Skip to content

Instantly share code, notes, and snippets.

@bgelens
Last active September 9, 2019 07:01
Show Gist options
  • Save bgelens/2746ef6ab08268a2f0caec4e0d39994a to your computer and use it in GitHub Desktop.
Save bgelens/2746ef6ab08268a2f0caec4e0d39994a to your computer and use it in GitHub Desktop.
Run on a Windows Event Collector to enumerate the subscriptions and parse out lot's of details with the `-Detailed` switch and get objects instead
function Get-WECSubscription {
param (
[Parameter(ValueFromPipeline, ValueFromPipeLineByPropertyName)]
[ValidateNotNullOrEmpty()]
[string] $Name,
[switch] $Detailed
)
begin {
$wecUtilPresent = ($null -ne (Get-Command -CommandType Application -Name wecutil -ErrorAction SilentlyContinue))
function GetSubDetails {
param (
[Parameter(ValueFromPipeline)]
[string] $Name
)
$subXML = wecutil gs $Name /f:xml
$subXML[0] = $subXML[0] -replace "^[^<]*"
$subInfo = ([xml]$subXML).subscription
$subTerse = ((wecutil gs $Name | Out-String) -split "`n`r")[-1].Trim() -split "`n"
$subRuntime = wecutil gr $Name
$subRuntime[0] = $subRuntime[0] -replace "^[^a-z]*"
$subRuntime = ($subRuntime| Out-String).Trim() -split "`n"
$eventSource = $subTerse | Select-String -Pattern "^EventSource.*" | ForEach-Object -Process {
$address = ($subTerse[$_.LineNumber] -split ' ')[-1]
$runtimeStartLine = ($subRuntime | Select-String -Pattern $address).LineNumber
[pscustomobject]@{
Address = $address
ComputerName = ($address -split '\.')[0].ToUpper()
Enabled = [bool]::Parse(($subTerse[$_.LineNumber + 1] -split ' ')[-1])
RunTimeStatus = ($subRuntime[$runtimeStartLine] -split ' ')[-1]
LastError = ($subRuntime[$runtimeStartLine + 1] -split ' ')[-1]
LastHeartbeatTime = [datetime]($subRuntime[$runtimeStartLine + 2] -split ' ')[-1]
}
}
[pscustomobject]@{
Name = $subInfo.SubscriptionId
SubscriptionId = $subInfo.SubscriptionId
SubscriptionType = $subInfo.SubscriptionType
Description = $subInfo.Description
ConfigurationMode = $subInfo.ConfigurationMode
RunTimeStatus = ($subRuntime[1] -split ' ')[-1].Trim()
Enabled = [bool]::Parse($subInfo.Enabled)
EventSource = $eventSource
}
}
}
process {
if ($wecUtilPresent) {
$subs = wecutil es
foreach ($sub in $subs) {
$sub = $sub -replace "^[^a-z]*"
if ([string]::IsNullOrEmpty($sub)) {
# potential for bom with PSv6 comming from wecutil
continue
}
if ($PSBoundParameters.ContainsKey('Name') -and $sub -ne $Name) {
continue
}
if ($Detailed) {
$sub | GetSubDetails
}
else {
$sub
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment