[EventSource] FSLogix VHD Lock Alerts | LM Exchange

Gjon · 2021-03-18T04:27:31Z

Installation 1. Import the FSLogix Apps property source (L7K9XW) and create a new event source:Name: FSLogix LocksApplies to: hasCategory("FSLogixEnabled") Type: Script EventScript: Copy the code at the bottom of the post and save it as "fslogix.ps1". Upload this into LM and set these fields accordingly: Windows Script: fslogix.ps1 Parameters: ##HOSTNAME## Schedule: 5 minutesAdd a filter: Type: Message Comparison: Contain Value: lockedClear after: 60 minutes (or however long you want)Alert Messge: Host: ##HOST## Message: ##MESSAGE## Detected on: ##START## Note: Your collector will need permissions to view the event logs of the remote servers! Result: Save below as fslogix.ps1: $hostname=$args[0] $date = (Get-Date).AddMinutes("-5") $eventlogs = Get-WinEvent -ComputerName $hostname -LogName "Microsoft-FSLogix-Apps/Operational" | ? { $_.timecreated -gt $date } $object = New-Object System.Object $object | Add-Member -MemberType NoteProperty events $events $object.events = @() foreach ($event in $eventlogs) { $obj = New-Object System.Object $obj | Add-Member -type NoteProperty -name happenedOn -Value $event.TimeCreated.ToString("yyyy-MM-ddTHH:mm:ss") $obj | Add-Member -type NoteProperty -name severity -Value $event.LevelDisplayName $obj | Add-Member -type NoteProperty -Name message -Value $event.Message $object.events += $obj } $output = $object | ConvertTo-Json return $output

MoreDiscussions

[EventSource] FSLogix VHD Lock Alerts | LM Exchange | LogicMonitor Community