Forum Discussion
Can't write to custom logs
I am new to Intune. I have created a log analytics workspace. Using PowerShell I want to write to this location. My web address is always wrong, regardless of what I use. PowerShell gives me this error:
Invoke-WebRequest : The remote name could not be resolved:
I am trying to use this code that I found online.
# Log analytics part
$CustomerId = "7aa60a6a-1234-4c67-5678-93d0f5f997c8"
$SharedKey = ''
$LogType = "TestReport"
$TimeStampField = ""
#***********************************************************************************************************
# Log analytics functions
Function Build-Signature ($customerId, $sharedKey, $date, $contentLength, $method, $contentType, $resource)
{
$xHeaders = "x-ms-date:" + $date
$stringToHash = $method + "`n" + $contentLength + "`n" + $contentType + "`n" + $xHeaders + "`n" + $resource
$bytesToHash = [Text.Encoding]::UTF8.GetBytes($stringToHash)
$keyBytes = [Convert]::FromBase64String($sharedKey)
$sha256 = New-Object System.Security.Cryptography.HMACSHA256
$sha256.Key = $keyBytes
$calculatedHash = $sha256.ComputeHash($bytesToHash)
$encodedHash = [Convert]::ToBase64String($calculatedHash)
$authorization = 'SharedKey {0}:{1}' -f $customerId,$encodedHash
return $authorization
}
# Create the function to create and post the request
Function Post-LogAnalyticsData($customerId, $sharedKey, $body, $logType)
{
$method = "POST"
$contentType = "application/json"
$resource = "/api/logs"
$rfc1123date = [DateTime]::UtcNow.ToString("r")
$contentLength = $body.Length
$signature = Build-Signature `
-customerId $customerId `
-sharedKey $sharedKey `
-date $rfc1123date `
-contentLength $contentLength `
-method $method `
-contentType $contentType `
-resource $resource
$uri = "https://" + $customerId + ".MyAzureCompany.onmicrosoft.com" + $resource + "?api-version=2022-11-13"
# $uri = "https://" + $customerId + ".MyAzureCompany.azure.com" + $resource + "?api-version=2022-11-13"
##############################################################################################################################
$headers = @{
"Authorization" = $signature;
"Log-Type" = $logType;
"x-ms-date" = $rfc1123date;
"time-generated-field" = $TimeStampField;
}
$response = Invoke-WebRequest -Uri $uri -Method $method -ContentType $contentType -Headers $headers -Body $body -UseBasicParsing
return $response.StatusCode
}
$Current_User_Profile = Get-ChildItem Registry::\HKEY_USERS | Where-Object { Test-Path "$($_.pspath)\Volatile Environment" } | ForEach-Object { (Get-ItemProperty "$($_.pspath)\Volatile Environment").USERPROFILE }
$Username = $Current_User_Profile.split("\")[2]
$WMI_computersystem = gwmi win32_computersystem
$Manufacturer = $WMI_computersystem.manufacturer
If($Manufacturer -eq "Lenovo")
{
$Get_Current_Model = $WMI_computersystem.SystemFamily.split(" ")[1]
}
Else
{
$Get_Current_Model = $WMI_computersystem.Model
}
$Get_Current_Model_MTM = ($WMI_computersystem.Model).Substring(0,4)
$Get_Current_Model_FamilyName = $WMI_computersystem.SystemFamily.split(" ")[1]
$BIOS_Version = (gwmi win32_bios).SMBIOSBIOSVersion
# Get Hard disk size info
$Win32_LogicalDisk = Get-ciminstance Win32_LogicalDisk | where {$_.DeviceID -eq "C:"}
$Disk_Full_Size = $Win32_LogicalDisk.size
$Disk_Free_Space = $Win32_LogicalDisk.Freespace
# Hard disk size percent
[int]$Free_DiskPercent = '{0:N0}' -f (($Disk_Free_Space / $Disk_Full_Size * 100),1)
# Hard disk size Log Anaytics format
$Disk_Size = ([System.Math]::Round(($Disk_Full_Size) / 1MB, 2))
$Free_DiskSpace = ([System.Math]::Round(($Disk_Free_Space) / 1MB, 2))
# Bitlocker status
$Bitlocker_status = (Get-BitLockerVolume -MountPoint "c:").protectionstatus
If($Bitlocker_status -eq "On")
{
$Bitlocker_status = "Enabled"
}
Else
{
$Bitlocker_status = "Disabled"
}
# Create the object
$Properties = [Ordered] @{
"Computer" = $env:computername
"UserName" = $Username
"Vendor" = $Manufacturer
"DeviceModel" = $Get_Current_Model
"BIOSVer" = $BIOS_Version
"DiskSize" = $Disk_Size
"FreeDisk" = $Free_DiskSpace
"FreeDiskPercentage" = $Free_DiskPercent
"BitlockerStatus" = $Bitlocker_status
}
$DeviceInfo = New-Object -TypeName "PSObject" -Property $Properties
$DeviceInfoJson = $DeviceInfo | ConvertTo-Json
$params = @{
CustomerId = $customerId
SharedKey = $sharedKey
Body = ([System.Text.Encoding]::UTF8.GetBytes($DeviceInfoJson))
LogType = $LogType
}
$LogResponse = Post-LogAnalyticsData @params
No matter what I try for $CustomerID and URL it fails. For CustomerID I have tried my subscription ID, my tenant ID and the Workspace ID and nothing works.
Question: Do I need to pre-create a custom log in Azure? If so how? It askes for a custom script and I don't know what to use.
Any help would be great.
2 Replies
Hi MattH010101,
Your script is failing because the URI is wrong. For Azure Log Analytics, you never use your tenant domain, subscription ID, or onmicrosoft.com domain. I guess you can use:https://<WorkspaceID>.ods.opinsights.azure.com/api/logs?api-version=2016-04-01And CustomerId = Workspace ID, SharedKey = Primary Key from the Log Analytics workspace.
Workspace ID → CustomerId:
Azure Portal → Log Analytics Workspace → Agents → Workspace ID
Primary Key → Shared Key:Same page → Private Key
You may use the Workspace ID of your Log Analytics workspace instead of the subscription ID or tenant ID. And the endpoint is always the Azure Monitor Data Collector API, not your tenant domain.