public/Session/Mount-AuditLogs.ps1
|
using namespace System.Management.Automation using module '..\..\modules\Enums.psm1' using module '..\..\modules\Helper\DateTimeHelper.psm1' using module '..\..\modules\Session.psd1' function Mount-AuditLogs { [Alias('mnal')] param( [Parameter(Mandatory=$true)] # Specifies the operator from where this match should be downloaded. [OPERATOR] $operator, [Parameter(Mandatory=$true)] # Specifies the environment from where the match logs will be downloaded. [ENVIRONMENT] $environment, # Specifies the matchId from the Control Center [string] $matchId, # Defines the source log files to be downloaded. By default it will downloada # all configured logs for this Operator and Environment. [SOURCE[]] $source, # Referent message time taken as baseline from where the messages will be start analyzing. [string] $referentTime, # Timeframe in which the messages will be analyzed after the referent time. [string] $timeSpan, # run this cmdlet as background job [switch] $AsJob, # created new session and preserve previous [switch] $newSession ) #region Init $convert = $false $saveConverted = $false if ($newSession -or -not [Session]::getCurrent()){ $currentSession = [Session]::NewSession($operator, $environment, $convert, $saveConverted) Write-Host ('New session [{0}] created' -f $currentSession.sessionId) } else { if (-not [Session]::getCurrent().canImport()) { Write-Error 'Import terminated, jobs in progress.'; return } [Session]::getCurrent().Reset($operator, $environment, $convert, $saveConverted) $currentSession = [Session]::getCurrent() } $currentSession.setAnalyzedScope($source, $matchId, $referentTime, $timeSpan) if ($currentSession.config.queryType -eq [QUERY_TYPE]::datetimeInterval){ Write-Error "Search without matchId is not supported with the current downloaders." return } #endregion $currentSession.RegisterLogFiles($AsJob, $false) Write-Host '' Write-Host ('Total processing time: {0}' -f [DateTimeHelper]::FormatMilliseconds($currentSession.auditLogFile.getProcessingTime((Get-Date)).TotalMilliseconds)) if (-not $AsJob -or -not [Session]::getCurrent()) { [Session]::currentSessionId = $currentSession.sessionId } } |