{"id":4618,"date":"2012-11-23T00:01:00","date_gmt":"2012-11-23T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2012\/11\/23\/exploring-the-powershell-psdiagnostics-module\/"},"modified":"2012-11-23T00:01:00","modified_gmt":"2012-11-23T00:01:00","slug":"exploring-the-powershell-psdiagnostics-module","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/exploring-the-powershell-psdiagnostics-module\/","title":{"rendered":"Exploring the PowerShell PSDiagnostics Module"},"content":{"rendered":"

Summary:<\/strong> Microsoft Scripting Guy, Ed Wilson, talks about exploring the Windows PowerShell PSDiagnostics module.<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. Let’s see, so today is November 23, 2012, which means that the Scripting Wife and I are in The Netherlands, and today, we are at the day-long Dutch PowerShell Group meeting<\/a>. We get to see Jeff Wouters (yesterday’s guest on the Hey, Scripting Guy! Blog) and Stefan Stranger, who is a Microsoft PFE, as well as dozens of other way-cool Windows PowerShell people.<\/p>\n

A quick look at the PSDiagnostics module<\/h2>\n

The PSDiagnostics module contains 10 functions that are useful when it comes to troubleshooting Windows PowerShell. To see the functions, use the Get-Command<\/strong> cmdlet, as shown here.<\/p>\n

PS C:\\> gcm -module psdiagnostics<\/p>\n

CommandType     Name                                               ModuleName<\/p>\n

———–     —-                                               ———-<\/p>\n

Function        Disable-PSTrace                                    PSDiagnostics<\/p>\n

Function        Disable-PSWSManCombinedTrace                       PSDiagnostics<\/p>\n

Function        Disable-WSManTrace                                 PSDiagnostics<\/p>\n

Function        Enable-PSTrace                                     PSDiagnostics<\/p>\n

Function        Enable-PSWSManCombinedTrace                        PSDiagnostics<\/p>\n

Function        Enable-WSManTrace                                  PSDiagnostics<\/p>\n

Function        Get-LogProperties                                  PSDiagnostics<\/p>\n

Function        Set-LogProperties                                  PSDiagnostics<\/p>\n

Function        Start-Trace                                        PSDiagnostics<\/p>\n

Function        Stop-Trace                                         PSDiagnostics<\/p>\n

Unfortunately, there is absolutely no Help whatsoever when it comes to the PSDiagnostics module. This means that we are pretty much left to guess what it does and how it might be useful. So, what do the PSDiagnostics functions do? Typically, the way to find out about a function is to use Get-Help<\/strong>. Here is the output from Get-Help<\/strong> for the Enable-PSTrace<\/strong> function.<\/p>\n

PS C:\\> help Enable-PSTrace<\/p>\n

NAME<\/p>\n

    Enable-PSTrace<\/p>\n

SYNTAX<\/p>\n

    Enable-PSTrace [-Force] [-AnalyticOnly]<\/p>\n

ALIASES<\/p>\n

    None<\/p>\n

REMARKS<\/p>\n

    None<\/p>\n

Hmm … that is not too enlightening. Well, one thing that is cool about Windows PowerShell functions is that there is a Function: PowerShell drive. Because, there is a Function: PowerShell drive, it means I can easily look at the content of a function to get a better idea of what it does. This is shown here.<\/p>\n

\"Image<\/a><\/p>\n

What does the Enable-PSTrace<\/strong> function do? Well, it calls the Set-LogProperties<\/strong> function and passes either the Windows PowerShell analytic logs or the analytic and the debug logs so they can be enabled. So, we need to look at the Set-LogProperties<\/strong> function and see what it does. This is shown here.<\/p>\n

\"Image<\/a><\/p>\n

The Set-LogProperties<\/strong> function is a bit longer, but one thing is clear—it calls Wevtutil and will enable the logs. From looking at it, it will also set backup, maximum log size, and other things as well.<\/p>\n

Note<\/strong>   I wrote a couple of Hey, Scripting Guy! Blog posts that talked about using Wevtutil last year. One post was Automatically Enable and Disable Trace Logs using PowerShell<\/a> and the other was Use PowerShell to Clear All Logs<\/a>. <\/em><\/p>\n

The Get-LogProperties<\/strong> function displays information about various diagnostic logs. It works as shown here.<\/p>\n

PS C:\\> Get-LogProperties Microsoft-Windows-PowerShell\/Admin<\/p>\n

Name       : Microsoft-Windows-PowerShell\/Admin<\/p>\n

Enabled    : True<\/p>\n

Type       : Admin<\/p>\n

Retention  : True<\/p>\n

AutoBackup : False<\/p>\n

MaxLogSize : 1048985600<\/p>\n

Unfortunately, it does not accept wild cards, and when receiving wild cards in a log name, it paints the screen red, as shown here.<\/p>\n

\"Image<\/a><\/p>\n

Of course, I can obtain the log names from the Event Viewer utility. All I need to do is to right-click the log, select Properties, and I can cut and paste the log name. The property page is shown here.<\/p>\n

\"Image<\/a><\/p>\n

But, dude, this is Windows PowerShell. And with Windows PowerShell, I do not need to supply cryptic, long, convoluted log path names because I can use the Get-WinEvent<\/strong> cmdlet to find my Windows PowerShell log names, and then I can pass the information to the Get-LogProperties<\/strong> function. This is shown here.<\/p>\n

PS C:\\> Get-WinEvent -ListLog *powershell* | Foreach {Get-LogProperties $_.logname}<\/p>\n

Name       : Windows PowerShell<\/p>\n

Enabled    : True<\/p>\n

Type       : Admin<\/p>\n

Retention  : False<\/p>\n

AutoBackup : False<\/p>\n

MaxLogSize : 15728640<\/p>\n

 <\/p>\n

Name       : Microsoft-Windows-PowerShell\/Admin<\/p>\n

Enabled    : True<\/p>\n

Type       : Admin<\/p>\n

Retention  : True<\/p>\n

AutoBackup : False<\/p>\n

MaxLogSize : 1048985600<\/p>\n

 <\/p>\n

Name       : Microsoft-Windows-PowerShell\/Operational<\/p>\n

Enabled    : True<\/p>\n

Type       : Operational<\/p>\n

Retention  : False<\/p>\n

AutoBackup : False<\/p>\n

MaxLogSize : 15728640<\/p>\n

If I want to look at only one log, I use the Where-Object<\/strong> to filter out the results. This is shown here.<\/p>\n

PS C:\\> Get-WinEvent -ListLog *powershell* | where logname -match admin | %{Get-LogPr<\/p>\n

operties $_.logname}<\/p>\n

Name       : Microsoft-Windows-PowerShell\/Admin<\/p>\n

Enabled    : True<\/p>\n

Type       : Admin<\/p>\n

Retention  : True<\/p>\n

AutoBackup : False<\/p>\n

MaxLogSize : 1048985600<\/p>\n

If you are wondering why I use the Get-LogProperties<\/strong> function instead of the Get-WinEvent<\/strong> cmdlet, here is the output from Get-Winevent<\/strong>.<\/p>\n

PS C:\\> Get-WinEvent -ListLog *powershell* | where logname -match admin<\/p>\n

LogMode   MaximumSizeInBytes RecordCount LogName<\/p>\n

——-   —————— ———– ——-<\/p>\n

Retain            1048985600           0 Microsoft-Windows-PowerShell\/Admin<\/p>\n

I see that both tell me the retention method and the maximum log size. But the Get-LogProperties<\/strong> function also tells me if the log is enabled, and if it has autobackup set.<\/p>\n

Join me tomorrow when I will talk some more about using the functions from the PSDiagnostics module.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about exploring the Windows PowerShell PSDiagnostics module. Microsoft Scripting Guy, Ed Wilson, is here. Let’s see, so today is November 23, 2012, which means that the Scripting Wife and I are in The Netherlands, and today, we are at the day-long Dutch PowerShell Group meeting. We get to […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[294,3,4,45],"class_list":["post-4618","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-debugging","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about exploring the Windows PowerShell PSDiagnostics module. Microsoft Scripting Guy, Ed Wilson, is here. Let’s see, so today is November 23, 2012, which means that the Scripting Wife and I are in The Netherlands, and today, we are at the day-long Dutch PowerShell Group meeting. We get to […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=4618"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4618\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=4618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=4618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=4618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}