Forum Discussion

Andy_C's avatar
Andy_C
Icon for Neophyte rankNeophyte
25 days ago

Need an LM Log Source to collect logs from a remote Windows file system

Basically as per, I have about 40 windows boxes I need to get some log file monitoring on. None have internet access , and I don't really want to install 40 odd collectors or OTEL agents, and they are all in different domains so UNC copying isn't really an answer either

The path is C:\ProgramData\Microsoft System Center 2012\Orchestrator\RunbookServerMonitorService.exe\Logs  , just to make it a bit more awkward, which stays the same . All my attempts at a groovy script to get the files just crash and burn even throwing all the AI engines at it ! This is as far as I can get. It reads the newest 20 lines of code whilst running in a !groovy  debug window. That's before we get to converting it to JSON or parsing for specific event text. I gave up when we got to tripple escaping and ##WMI.USER## can't be escaped.

Anybody got a LS they can share or point me to ?

def remoteComputer = "machinename"
def username = 'domain\user'
def password = 'password'

// Folder to check
def folderPath = 'C:\\ProgramData\\Microsoft System Center 2012\\Orchestrator\\RunbookServerMonitorService.exe\\Logs'

// PowerShell command (escaped for Groovy)
def psCommand = """
\$securePass = ConvertTo-SecureString '${password}' -AsPlainText -Force
\$cred = New-Object System.Management.Automation.PSCredential('${username}', \$securePass)
Invoke-Command -ComputerName ${remoteComputer} -Credential \$cred -ScriptBlock {
    param(\$folder)
    if (Test-Path \$folder) {
        \$newest = Get-ChildItem -Path \$folder -File -ErrorAction SilentlyContinue |
            Sort-Object LastWriteTime -Descending | Select-Object -First 1
        if (\$newest) {
            \$lines = Get-Content \$newest.FullName -Tail 20
            Write-Output "Last 20 lines of: \$newest.Name"
            Write-Output \$lines
        } else {
            Write-Output "No files found in: \$folder"
        }
    } else {
        Write-Output "Folder does not exist: \$folder"
    }
} -ArgumentList '${folderPath}' | Out-String
"""

// Run PowerShell from Groovy
def command = ["powershell.exe", "-NoProfile", "-Command", psCommand]
def process = command.execute()

def output = new StringBuffer()
def error = new StringBuffer()
process.consumeProcessOutput(output, error)
process.waitFor()

println "Output:"
println output.toString().trim()

if (error) {
    println "Errors:"
    println error.toString()
}

 

 

1 Reply

  • Hi Andy,

    You could install FluentD or Otel on the collector which would tail the logs remotely from those servers.