IISRFBaseline-allowDoubleEscaping.psm1
|
function Get-RFLpQueryAllowDoubleEscaping { <# .SYNOPSIS Creates Logparser query for RF allowDoubleEscaping baseline using IIS logs. .EXAMPLE Get-RFLpQueryAllowDoubleEscaping -Sitename W3SVC1 -LogDir D:\inetpub\Logs\ex*.log -OutputDir D:\WorkingFolder\ #> [CmdletBinding()] param( [parameter(Mandatory=$true)] [System.String] # IIS Sitename of target website. $Sitename , [parameter(Mandatory=$true)] [System.String] # IIS log directory. $LogDir , [parameter(Mandatory=$true)] [System.String] # Outut directory for writing files. $OutputDir ) $ResultFile = Join-Path -Path $OutputDir -ChildPath 'lp_results_allowDoubleEscaping.csv' return @" --lp_query_allowDoubleEscaping.sql-- SELECT date, time, c-ip, cs-host, sc-status, sc-substatus, cs-uri-stem, URLUNESCAPE(cs-uri-stem) AS Normalized1, URLUNESCAPE(Normalized1) AS Normalized2, cs(User-Agent) INTO $ResultFile FROM $LogDir WHERE s-sitename LIKE `'$Sitename`' AND (Normalized1<>Normalized2 OR (sc-status=404 AND sc-substatus=11)) AND NOT ((sc-status=400 AND sc-substatus=0) OR (sc-status=404 AND sc-substatus=0)) --lp_query_allowDoubleEscaping.sql-- "@ } # End function Get-RFLpQueryAllowDoubleEscaping function New-RFLpFileAllowDoubleEscaping { <# .SYNOPSIS Creates Logparser file for RF allowDoubleEscaping baseline using IIS logs. .EXAMPLE New-RFLpFileAllowDoubleEscaping -Sitename W3SVC1 -LogDir D:\inetpub\Logs\ex*.log -OutputDir D:\WorkingFolder\ #> [CmdletBinding()] param( [parameter(Mandatory=$true)] [System.String] # IIS Sitename of target website. $Sitename , [parameter(Mandatory=$true)] [System.String] # IIS log directory. $LogDir , [parameter(Mandatory=$true)] [System.String] # Outut directory for writing files. $OutputDir ) $FileLocation = Join-Path -Path $OutputDir -ChildPath 'lp_query_allowDoubleEscaping.sql' Get-RFLpQueryAllowDoubleEscaping -Sitename $Sitename -LogDir $LogDir -OutputDir $OutputDir | Out-File -LiteralPath $FileLocation -Force -Encoding ascii return $FileLocation } # End function New-RFLpFileAllowDoubleEscaping Export-ModuleMember -Function 'Get-RFLpQueryAllowDoubleEscaping','New-RFLpFileAllowDoubleEscaping' |