{"id":1871,"date":"2014-01-03T10:32:00","date_gmt":"2014-01-03T10:32:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/powershell\/2014\/01\/03\/using-event-logs-to-diagnose-errors-in-desired-state-configuration\/"},"modified":"2024-02-22T14:40:33","modified_gmt":"2024-02-22T22:40:33","slug":"using-event-logs-to-diagnose-errors-in-desired-state-configuration","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powershell\/using-event-logs-to-diagnose-errors-in-desired-state-configuration\/","title":{"rendered":"Using Event Logs to Diagnose Errors in Desired State Configuration"},"content":{"rendered":"
\n

Windows PowerShell Desired State Configuration (DSC), just like any other Windows software, records errors and events in logs<\/a> that can be viewed from the Event Viewer<\/a>. However, the trick lies in effectively parsing these logs, so we know exactly why a particular operation failed.<\/p>\n

In this blog, we explain where the DSC event logs are, and how their content is structured. We also discuss how we can use DSC events for diagnosing failures, and how we can play with the events to gather maximum information from a single DSC operation. We use the term \u201cDSC operation\u201d to identify a single operation that DSC performs from beginning to end. Each DSC cmdlet, when run, represents a single operation. For instance, Start-DscConfiguration<\/a> is a DSC operation.<\/p>\n

<\/a><\/p>\n

Where are DSC event logs?<\/h2>\n

In Event Viewer, DSC events can be seen inside the tree structure:\u00a0 Applications and Services Logs\/Microsoft\/Windows\/Desired State Configuration<\/strong>.<\/p>\n

\"Image<\/a><\/p>\n

\"Image<\/a><\/p>\n

The corresponding PowerShell cmdlet, Get-WinEvent<\/a>,<\/span> can also be run to view the event logs.<\/p>\n

PS C:\\Users> Get-WinEvent -LogName “Microsoft-Windows-Dsc\/Operational”<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0\u00a0 ProviderName: Microsoft-Windows-DSC<\/span><\/p>\n

\u00a0<\/span><\/p>\n

TimeCreated\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Id LevelDisplayName Message\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

———–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 — —————- ——-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n

11\/17\/2013 10:27:23 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4102 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {02C38626-D95A-47F1-9DA2-C1D44A7128E7} : …\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

\n

As shown in the example above, DSC\u2019s primary log name is \u201cMicrosoft-Windows-DSC\u201d. This is appended to the channel name to create the complete log name. The DSC engine writes mainly into three types of logs : Operational, Analytic, and Debug logs<\/a>. Because the analytic and debug logs are turned off by default, and because troubleshooting an error is much more efficient if these logs are enabled before running an operation, I recommend turning on the logs first. These logs can be enabled in Event Viewer<\/a>. The log name for the analytic channel is \u201cMicrosoft-Windows-Dsc\/Analytic\u201d, and the debug channel is \u201cMicrosoft-Windows-Dsc\/Debug\u201d.<\/p>\n

\u00a0You could also use the wevtutil<\/a> utility to enable the logs, as shown in the following example.<\/p>\n

\u00a0 PS C:\\Users> wevtutil.exe set-log \u201cMicrosoft-Windows-Dsc\/Analytic\u201d \/q:true \/e:true <\/span><\/span><\/p>\n

\u00a0<\/span><\/p>\n

<\/a>What do DSC logs contain?<\/h2>\n

\u00a0DSC logs are split over the three log channels based on the importance of the message. The operational log in DSC contains all error messages, and can be used to identify a problem. The analytic log has a higher volume of events, and can identify where error(s) occurred. This channel also contains verbose messages (if any). The debug log contains logs that can help a developer understand how the errors occurred.<\/p>\n

DSC event messages are structured such that every event message begins with a job ID that uniquely represents a DSC operation. For instance, in the example below, we try to obtain the message from the first event logged into the operational DSC log.<\/p>\n

PS C:\\Users> $AllDscOpEvents=get-winevent -LogName “Microsoft-Windows-Dsc\/Operational”<\/span><\/p>\n

\u00a0<\/span><\/p>\n

PS C:\\Users> $FirstOperationalEvent=$AllDscOpEvents[0]<\/span><\/p>\n

\u00a0<\/span><\/p>\n

PS C:\\Users> $FirstOperationalEvent.Message<\/span><\/p>\n

Job {02C38626-D95A-47F1-9DA2-C1D44A7128E7} : <\/span><\/p>\n

Consistency engine was run successfully. <\/span><\/p>\n

\n

DSC events are logged in a particular structure that enables the user to aggregate events from one DSC job. The structure is as follows:\nJob ID : <Guid>\n<Event Message><\/strong><\/p>\n

<\/a>Gathering events from a single DSC operation<\/h2>\n

\u00a0DSC event logs contain events generated by various DSC operations. However, the user is usually concerned with the detail about just one particular operation. All DSC logs can be grouped by the job ID property that is unique for every DSC operation. The job ID is displayed as the first property value in all DSC events. The following steps explain how we can accumulate all events in a grouped array structure.<\/p>\n

<##########################################################################<\/span><\/p>\n

\u00a0Step 1 : Enable analytic and debug DSC channels (Operational channel is enabled by default)<\/span><\/p>\n

###########################################################################><\/span><\/p>\n

\u00a0<\/span><\/p>\n

wevtutil.exe<\/span> set-log<\/span> \u201cMicrosoft-Windows-Dsc\/Analytic\u201d<\/span> \/q:true<\/span> \/e:true<\/span><\/span><\/p>\n

wevtutil.exe<\/span> set-log<\/span> \u201cMicrosoft-Windows-Dsc\/Debug\u201d<\/span> \/q:True<\/span> \/e:true<\/span><\/span><\/p>\n

\u00a0<\/span><\/p>\n

<##########################################################################<\/span><\/p>\n

\u00a0Step 2 : Perform the required DSC operation (Below is an example, you could run any DSC operation instead)<\/span><\/p>\n

###########################################################################><\/span><\/p>\n

\u00a0<\/span><\/p>\n

Get-DscLocalConfigurationManager<\/span><\/p>\n

\u00a0<\/span><\/p>\n

<##########################################################################<\/span><\/p>\n

Step 3 : Collect all DSC Logs, from the Analytic, Debug and Operational channels<\/span><\/p>\n

###########################################################################><\/span><\/p>\n

\u00a0<\/span><\/p>\n

$DscEvents<\/span>=[<\/span>System.Array<\/span>]<\/span>(Get-WinEvent<\/span> “Microsoft-windows-dsc\/operational”<\/span>) `<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +<\/span> [<\/span>System.Array<\/span>]<\/span>(Get-WinEvent<\/span> “Microsoft-Windows-Dsc\/Analytic”<\/span> -Oldest<\/span>) `<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +<\/span> [<\/span>System.Array<\/span>]<\/span>(Get-Winevent<\/span> “Microsoft-Windows-Dsc\/Debug”<\/span> -Oldest<\/span>)<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

<##########################################################################<\/span><\/p>\n

\u00a0Step 4 : Group all logs based on the job ID<\/span><\/p>\n

###########################################################################><\/span><\/p>\n

$SeparateDscOperations<\/span>=<\/span>$DscEvents<\/span> |<\/span> Group<\/span> {$_<\/span>.<\/span>Properties[<\/span>0<\/span>].<\/span>value}\u00a0 <\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Here, the variable $SeparateDscOperations<\/span> contains logs grouped by the job IDs. Each array element of this variable represents a group of events logged by a different DSC operation. Hence, we can use this variable to access more information about the logs.<\/p>\n

PS C:\\> $SeparateDscOperations<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Count Name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Group\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n

—– —-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 —–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

\u00a0\u00a0 48 {1A776B6A-5BAC-11E3-BF… {System.Diagnostics.Eventing.Reader.EventLogRecord, System.Diagnostics….<\/span><\/p>\n

\u00a0\u00a0 40 {E557E999-5BA8-11E3-BF… {System.Diagnostics.Eventing.Reader.EventLogRecord, System.Diagnostics….<\/span><\/p>\n

\u00a0<\/span><\/p>\n

PS C:\\> $SeparateDscOperations[0].Group<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0\u00a0 ProviderName: Microsoft-Windows-DSC<\/span><\/p>\n

\u00a0<\/span><\/p>\n

TimeCreated\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Id LevelDisplayName Message\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n

———–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 — —————- ——-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4115 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4198 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4114 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4102 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4098 Warning\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4098 Warning\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4176 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a04182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 3:47:29 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4182 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\n

We can mine the data in the variable $SeparateDscOperations<\/span> using Where-Object<\/a>. Let me discuss a few reasons why we\u2019d want to do this:<\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Requirement<\/strong> 1<\/strong>: Show me all DSC operations on my machine that had some failure.<\/p>\n

PS C:\\> $SeparateDscOperations\u00a0 | Where-Object {$_.Group.LevelDisplayName -contains “Error”}<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Count Name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Group\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

—– —-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 —–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

\u00a0\u00a0 38 {5BCA8BE7-5BB6-11E3-BF… {System.Diagnostics.Eventing.Reader.EventLogRecord, System.Diagnostics….<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Explanation: All events have a level display as per <\/em>severity levels<\/em><\/a> . This information can be used to identify the error events.<\/em><\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Requirement<\/strong> 2<\/strong>:\u00a0 Give me details of operations run in the last half hour.<\/p>\n

PS C:\\> $DateLatest=(Get-date).AddMinutes(-30)<\/span><\/p>\n

\u00a0<\/span><\/p>\n

PS C:\\> $SeparateDscOperations\u00a0 | Where-Object {$_.Group.TimeCreated -gt $DateLatest}<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Count Name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Group\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

—– —-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0—–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

\u00a0\u00a0\u00a0 1 {6CEC5B09-5BB0-11E3-BF… {System.Diagnostics.Eventing.Reader.EventLogRecord}\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

Explanation<\/em>:<\/span><\/span> TimeCreated, a property of every Windows event, states the time the event was created. Comparing this property with a particular date\/time object can be used to filter all events.<\/em><\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Requirement 3<\/strong>: Display all messages from the latest operation.<\/p>\n

PS C:\\> $SeparateDscOperations[0].Group.Message<\/span><\/p>\n

Job {5BCA8BE7-5BB6-11E3-BF41-00155D553612} : <\/span><\/p>\n

Running consistency engine.<\/span><\/p>\n

Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : <\/span><\/p>\n

Configuration is sent from computer NULL by user sid S-1-5-18.<\/span><\/p>\n

Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : <\/span><\/p>\n

Displaying messages from built-in DSC resources:<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0WMI channel 1 <\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0ResourceID:\u00a0 <\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0Message : [INCH-VM]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [] Starting consistency engine.<\/span><\/p>\n

Job {1A776B6A-5BAC-11E3-BF41-00155D553612} : <\/span><\/p>\n

Displaying messages from built-in DSC resources:<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0WMI channel 1 <\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0ResourceID:\u00a0 <\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0Message : [INCH-VM]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [] Consistency check completed. <\/span><\/p>\n

\u00a0Explanation<\/em>:<\/span><\/span> The latest operation is stored in the first index of the array group $SeparateDscOperations. Hence, querying the group\u2019s messages for index 0 returns all messages for the latest operation.<\/em><\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>Requirement 4<\/strong>: My most recent operation failed. What is the error message logged?<\/p>\n

PS C:\\> $myFailedEvent=($SeparateDscOperations[0].Group | Where-Object {$_.LevelDisplayName -eq “Error”})<\/span><\/p>\n

\u00a0<\/span><\/p>\n

PS C:\\> $myFailedEvent.Message<\/span><\/p>\n

Job {5BCA8BE7-5BB6-11E3-BF41-00155D553612} : <\/span><\/p>\n

DSC Engine Error : <\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0Error Message Current configuration does not exist. Execute Start-DscConfiguration command with -Path pa<\/span><\/p>\n

rameter to specify a configuration file and create a current configuration first. <\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Error Code : 1 <\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Explanation<\/em>:<\/span><\/span> $SeparateDscOperations[0].Group contains a set of events for the latest operation. Run the Where-Object cmdlet to filter the events based on their level display name. Results are stored in the $myFailedEvent variable, which can be further dissected to get the event message.<\/em><\/p>\n

\u00b7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span>\u00a0Requirement 5<\/strong>: I know the required operation\u2019s job ID = $jobX ; give me all events generated for this job ID.<\/p>\n

PS C:\\> ($SeparateDscOperations | Where-Object {$_.Name -eq $jobX} ).Group<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0\u00a0 ProviderName: Microsoft-Windows-DSC<\/span><\/p>\n

\u00a0<\/span><\/p>\n

TimeCreated\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Id LevelDisplayName Message\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

———–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 — —————- ——-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 4:33:24 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4102 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {847A5619-5BB2-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 4:33:24 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4168 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {847A5619-5BB2-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 4:33:24 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4146 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {847A5619-5BB2-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

12\/2\/2013 4:33:24 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4120 Information\u00a0\u00a0\u00a0\u00a0\u00a0 Job {847A5619-5BB2-11E3-BF41-00155D553612} : …\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

Explanation<\/em>:<\/span><\/span> $SeparateDscOperations is an array of groups, each of which has the name as the unique job ID. By running the Where-Object cmdlet, we can extract those groups of events that have a particular job ID.<\/em><\/p>\n

\n

The usage can be extended based on your requirements, to diagnose errors, or just to read events. These are just a few examples to get you started with DSC eventing information. They can make troubleshooting or reporting errors much quicker.<\/p>\n

\n

Inchara Shivalingaiah<\/p>\n

Windows PowerShell Development<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Windows PowerShell Desired State Configuration (DSC), just like any other Windows software, records errors and events in logs that can be viewed from the Event Viewer. However, the trick lies in effectively parsing these logs, so we know exactly why a particular operation failed. In this blog, we explain where the DSC event logs are, […]<\/p>\n","protected":false},"author":600,"featured_media":13641,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[142,150,248,251,345,348],"class_list":["post-1871","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powershell","tag-desired-state-configuration","tag-dsc","tag-powershell","tag-powershell-4-0","tag-windows-powershell-4-0","tag-windows-powershell-desired-state-configuration"],"acf":[],"blog_post_summary":"

Windows PowerShell Desired State Configuration (DSC), just like any other Windows software, records errors and events in logs that can be viewed from the Event Viewer. However, the trick lies in effectively parsing these logs, so we know exactly why a particular operation failed. In this blog, we explain where the DSC event logs are, […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/1871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/users\/600"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/comments?post=1871"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/1871\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media\/13641"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media?parent=1871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/categories?post=1871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/tags?post=1871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}