@@ -13,13 +13,9 @@ function New-CIPPAuditLogSearchResultsCache {
1313 [string ]$TenantFilter ,
1414 [string ]$SearchId
1515 )
16-
17- # Rerun protection - Check if we already tried downloading this search ID in the last 4 hours
1816 try {
1917 $FailedDownloadsTable = Get-CippTable - TableName ' FailedAuditLogDownloads'
2018 $fourHoursAgo = (Get-Date ).AddHours(-4 ).ToUniversalTime()
21-
22- # Check if this search ID has a failed attempt in the last 4 hours
2319 $failedEntity = Get-CIPPAzDataTableEntity @FailedDownloadsTable - Filter " PartitionKey eq '$TenantFilter ' and SearchId eq '$SearchId ' and Timestamp ge datetime'$ ( $fourHoursAgo.ToString (' yyyy-MM-ddTHH:mm:ssZ' )) '"
2420
2521 if ($failedEntity ) {
@@ -37,7 +33,6 @@ function New-CIPPAuditLogSearchResultsCache {
3733 Write-Information " Starting audit log cache process for tenant: $TenantFilter "
3834 $CacheWebhooksTable = Get-CippTable - TableName ' CacheWebhooks'
3935 $CacheWebhookStatsTable = Get-CippTable - TableName ' CacheWebhookStats'
40-
4136 # Check if we haven't already downloaded this search by checking the cache table
4237 $searchEntity = Get-CIPPAzDataTableEntity @CacheWebhooksTable - Filter " PartitionKey eq '$TenantFilter ' and SearchId eq '$SearchId '"
4338 if ($searchEntity ) {
@@ -60,18 +55,12 @@ function New-CIPPAuditLogSearchResultsCache {
6055 Write-Information " Recorded download attempt for search ID: $SearchId , tenant: $TenantFilter "
6156 } catch {
6257 Write-Information " Failed to record download attempt: $ ( $_.Exception.Message ) "
63- # Continue with the process even if recording the attempt fails
6458 }
6559
66- # Start tracking download time
6760 $downloadStartTime = Get-Date
68-
69- # Process each search and store results in cache
7061 try {
7162 Write-Information " Processing search ID: $ ( $SearchId ) for tenant: $TenantFilter "
72- # Get the search results
7363 $searchResults = Get-CippAuditLogSearchResults - TenantFilter $TenantFilter - QueryId $SearchId
74- # Store the results in the cache table
7564 foreach ($searchResult in $searchResults ) {
7665 $cacheEntity = @ {
7766 RowKey = $searchResult.id
@@ -82,19 +71,11 @@ function New-CIPPAuditLogSearchResultsCache {
8271 Add-CIPPAzDataTableEntity @CacheWebhooksTable - Entity $cacheEntity - Force
8372 }
8473 Write-Information " Successfully cached search ID: $ ( $SearchId ) for tenant: $TenantFilter "
85-
86- # If we get here, the download was successful, so remove the failed download record
8774 try {
8875 $FailedDownloadsTable = Get-CippTable - TableName ' FailedAuditLogDownloads'
89- # Get all records for this tenant and search ID
9076 $failedEntities = Get-CIPPAzDataTableEntity @FailedDownloadsTable - Filter " PartitionKey eq '$TenantFilter ' and SearchId eq '$SearchId '"
91-
92- # Remove each record
93- foreach ($entity in $failedEntities ) {
94- Remove-CIPPAzDataTableEntity @FailedDownloadsTable - Entity $entity
95- }
96-
9777 if ($failedEntities ) {
78+ Remove-CIPPAzDataTableEntity @FailedDownloadsTable - Entity $entity
9879 Write-Information " Removed failed download records for search ID: $SearchId , tenant: $TenantFilter "
9980 }
10081 } catch {
@@ -104,22 +85,17 @@ function New-CIPPAuditLogSearchResultsCache {
10485 throw $_
10586 }
10687
107- # Calculate download time
10888 $downloadEndTime = Get-Date
10989 $downloadSeconds = ($downloadEndTime - $downloadStartTime ).TotalSeconds
11090
111- # Store performance metrics
11291 $statsEntity = @ {
11392 RowKey = $TenantFilter
11493 PartitionKey = ' Stats'
11594 DownloadSecs = [string ]$downloadSeconds
11695 SearchCount = [string ]($searchResults ? $searchResults.Count : 0 )
11796 }
118-
11997 Add-CIPPAzDataTableEntity @CacheWebhookStatsTable - Entity $statsEntity - Force
120-
12198 Write-Information " Completed audit log cache process for tenant: $TenantFilter . Download time: $downloadSeconds seconds"
122-
12399 return ($searchResults ? $searchResults.Count : 0 )
124100 } catch {
125101 Write-Information " Error in New-CIPPAuditLogSearchResultsCache for tenant: $TenantFilter . Error: $ ( $_.Exception.Message ) "
0 commit comments