Writting Windows Event Log

[Shane-MTB]

Thank you for creating the WAU! Has saved me a lot of time trying to create something myself.

I'm currently looking for a way to monitor for failed application updates with our RMM tool, ConnectWise Automate. My idea is to have the script write to the Windows Event Logs based on failures and successes.
After going through the scripts, I had an idea of adding some event log writing code to the Update-Apps.ps1 script.
Though you might want to integrate something like this in your release?

Here is my current versions of this that seems to be doing the trick:

#Function to update an App

Function Update-App ($app) {

    #Create New Eventlog
    $Source = "Winget-AutoUpdate"
    New-EventLog –LogName Application –Source “$Source”

    #Get App Info
    $ReleaseNoteURL = Get-AppInfo $app.Id
    if ($ReleaseNoteURL) {
        $Button1Text = $NotifLocale.local.outputs.output[10].message
    }

    #Send available update notification
    $AvailableUpdateMessage = "Updating $($app.Name) from $($app.Version) to $($app.AvailableVersion)..."
    Write-ToLog "$AvailableUpdateMessage" "Cyan"
    Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$AvailableUpdateMessage"
    $Title = $NotifLocale.local.outputs.output[2].title -f $($app.Name)
    $Message = $NotifLocale.local.outputs.output[2].message -f $($app.Version), $($app.AvailableVersion)
    $MessageType = "info"
    $Balise = $($app.Name)
    Start-NotifTask -Title $Title -Message $Message -MessageType $MessageType -Balise $Balise -Button1Action $ReleaseNoteURL -Button1Text $Button1Text

    #Check if mods exist for preinstall/override/upgrade/install/installed/notinstalled
    $ModsPreInstall, $ModsOverride, $ModsUpgrade, $ModsInstall, $ModsInstalled, $ModsNotInstalled = Test-Mods $($app.Id)

    #Winget upgrade
    Write-ToLog "##########   WINGET UPGRADE PROCESS STARTS FOR APPLICATION ID '$($App.Id)'   ##########" "Gray"

    #If PreInstall script exist
    if ($ModsPreInstall) {
        $ModsPreInstallMessage = "Modifications for $($app.Id) before upgrade are being applied..." 
        Write-ToLog "$ModsPreInstallMessage" "Yellow"
        Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsPreInstallMessage"
        & "$ModsPreInstall"
    }

    #Run Winget Upgrade command
    if ($ModsOverride) {
        $ModsOverrideMessage = "-> Running (overriding default): Winget upgrade --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget --override $ModsOverride"
        Write-ToLog "$ModsOverrideMessage"
        Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsOverrideMessage"
        & $Winget upgrade --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget --override $ModsOverride | Where-Object { $_ -notlike "   *" } | Tee-Object -file $LogFile -Append
    }
    else {
        $ModsOverrideMessage = "-> Running: Winget upgrade --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget -h"
        Write-ToLog "$ModsOverrideMessage"
        Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsOverrideMessage"
        & $Winget upgrade --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget -h | Where-Object { $_ -notlike "   *" } | Tee-Object -file $LogFile -Append
    }

    if ($ModsUpgrade) {
        $ModsUpgradeMessage = "Modifications for $($app.Id) during upgrade are being applied..." 
        Write-ToLog "$ModsUpgradeMessage" "Yellow"
        Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsUpgradeMessage"
        & "$ModsUpgrade"
    }

    #Check if application updated properly
    $ConfirmInstall = Confirm-Installation $($app.Id) $($app.AvailableVersion)

    if ($ConfirmInstall -ne $true) {
        #Upgrade failed!
        #Test for a Pending Reboot (Component Based Servicing/WindowsUpdate/CCM_ClientUtilities)
        $PendingReboot = Test-PendingReboot
        if ($PendingReboot -eq $true) {
            $PendingRebootMessage =  "-> A Pending Reboot lingers and probably prohibited $($app.Name) from upgrading...`n-> ...an install for $($app.Name) is NOT executed!" 
            Write-ToLog "$PendingRebootMessage" "Red"
            Write-EventLog –LogName Application –Source “$Source” –EntryType Warning –EventID 10002 -Message "$PendingRebootMessage"
            break
        }

        #If app failed to upgrade, run Install command (2 tries max - some apps get uninstalled after single "Install" command.)
        $retry = 1
        While (($ConfirmInstall -eq $false) -and ($retry -le 2)) {

            Write-ToLog "-> An upgrade for $($app.Name) failed, now trying an install instead... ($retry/2)" "Yellow"

            if ($ModsOverride) {
                $ModsOverrideMessage = "-> Running (overriding default): Winget install --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget --force --override $ModsOverride"
                Write-ToLog "$ModsOverrideMessage"
                Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsOverrideMessage"
                & $Winget install --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget --force --override $ModsOverride | Where-Object { $_ -notlike "   *" } | Tee-Object -file $LogFile -Append
            }
            else {
                $ModsOverrideMessage = "-> Running: Winget install --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget -h --force"
                Write-ToLog "$ModsOverrideMessage"
                Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsOverrideMessage"
                & $Winget install --id $($app.Id) -e --accept-package-agreements --accept-source-agreements -s winget -h --force | Where-Object { $_ -notlike "   *" } | Tee-Object -file $LogFile -Append
            }

            if ($ModsInstall) {
                $ModsInstallMessage = "Modifications for $($app.Id) during install are being applied..." 
                Write-ToLog "$ModsInstallMessage" "Yellow"
                Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsInstallMessage"
                & "$ModsInstall"
            }

            #Check if application installed properly
            $ConfirmInstall = Confirm-Installation $($app.Id) $($app.AvailableVersion)
            $retry += 1
        }
    }

    switch ($ConfirmInstall) {
        # Upgrade/install was successful
        $true {
            if ($ModsInstalled) {
                $ModsInstalledMessage = "Modifications for $($app.Id) after upgrade/install are being applied..."
                Write-ToLog "$ModsInstalledMessage" "Yellow"
                Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ModsInstalled"
                
                & "$ModsInstalled"
            }
        }
        # Upgrade/install was unsuccessful
        $false {
            if ($ModsNotInstalled) {
                $ModsNotInstalledMessage = "Modifications for $($app.Id) after a failed upgrade/install are being applied..." 
                Write-ToLog "$ModsNotInstalledMessage" "Yellow"
                Write-EventLog –LogName Application –Source “$Source” –EntryType Error –EventID 10003 -Message "$ModsNotInstalled"
                & "$ModsNotInstalled"
            }
        }
    }

    Write-ToLog "##########   WINGET UPGRADE PROCESS FINISHED FOR APPLICATION ID '$($App.Id)'   ##########" "Gray"

    #Notify installation
    if ($ConfirmInstall -eq $true) {

        #Send success updated app notification
        $ConfirmInstallMessage = "$($app.Name) updated to $($app.AvailableVersion) !" 
        Write-ToLog "$ConfirmInstallMessage" "Green"
        Write-EventLog –LogName Application –Source “$Source” –EntryType Information –EventID 10001 -Message "$ConfirmInstallMessage"

        #Send Notif
        $Title = $NotifLocale.local.outputs.output[3].title -f $($app.Name)
        $Message = $NotifLocale.local.outputs.output[3].message -f $($app.AvailableVersion)
        $MessageType = "success"
        $Balise = $($app.Name)
        Start-NotifTask -Title $Title -Message $Message -MessageType $MessageType -Balise $Balise -Button1Action $ReleaseNoteURL -Button1Text $Button1Text

        $Script:InstallOK += 1

    }
    else {

        #Send failed updated app notification
        $failedUpdateMessage = "$($app.Name) update failed." 
        Write-ToLog "$failedUpdateMessage" "Red"
        Write-EventLog –LogName Application –Source “$Source” –EntryType Error –EventID 10003 -Message "$failedUpdateMessage"

        #Send Notif
        $Title = $NotifLocale.local.outputs.output[4].title -f $($app.Name)
        $Message = $NotifLocale.local.outputs.output[4].message
        $MessageType = "error"
        $Balise = $($app.Name)
        Start-NotifTask -Title $Title -Message $Message -MessageType $MessageType -Balise $Balise -Button1Action $ReleaseNoteURL -Button1Text $Button1Text

    }

}

[AndrewDemski-ad-gmail-com]

Hey Shane,
thanks for sharing the idea.

Words of caution, please avoid copy+pasting PowerShell code to other text editors, double quotes get messed up.
Example from your own pasteblock : “$Source”

As for the storage medium for update successes, I would suggest something more resilient to overwriting.
Oldest event log entries will be dropped, once size of particular eventlog file exceeded max capacity. If enough time will be spend between error/failure and the remediation action, you may lose the data/trace/log.

If we only focus on failed action (f.ex. to start thinking if we should retry or manual intervention will be required), the the best pace would be a HKLM registry Key with subkeys names after App.ID with reg value called "state" or something similar.

Then you would only need to do is querying the registry key, doing the "foreach-object" check of reg values.
That way you will get a nice hashtable with keys being consistent with App.ID, and Values containing your custom object with all properties you would ever need.

Just thinking aloud..

[Shane-MTB]

Thanks for your input Andrew.

Will keep that copy+pasting code in mind.

Appreciate that the event log data would be lost over time. In my particular use case, all I need is something for the RMM agent to spot a failure, and create a ticket in our system so it can be addressed. Once it's got a ticket it will have long term retention.

Am curious about your idea of using reg keys. Hadn't thought of that. Will ponder that.

Thanks!

[Romanitho]

The reg thing can be interesting 😇