I recently created an alternative version of the script template. This one is for PowerShell scripts and includes additions for the logging that I do both within a log file and Event Viewer. I am including the template and the code to add to VSCode to make it a snippet. I also have the code and snippets for adding the logging within the script.<\/p>\n
Template<\/p>\n
Code for snippet in VSCode<\/p>\n
It is a good idea to decide on Event IDs if you are going to write custom Event Logs. These are the IDs I decided to use for Compliance Settings.
\n\u2022 17 – compliance check starting
\n\u2022 42 – success (hitchhiker’s guide)
\n\u2022 1984 – error (1984)
\n\u2022 1822 – needs remediation (Babbage)
\n\u2022 1138 – Remediation starting (THX-1138)
\n\u2022 1949 – Remediation finished with some errors and may still be non-compliant (John von Neumann’s article on the “Theory of self-reproducing automata” is published)
\n\u2022 1936 – successful remediation (Turing)<\/p>\n
Now that we have a template to use for a script that has logging features, how do we handle the actual logging? The Write-EventLog cmdlet is used to write to an Event Log. You need the name of the log, the source, entry type, Event ID, and the message. The template already includes variables used for the log name and source.<\/p>\n
Here is the code I use to write to an Event Log.<\/p>\n
What if you want to capture and write an error message to the Event Log? This is where \u2013ErrorVariable comes into play. Using \u2013ErrorVariable, we write the error message to a variable and then use that variable with the Write-EventLog cmdlet.<\/p>\n
The code follows a cmdlet to write any error messages to a variable. It then checks if the variable is NULL. If it is, then an error message wasn\u2019t captured. If it is not NULL, it writes the variable to the Event Log, sets the variable back to NULL and also sets a new variable as true. This last variable isn\u2019t needed, but I use it at the end of my script so I know if it completed running the script and an error message was captured. This goes with my custom Event ID of 1949 which is remediation of a compliance setting configuration item finished with some errors and may not be compliant.<\/p>\n
Here is what that code looks like.<\/p>\n