lorentz
1112a06afe
- RMM Overshell (migration 077): admin page, dispatch UI, executor/worker, target resolver, script registry (AD/DHCP/DNS/event-log/services/software/network/loglift) - LogLift evidence pipeline (migration 078): upload webhook, B2 storage client, receiver/matcher, EventLogCollector PowerShell script - IT Glue audit + write-back (migrations 075, 076): asset-audit runner, ticket xrefs, applications/configurations browse pages + apply/revert/audit endpoints - Link-aware analyzer bundles (migration 073) + provider toggle (migration 074): link-discovery service, OpenRouter LLM provider, related-tickets/itglue-suggestion panels, analyze-bundle endpoint - Endpoint data model + device-link reconciliation (migrations 079, 080): conflicts admin page, reconciler service, resolve endpoints - Dashboard overhaul: integration-health service + alerts, overview/health endpoints - Permissions: add itglue + rmm scopes; middleware: public /api/rmm/loglift route Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
39 lines
1.4 KiB
TypeScript
39 lines
1.4 KiB
TypeScript
/**
|
|
* get-event-log-recent — last 50 errors+warnings from System and
|
|
* Application logs in the past 24h. Asset-self.
|
|
*
|
|
* Useful for retroactive diagnosis — "what was screaming on this server
|
|
* around the time the ticket came in?"
|
|
*/
|
|
|
|
import { type RmmScript, parseJsonOutput } from './types';
|
|
|
|
export const getEventLogRecent: RmmScript = {
|
|
id: 'get-event-log-recent',
|
|
name: 'Recent event-log errors',
|
|
description:
|
|
'Last 24h of Errors + Warnings from System + Application logs (capped at 50).',
|
|
target_type: 'asset_self',
|
|
expected_runtime_seconds: 25,
|
|
version: 1,
|
|
body: `
|
|
$ErrorActionPreference = 'Stop'
|
|
$since = (Get-Date).AddHours(-24)
|
|
$entries = Get-WinEvent -FilterHashtable @{
|
|
LogName = @('System','Application')
|
|
Level = @(1,2,3) # 1=Critical, 2=Error, 3=Warning
|
|
StartTime = $since
|
|
} -MaxEvents 50 -ErrorAction SilentlyContinue |
|
|
Select-Object @{n='time';e={$_.TimeCreated.ToUniversalTime().ToString("o")}},
|
|
LogName, Id, LevelDisplayName, ProviderName,
|
|
@{n='message';e={ ($_.Message -replace '\\s+',' ').Trim().Substring(0, [Math]::Min(500, $_.Message.Length)) }}
|
|
@{
|
|
hostname = $env:COMPUTERNAME
|
|
captured_at_utc = (Get-Date).ToUniversalTime().ToString("o")
|
|
since_utc = $since.ToUniversalTime().ToString("o")
|
|
count = ($entries | Measure-Object).Count
|
|
entries = $entries
|
|
} | ConvertTo-Json -Depth 4 -Compress
|
|
`.trim(),
|
|
parseOutput: (stdout) => parseJsonOutput(stdout),
|
|
};
|