Blog post - Use PowerShell for reading Intune Management Extension logs

Trusted Contributor

Wrote a blog post on how to read the Intune logs using PowerShell, https://powershellisfun.com/2022/09/12/read-intunemanagementextension-logs-using-powershell/, this is the script for it, and yes... I think I need to learn Regex :) 

 

 

 

#Function for reading the Intune Management Extension log
function Get-IntuneLogContent {
    param (
        [Parameter(Mandatory = $true)][string]$Filepath
    )
    
    if (-not (Test-Path -Path $Filepath -ErrorAction SilentlyContinue)) {
        Write-Warning ("Error accessing {0}, check permissions" -f $false)
        return
    }

    #Start reading logfile
    $LogTotal = foreach ($line in Get-Content -Path $Filepath) {
        #Get Time-stamp
        try {
            $time = (Select-String 'time=(.*)' -InputObject $line).Matches.groups[0].value.split('"')[1]
        }
        catch {
            $time = 'n.a.'
        }

        #Get date
        try {
            $date = (Select-String 'date=(.*)' -InputObject $line).Matches.groups[0].value.split('"')[1]
        }
        catch {
            $date = 'n.a.'
        }
            
        #Set datetime to n.a. if not found
        if ($date -ne 'n.a.' -and $time -ne 'n.a.') {
            $datetime = "$($date) $($time)"
        }
        else {
            $datetime = 'n.a.' 
        }

        #Get the component value
        try {
            $component = (Select-String 'component=(.*)' -InputObject $line).matches.groups[0].value.split('"')[1]
        }
        catch {
            $component = 'n.a'
        }

        #If line is part of a muli-line, display it or else split it to message text
        If ($line.StartsWith('<![LOG') -ne $true -or ($line.Split('!><')[3]).length -eq 0 ) {
            $text = $line
        }
        else {
            $text = $line.Split('!><')[3]
        }

        [PSCustomObject]@{
            'Log Text'  = $text
            'Date/Time' = $datetime
            Component   = $component
        }
    } 

    #Return found items in a GridView
    $LogTotal | Out-GridView -Title $Filepath
}
function Show-IntuneManagementExtensionLog {
    [CmdletBinding(DefaultParameterSetName = "Default")]
    param (      
        [parameter(ParameterSetName = "Indiviudal")][switch]$AgentExecutor,
        [parameter(ParameterSetName = "All")][switch]$All,
        [parameter(ParameterSetName = "Indiviudal")][switch]$ClientHealth,
        [parameter(ParameterSetName = "Indiviudal")][switch]$IntuneManagementExtension,
        [parameter(ParameterSetName = "Indiviudal")][switch]$Sensor
    )

    #Warn if not parameter specified
    if (-not ($AgentExecutor.IsPresent -or $All.IsPresent -or $ClientHealth.IsPresent -or $IntuneManagementExtension.IsPresent -or $Sensor.IsPresent)) {
        Write-Warning ("No parameter specified, please use the AgentExecutor, All, ClientHealth, IntuneManagementExtension or Sensor parameter to display the log(s)...")
        return
    }

    #If all parameter is set, set all switches to True
    if ($all) {
        Write-Host ("Processing all logs...") -ForegroundColor Green
        $AgentExecutor = $true
        $ClientHealth = $true
        $IntuneManagementExtension = $true
        $Sensor = $true
    }

    #Invoke the Get-IntuneLogContent with the path of the log
    if ($AgentExecutor) {
        Write-Host ("Processing AgentExecutor log") -ForegroundColor Green
        Get-IntuneLogContent -FilePath C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.log
    }

    if ($ClientHealth) {
        Write-Host ("Processing ClientHealth log") -ForegroundColor Green
        Get-IntuneLogContent -FilePath C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\ClientHealth.log
    }

    if ($IntuneManagementExtension) {
        Write-Host ("Processing IntuneManagementExtension log") -ForegroundColor Green
        Get-IntuneLogContent -FilePath C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
    }

    if ($Sensor) {
        Write-Host ("Processing Sensor log") -ForegroundColor Green
        Get-IntuneLogContent -FilePath C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Sensor.log
    }
}

 

 

2 Replies
Great script! CMTrace for Intune!
Brilliant, adding to my arsenal.