Write info to Log Analytics

PowerShell Help
1

I have this code:


# Define your Log Analytics Workspace ID and Key
$WorkspaceID = "d929aff4-6e8a-47f8-94a5-a8466376b044"
$WorkspaceKey = "oDmfRIXSTV7irLLTloKOQjBYwiSNE+rG5i/j7SCEEvcvrD/2BH0P899TOCl6KZfkXO5/r3oPIZ1RlzMWddX5EQ=="

# Define the registry key path and value names
$RegistryPath = "HKLM:\SOFTWARE\DELL\Docks"
$RegistryValueNames = @("Model", "Firmware", "AssetTag")

# Get the registry values
$RegistryValues = @{}
ForEach ($ValueName in $RegistryValueNames) {
    $RegistryValue = Get-ItemProperty -Path $RegistryPath | Select-Object -ExpandProperty $ValueName
    $RegistryValues[$ValueName] = $RegistryValue
}

# Create a custom log entry
$LogEntry = @{
    "RegistryKey" = $RegistryPath
    "Model" = $RegistryValues["Model"]
    "Firmware" = $RegistryValues["Firmware"]
    "AssetTag" = $RegistryValues["AssetTag"]
    $Timestamp = [System.DateTime]::UtcNow.ToString("r")
}

# Convert the log entry to JSON
$JsonLogEntry = $LogEntry | ConvertTo-Json

# Create a timestamp
$Timestamp = Get-Date -Format "yyyy-MM-ddTHH:mm:ss"

# Create a signature for authentication
$Signature = [System.Text.Encoding]::UTF8.GetBytes("POST`n$jsonLogEntry`n$Timestamp")
$HMACSHA256 = New-Object System.Security.Cryptography.HMACSHA256
$HMACSHA256.Key = [System.Convert]::FromBase64String($WorkspaceKey)
$Hash = $HMACSHA256.ComputeHash($Signature)
$Signature = [System.Convert]::ToBase64String($Hash)

# Create headers for the request
$Headers = @{
    "Log-Type" = "CustomRegistryData"  # Define your Log Type
    "x-ms-Date" = $Timestamp
    "Authorization" = "SharedKey $WorkspaceID $Signature"
}

# Send data to Azure Log Analytics
$Uri = "https://$WorkspaceID.ods.opinsights.azure.com/api/logs?api-version=2016-04-01"

Invoke-RestMethod -Uri $Uri -Method Post -Headers $Headers -Body $JsonLogEntry -UseBasicParsing

Write-Host "Registry information sent to Azure Log Analytics."

when I run it I get the following error:

Invoke-RestMethod : {"Error":"InvalidAuthorization","Message":"An invalid date 
format used in the x-ms-date header."}
At C:\Users\Test\OneDrive\Scripts\PowerShell\DELL\SVEN\My Log 
Analytics\testing.ps1:53 char:1
+ Invoke-RestMethod -Uri $Uri -Method Post -Headers $Headers -Body $Jso ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:Htt 
   pWebRequest) [Invoke-RestMethod], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe 
   ll.Commands.InvokeRestMethodCommand

also, nothing gets written up to Intune. Any help would be great. Also, if anyone has a good doc or video that clearly shows how to get information written up to Intune / Log Analytics using PowerShell that would be awesome.

2

It looks like the date format should be in RFC 1123 format, try:

$timeStamp = Get-Date -Format "ddd, dd MMM yyyy HH':'mm':'ss 'GMT'"
3

Thank you that time stamp worked. But now I get a new error.

Invoke-RestMethod : The remote name could not be resolved: 
'd929aff4-6e8a-478f-94a5-a8415376b934.ods.opinsights.azure.com'
At line:53 char:1

I have no proxy setup in my environment and I’ve confirmed that I have the correct WorkspaceID (shown above)

Thank you.

4

Don’t believe it would cause your error, but the above should be:

"Authorization" = "SharedKey $WorkspaceID:$Signature"

Might be worth fixing that and retesting it just to rule it out.

5

the only thing that works is if I use a Colon with no space before or after. But then I get the same remote name could not be resolved :slight_smile:

6

Relevant?