Repository navigation
fix(logs): read the kind of a timeline from a rolled log file - #35
Conversation
Get-IntuneAgentTimeline reported Kind as Unknown for a policy or app whose lines all sat in a rolled log file. The agent rolls HealthScripts.log over to HealthScripts-20260925-101500.log, and the kind lookup stripped one -digits suffix from the log name, which removed the time and left a name the log table does not have. Both parts come off now. Reproduced on the lab device: three remediations read from its rolled HealthScripts log alone all came back Unknown. The parser comments quoted a 22 MB log where the 0.28.0 changelog measured 15 MB for the same 80,000 entries; they carry the measured figures. The README log blocks show the Agent abbreviation in the Log column and the list form of the diagnostic result, as the commands print them.
fadwen
left a comment
fadwen
left a comment
There was a problem hiding this comment.
Notes on the lines whose reason the diff does not show.
| $logsSeen = @($steps | ForEach-Object { $_.Log -replace '-\d+$', '' } | Sort-Object -Unique) | ||
| # A rolled file is HealthScripts-20260925-101500: both date and time come off, or the name | ||
| # never matches the table and a policy whose lines all sit in a rolled file reads as Unknown | ||
| $logsSeen = @($steps | ForEach-Object { $_.Log -replace '-\d{8}-\d{6}$', '' } | Sort-Object -Unique) |
There was a problem hiding this comment.
Anchored to the exact rolled shape (eight digits, dash, six digits) rather than a looser repeat of -digits, so a hypothetical log whose base name ends in a number is not shortened by accident. The agent has produced only this shape on the lab devices across all rounds.
| # whose lines all sit in the rolled file is still a remediation | ||
| $rolled = Join-Path $TestDrive 'Rolled' | ||
| $hs = @{ Component = 'HealthScripts' } | ||
| Write-TestLog $rolled 'HealthScripts-20260925-101500.log' @( |
There was a problem hiding this comment.
A separate folder with the rolled file alone, rather than adding a rolled file next to the fixture's current logs: with both present the current file would supply the kind and the test would pass without the fix.
| $ordinal = [System.StringComparison]::Ordinal | ||
|
|
||
| # An agent log of 22 MB is 80,000 entries, and every statement here runs once per entry. The | ||
| # An agent log of 15 MB is 80,000 entries, and every statement here runs once per entry. The |
There was a problem hiding this comment.
15 MB is the figure the 0.28.0 changelog recorded for the same 80,000-entry log the benchmark used; the 22 MB here predated that measurement. Only the comment changes.
| 09-28 07:11:22.504 AppWorkload EspComplete | ||
| 09-28 07:12:22.658 IntuneManagementExtension EspNontrackedCheckin True | ||
| EspAppState, EspPhaseComplete, EspComplete, EspNontrackedCheckin | | ||
| Format-Table Time, Log, Event, Detail |
There was a problem hiding this comment.
The block below shows four columns, and the default view prints Message too, so the command now selects what the block shows. The column widths are what Format-Table gives these values once IntuneManagementExtension prints as Agent; the rows are the round-8 values unchanged.
1 participant
Summary
Get-IntuneAgentTimelinereportedKindasUnknownfor a policy or app whose lines all sat in a rolled log file. The agent rollsHealthScripts.logover toHealthScripts-20260925-101500.log; the kind lookup stripped one-digitssuffix from the log name, which removed the time and leftHealthScripts-20260925, a name the log table does not have. Reproduced on the lab device's own rolledHealthScripts-20261008-202550.log: three remediations with 46 to 92 runs each came backUnknown.Two documentation items found at the same time: the parser's comments quoted a 22 MB log where the 0.28.0 changelog measured 15 MB for the same 80,000 entries, and the README's log blocks predated the
Agentabbreviation in theLogcolumn and the list form of the diagnostic result.Changes
Public/Get-IntuneAgentTimeline.ps1: the rolled suffix is matched as-\d{8}-\d{6}$, so both the date and the time come off before the name is looked up.Tests/Unit/Public/Get-IntuneAgentTimeline.Tests.ps1: a remediation whose two lines sit inHealthScripts-20260925-101500.logalone reads as Remediation, keeps the rolled name on its steps, and carries its outcome.Private/ConvertFrom-IslCmTraceLog.ps1: the two comments carry the changelog's figures (15 MB, 80,000 entries, 5 s for one policy against 30 s for every entry).README.md: the Enrollment Status Page block showsAgentin theLogcolumn and its command selects the four columns the block shows; the diagnostic block shows the list the command prints since 0.28.0, with the figures from a run on the lab device today.CHANGELOG.md: Fixed entries under Unreleased.Verification
Get-IntuneAgentTimeline,Get-IntuneAgentLog,ConvertFrom-IslCmTraceLogandModule.Contractsuites: 55 passed on PowerShell 7.6.6; the first three under Windows PowerShell 5.1: 39 passed.HealthScripts-20261008-202550.logalone readUnknownfor all three remediations; the new test encodes the same shape and passes with the fix.