How to create a log file with multiple sources?

This topic contains 3 replies, has 2 voices, and was last updated by Profile photo of Dave Wyatt Dave Wyatt 2 years, 3 months ago.

  • Author
    Posts
  • #18447
    Profile photo of Michael Felkins
    Michael Felkins
    Participant

    Hi,

    I have a requirement to build a custom event log file that has two sources.

    In Powershell, I do this:

    New-EventLog -LogName GFWM_LOG -Source DBLogger
    Limit-EventLog -OverflowAction OverWriteAsNeeded -MaximumSize 20480KB -LogName GFWM_LOG

    New-EventLog -LogName GFWM_LOG -Source LogginService

    However, in DSC if I try to reference the same log file it complains about duplicates and errors.

    I have looked at the examples and the help file, but they don't address the issue of multiple sources.

    As I look further into my project I see some log file with as many as five sources.

    Here is how I build the log file in my DSC script:

    cCreateLogFile GFWMF-DBLogger-EventLogs {
    Name = 'GFWM_LOG'
    Source = 'DBLogger'
    Limit = 20480KB
    Id = 411
    Ensure = 'Present'
    }

    [b]And the module cCreateLogFile looks like this: (I have xx out the company name) [/b]
    function Get-TargetResource
    {
    [CmdletBinding()]
    [OutputType([System.Collections.Hashtable])]
    param
    (
    [parameter(Mandatory = $true)]
    [System.String]
    $Name
    )

    $Configuration = @{
    Name = $Name
    Source = $Source
    limit = $limit
    Id = $Id
    }

    Try{
    write-verbose "Get: Getting current Logfile $name status"
    $Status = [System.Diagnostics.EventLog]::Exists($Name)

    If ($Status -eq $true) {
    write-verbose "Test: Logfile $name Present"
    $Configuration.Add('Ensure','Present')
    } else {
    write-verbose 'Test: Logfile $name Not present'
    $Configuration.Add('Ensure','Absent')
    }
    return $Configuration
    }
    Catch{
    $exception = $_
    Write-Verbose ("An Error Occurred: $exception.message")
    }
    }

    function Set-TargetResource
    {
    [CmdletBinding()]
    param
    (
    [parameter(Mandatory = $true)]
    [System.String]
    $Name,

    [System.String]
    $Source,

    [System.UInt32]
    $limit,

    [System.UInt32]
    $Id,

    [ValidateSet('Present','Absent')]
    [System.String]
    $Ensure
    )

    try {
    if ($Ensure -like 'Present')
    {
    write-verbose "Set: Creating Logfile $Name $Source"
    new-eventlog -logname $Name -Source $Source
    limit-eventLog -logname $Name -MaximumSize $limit -overflowaction OverwriteOlder
    write-eventlog -logname $Name -Source $Source -Message 'Eventlog created by DSC Configuration=EWM-WebRole,`
    Module=xxxxxxxxxx -Resource=XX_CreateLogFile' -id $Id
    }
    else
    {
    write-verbose "Set: Removing Logfile $Name"
    Remove-EventLog -LogName $name
    }
    }
    Catch{
    $exception = $_
    Write-Verbose ("An Error Occurred: $exception.message")
    }
    }

    function Test-TargetResource
    {
    [CmdletBinding()]
    [OutputType([System.Boolean])]
    param
    (
    [parameter(Mandatory = $true)]
    [System.String]
    $Name,

    [System.String]
    $Source,

    [System.UInt32]
    $limit,

    [System.UInt32]
    $Id,

    [ValidateSet('Present','Absent')]
    [System.String]
    $Ensure
    )

    try {
    write-verbose "Test: Getting current Logfile $name status"
    $Status = [System.Diagnostics.EventLog]::Exists($Name)

    if ($Ensure -like 'Present')
    {

    if (($Status -eq $true))
    {
    return $true
    }
    else
    {
    return $false
    }

    }
    else
    {

    if ($Status -eq $true)
    {
    return $false
    }
    else
    {
    return $true
    }

    }
    }
    Catch {
    $exception = $_
    Write-Verbose ("An Error Occurred: $exception.message")
    }
    }

    Export-ModuleMember -Function *-TargetResource

  • #18449
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    New-EventLog's -Source parameter accepts an array of strings. You could modify your DSC resource to accept the same thing, eliminating the need for multiple calls.

    As you've discovered, you can't have multiple DSC resources with the same key properties in the same configuration / MOF document. I suspect, in this case, your cCreateLogFile resource is using the Name property as its key value. If so, that means you need to be able to pass in all of the parameters necessary to construct that log (including multiple sources) in a single call for that log Name. Even if New-EventLog didn't allow multiple Source values to be passed in a single call, your resource would still need to accept multiple Sources, and the Set-TargetResource method would be responsible for calling New-EventLog as many times as needed.

    Alternatively, if it made sense to do so, you could make the Source property a Key property on the DSC resource. Then each unique Name + Source combination should be allowed in the DSC configuration.

  • #18456
    Profile photo of Michael Felkins
    Michael Felkins
    Participant

    Thanks for the quick answer. So editing the cCreateLogFile resource to accept an array of strings would be the solution I am looking for.
    Would that be as simple as editing this section:

    $Configuration = @{
    Name = $Name
    Source = $Source
    limit = $limit
    Id = $Id
    }

    to something like:

    $Source = @()
    $Configuration = @{
    Name = $Name
    Source = $Source
    limit = $limit
    Id = $Id
    }

    Or am I missing the point entirely?

  • #18457
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    You would need to update the parameter from a [String] to a [String[]] in both the Test-, Set- and Get-TargetResource functions of your PSM1 file, and you'd also need to update the Schema.mof file (changing "String Source;" to "String Source[];")

    The current code in the Test-TargetResource and Get-TargetResource functions is pretty skimpy... it only really tests to see if the event log specified by $Name exists, and doesn't bother to verify or retrieve settings for all of the other parameters. While that means you don't need to change anything else in order to support changing Source to an array, it also means that the resource would not detect or correct certain types of configuration drift, such as if a source were deleted (but not the log itself), or someone changed the log file's maximum size.

You must be logged in to reply to this topic.