Forum Discussion

MattH010101's avatar
MattH010101
Copper Contributor
Nov 14, 2022

Can't write to custom logs

I am new to Intune.   I have created a log analytics workspace.   Using PowerShell I want to write to this location.    My web address is always wrong, regardless of what I use.   PowerShell gives me this error:

 

Invoke-WebRequest : The remote name could not be resolved:

 

I am trying to use this code that I found online.  

 

 

# Log analytics part
$CustomerId = "7aa60a6a-1234-4c67-5678-93d0f5f997c8"
$SharedKey = ''
$LogType = "TestReport"
$TimeStampField = ""
#***********************************************************************************************************

# Log analytics functions
Function Build-Signature ($customerId, $sharedKey, $date, $contentLength, $method, $contentType, $resource)
{
    $xHeaders = "x-ms-date:" + $date
    $stringToHash = $method + "`n" + $contentLength + "`n" + $contentType + "`n" + $xHeaders + "`n" + $resource

    $bytesToHash = [Text.Encoding]::UTF8.GetBytes($stringToHash)
    $keyBytes = [Convert]::FromBase64String($sharedKey)

    $sha256 = New-Object System.Security.Cryptography.HMACSHA256
    $sha256.Key = $keyBytes
    $calculatedHash = $sha256.ComputeHash($bytesToHash)
    $encodedHash = [Convert]::ToBase64String($calculatedHash)
    $authorization = 'SharedKey {0}:{1}' -f $customerId,$encodedHash
    return $authorization
}


# Create the function to create and post the request
Function Post-LogAnalyticsData($customerId, $sharedKey, $body, $logType)
{
    $method = "POST"
    $contentType = "application/json"
    $resource = "/api/logs"
    $rfc1123date = [DateTime]::UtcNow.ToString("r")
    $contentLength = $body.Length
    $signature = Build-Signature `
        -customerId $customerId `
        -sharedKey $sharedKey `
        -date $rfc1123date `
        -contentLength $contentLength `
        -method $method `
        -contentType $contentType `
        -resource $resource
     
     $uri = "https://" + $customerId  + ".MyAzureCompany.onmicrosoft.com" + $resource + "?api-version=2022-11-13"
     #     $uri = "https://" + $customerId  + ".MyAzureCompany.azure.com" + $resource + "?api-version=2022-11-13"
    ##############################################################################################################################
    $headers = @{
        "Authorization" = $signature;
        "Log-Type" = $logType;
        "x-ms-date" = $rfc1123date;
        "time-generated-field" = $TimeStampField;
    }

    $response = Invoke-WebRequest -Uri $uri -Method $method -ContentType $contentType -Headers $headers -Body $body -UseBasicParsing
    return $response.StatusCode

}

$Current_User_Profile = Get-ChildItem Registry::\HKEY_USERS | Where-Object { Test-Path "$($_.pspath)\Volatile Environment" } | ForEach-Object { (Get-ItemProperty "$($_.pspath)\Volatile Environment").USERPROFILE }
$Username = $Current_User_Profile.split("\")[2]		
$WMI_computersystem = gwmi win32_computersystem
$Manufacturer = $WMI_computersystem.manufacturer
If($Manufacturer -eq "Lenovo")
	{
		$Get_Current_Model = $WMI_computersystem.SystemFamily.split(" ")[1]
	}
Else
	{
		$Get_Current_Model = $WMI_computersystem.Model
	}
	
$Get_Current_Model_MTM = ($WMI_computersystem.Model).Substring(0,4)
$Get_Current_Model_FamilyName = $WMI_computersystem.SystemFamily.split(" ")[1]		
$BIOS_Version = (gwmi win32_bios).SMBIOSBIOSVersion

# Get Hard disk size info
$Win32_LogicalDisk = Get-ciminstance Win32_LogicalDisk | where {$_.DeviceID -eq "C:"}
$Disk_Full_Size = $Win32_LogicalDisk.size
$Disk_Free_Space = $Win32_LogicalDisk.Freespace

# Hard disk size percent
[int]$Free_DiskPercent = '{0:N0}' -f (($Disk_Free_Space / $Disk_Full_Size * 100),1)                                                          

# Hard disk size Log Anaytics format
$Disk_Size = ([System.Math]::Round(($Disk_Full_Size) / 1MB, 2))
$Free_DiskSpace = ([System.Math]::Round(($Disk_Free_Space) / 1MB, 2))

# Bitlocker status
$Bitlocker_status = (Get-BitLockerVolume -MountPoint "c:").protectionstatus
If($Bitlocker_status -eq "On")
	{
		$Bitlocker_status = "Enabled"
	}
Else
	{
		$Bitlocker_status = "Disabled"	
	}
	
# Create the object
$Properties = [Ordered] @{
    "Computer"     = $env:computername
    "UserName"             = $Username
    "Vendor"     = $Manufacturer	
    "DeviceModel"            = $Get_Current_Model
	"BIOSVer"      = $BIOS_Version
	"DiskSize"     = $Disk_Size	
	"FreeDisk"    = $Free_DiskSpace	
	"FreeDiskPercentage"  = $Free_DiskPercent		
	"BitlockerStatus" = $Bitlocker_status			
}
$DeviceInfo = New-Object -TypeName "PSObject" -Property $Properties

$DeviceInfoJson = $DeviceInfo | ConvertTo-Json

$params = @{
    CustomerId = $customerId
    SharedKey  = $sharedKey
    Body       = ([System.Text.Encoding]::UTF8.GetBytes($DeviceInfoJson))
    LogType    = $LogType 
}
$LogResponse = Post-LogAnalyticsData @params
	

 

 

 

No matter what I try for $CustomerID and URL it fails.  For CustomerID I have tried my subscription ID, my tenant ID and the Workspace ID and nothing works.   


Question:  Do I need to pre-create a custom log in Azure?  If so how?     It askes for a custom script and I don't know what to use.

Any help would be great.

 

 

 

 

1 Reply

  • You may use the Workspace ID of your Log Analytics workspace instead of the subscription ID or tenant ID. And the endpoint is always the Azure Monitor Data Collector API, not your tenant domain.