Forensics script update and adding startup-probe

Azure-ARM/forensics_log_pull.ps1

@@ -20,47 +20,51 @@ if ($result -eq 'READ_ONLY') {
 # Rest of the script
 Write-Host "Executing the rest of the script..."
 
-New-Item -Path "C:\Fileshare\" -Name "alllogs" -ItemType "directory" -ErrorAction Ignore
-# Pull Product Services, IIS, Event Viewer logs as well as Netstat and TCPConnection logs
-$DT = get-date -UFormat "%m-%d-%Y-%H%M%S-UTC-%a"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Config"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Gateway"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Attachments"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Auth"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Governance"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Monolith"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Workflows"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Web"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Webportal"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Monitor"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Data"
-mkdir "$env:TEMP\all-Logs\$DT\ProfiseeLogs\ConnEx"
-mkdir "$env:TEMP\all-Logs\$DT\EventViewerLogs"
-mkdir "$env:TEMP\all-Logs\$DT\TCPLogs"
-mkdir "$env:TEMP\all-Logs\$DT\IISLogs"
-robocopy "$env:SystemRoot\System32\winevt\Logs\" "$env:TEMP\all-Logs\$DT\EventViewerLogs" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\configuration\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Config" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\gateway\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Gateway" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\services\attachments\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Attachments" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\services\auth\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Auth" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\services\governance\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Governance" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\services\monolith\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Monolith" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\services\workflows\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Workflows" /E /COPYALL /DCOPY:T
-robocopy "C:\Profisee\Services\Monitor\LogFiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Monitor" /E /COPYALL /DCOPY:T
-robocopy "C:\Profisee\Services\Data\LogFiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Data" /E /COPYALL /DCOPY:T
-robocopy "C:\Profisee\Services\ConnEx\LogFiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\ConnEx" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\web\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Web" /E /COPYALL /DCOPY:T
-robocopy "c:\profisee\webportal\logfiles" "$env:TEMP\all-Logs\$DT\ProfiseeLogs\Webportal" /E /COPYALL /DCOPY:T
-robocopy "c:\inetpub\logs\LogFiles\W3SVC1" "$env:TEMP\all-Logs\$DT\IISLogs" /E /COPYALL /DCOPY:T
-netstat -anobq > $env:TEMP\all-Logs\$DT\TCPLogs\netstat.txt
-Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending | out-file $env:TEMP\all-Logs\$DT\TCPLogs\TCPconnections.txt
+# Get hostname of pod to know which pod the logs are from
+$hostname = hostname
 
 # Make Webapp name w/ Capital letter
 $WebAppName = $env:ProfiseeWebAppName.substring(0, 1).ToUpper() + $env:ProfiseeWebAppName.Substring(1)
 
+New-Item -Path "C:\Fileshare\" -Name "alllogs" -ItemType "directory" -ErrorAction Ignore
+# Pull Product Services, IIS, Event Viewer logs as well as Netstat and TCPConnection logs
+$DT = get-date -UFormat "%m-%d-%Y-%H%M%S-UTC-%a"
+$logsFolder = "$WebAppName-$hostname-$DT"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Config"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Gateway"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Attachments"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Auth"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Governance"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Monolith"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Workflows"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Web"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Webportal"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Monitor"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Data"
+mkdir "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\ConnEx"
+mkdir "$env:TEMP\all-Logs\$logsFolder\EventViewerLogs"
+mkdir "$env:TEMP\all-Logs\$logsFolder\TCPLogs"
+mkdir "$env:TEMP\all-Logs\$logsFolder\IISLogs"
+robocopy "$env:SystemRoot\System32\winevt\Logs\" "$env:TEMP\all-Logs\$logsFolder\EventViewerLogs" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\configuration\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Config" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\gateway\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Gateway" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\services\attachments\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Attachments" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\services\auth\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Auth" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\services\governance\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Governance" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\services\monolith\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Monolith" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\services\workflows\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Workflows" /E /COPYALL /DCOPY:T
+robocopy "C:\Profisee\Services\Monitor\LogFiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Monitor" /E /COPYALL /DCOPY:T
+robocopy "C:\Profisee\Services\Data\LogFiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Data" /E /COPYALL /DCOPY:T
+robocopy "C:\Profisee\Services\ConnEx\LogFiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\ConnEx" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\web\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Web" /E /COPYALL /DCOPY:T
+robocopy "c:\profisee\webportal\logfiles" "$env:TEMP\all-Logs\$logsFolder\ProfiseeLogs\Webportal" /E /COPYALL /DCOPY:T
+robocopy "c:\inetpub\logs\LogFiles\W3SVC1" "$env:TEMP\all-Logs\$logsFolder\IISLogs" /E /COPYALL /DCOPY:T
+netstat -anobq > $env:TEMP\all-Logs\$logsFolder\TCPLogs\netstat.txt
+Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}}, Group | Sort Count -Descending | out-file $env:TEMP\all-Logs\$logsFolder\TCPLogs\TCPconnections.txt
+
 # Compress and copy to fileshare
-compress-archive -Path "$env:TEMP\all-Logs\$DT\" -DestinationPath "$env:TEMP\$WebAppName-All-Logs-$DT.zip"
-copy "$env:TEMP\$WebAppName-All-Logs-$DT.zip" "C:\fileshare\alllogs"
+compress-archive -Path "$env:TEMP\all-Logs\$logsFolder\" -DestinationPath "$env:TEMP\$WebAppName-$hostname-All-Logs-$DT.zip"
+copy "$env:TEMP\$WebAppName-$hostname-All-Logs-$DT.zip" "C:\fileshare\alllogs\"
 
 # Delete older zipped log files more than 30 days
 Get-ChildItem -Path C:\Fileshare\* -Include *all-logs-*.zip -Recurse | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)} | Remove-Item

Azure-ARM/startup-probe.ps1

@@ -0,0 +1,34 @@
+# Start transcript for logging
+$hostname = hostname
+$probeLog = "C:\fileshare\startup-probe-$hostname.log"
+Start-Transcript -Path $probeLog
+
+$logFilePath = "C:\Profisee\Configuration\LogFiles\SystemLog.log" 
+$successString = "User Manager\\ContainerAdministrator Profisee platform configuration finished." 
+$checkIntervalSeconds = 5
+
+
+# Main loop
+while ($true) {
+    Write-Host "Parsing log file for success and failure strings..."
+    if (Test-Path $logFilePath) {
+        # Get the entries for success and failure strings
+        $successEntries = Get-Content -Path $logFilePath | Select-String -Pattern $successString
+
+        # Get the counts of the entries
+        $successCount = $successEntries.Count
+
+        # 1. If success count > 0, break successfully.
+        if ($successCount -gt 0) {
+            Write-Host "Configuration finished. There may be errors."
+            break
+        }
+    } else {
+        Write-Host "Log file not found."
+    }
+
+    # Sleep before checking again
+    Start-Sleep -Seconds $checkIntervalSeconds
+}
+
+Stop-Transcript