Json
I need to look at this array:
$build.build.jobs
Which returns:
jobId : jgc1moa0o1tjdkyq
name : Environment: PYTHON=C:\Python35, PYTHON_VERSION=3.5.x, PYTHON_ARCH=32
allowFailure : False
messagesCount : 0
compilationMessagesCount : 0
compilationErrorsCount : 0
compilationWarningsCount : 0
testsCount : 0
passedTestsCount : 0
failedTestsCount : 0
artifactsCount : 1
status : success
started : 2017-03-23T08:34:59.2087897+00:00
finished : 2017-03-23T08:37:03.7539463+00:00
created : 2017-03-23T08:34:52.1106626+00:00
updated : 2017-03-23T08:37:03.7539463+00:00
jobId : 3yqddtiapirm49ow
name : Environment: PYTHON=C:\Python35-x64, PYTHON_VERSION=3.5.x, PYTHON_ARCH=64
allowFailure : False
messagesCount : 0
compilationMessagesCount : 0
compilationErrorsCount : 0
compilationWarningsCount : 0
testsCount : 0
passedTestsCount : 0
failedTestsCount : 0
artifactsCount : 1
status : success
started : 2017-03-23T08:37:08.5375578+00:00
finished : 2017-03-23T08:39:10.7684334+00:00
created : 2017-03-23T08:34:52.4856621+00:00
updated : 2017-03-23T08:39:10.7840711+00:00
I need jobId where name contains Python35-X64.
The following expression returns nothing, what am I doing wrong?
$job_id = $build.build.jobs | where { $_.name -like "*Python35-X64*" }
Your expression returns nothing because the result gets assigned to variable $job_id. The variable in this case does not contain the id of the job but the job object.
$job = $build.build.jobs |? name -like "*Python35-X64*" | Select-Object -First 1;
$job;
$job_id = $job.jobId;
Attention: If you do not select the first result the $job will contain an array of jobs in case that multiple names match the where clause.
In case you want to select the jobId attribute directly you can do so as follows.
$job_id = ($build.build.jobs |? name -like "*Python35-X64*" | Select-Object -First 1).jobId;