Skip to content

Commit cf42794

Browse files
pull[bot]pull[bot]
authored
Merge pull request #595 from KelvinTegelaar/dev
[pull] dev from KelvinTegelaar:dev
2 parents f2cd6b2 + e2038c2 commit cf42794

File tree

2 files changed

+100
-75
lines changed

2 files changed

+100
-75
lines changed

‎Modules/CIPPCore/Public/AuditLogs/Get-CippAuditLogSearches.ps1‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,14 @@ function Get-CippAuditLogSearches {
1919

2020
if ($ReadyToProcess.IsPresent) {
2121
Measure-CippTask -TaskName 'QueryReadyToProcess' -EventName 'CIPP.AuditLogsProfile' -Script {
22-
$15MinutesAgo = (Get-Date).AddMinutes(-15).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
23-
$1DayAgo = (Get-Date).AddDays(-1).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
24-
Get-CIPPAzDataTableEntity @AuditLogSearchesTable -Filter "PartitionKey eq 'Search' and Tenant eq '$TenantFilter' and (CippStatus eq 'Pending' or (CippStatus eq 'Processing' and Timestamp le datetime'$15MinutesAgo')) and Timestamp ge datetime'$1DayAgo'" | Sort-Object Timestamp
22+
$15MinutesAgo = (Get-Date).AddMinutes(-15).ToUniversalTime()
23+
$1DayAgo = (Get-Date).AddDays(-1).ToUniversalTime()
24+
Get-CIPPAzDataTableEntity @AuditLogSearchesTable -Filter "PartitionKey eq 'Search' and Tenant eq '$TenantFilter'" | Where-Object {
25+
$_.Timestamp -ge $1DayAgo -and (
26+
$_.CippStatus -eq 'Pending' -or
27+
($_.CippStatus -eq 'Processing' -and $_.Timestamp -le $15MinutesAgo)
28+
)
29+
} | Sort-Object Timestamp
2530
}
2631
} else {
2732
Measure-CippTask -TaskName 'QueryAllSearches' -EventName 'CIPP.AuditLogsProfile' -Script {

‎Modules/CIPPCore/Public/AuditLogs/New-CIPPAuditLogSearchResultsCache.ps1‎

Lines changed: 92 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -13,91 +13,111 @@ function New-CIPPAuditLogSearchResultsCache {
1313
[string]$TenantFilter,
1414
[string]$SearchId
1515
)
16-
try {
17-
$FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads'
18-
$fourHoursAgo = (Get-Date).AddHours(-4).ToUniversalTime()
19-
$failedEntity = Get-CIPPAzDataTableEntity @FailedDownloadsTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId' and Timestamp ge datetime'$($fourHoursAgo.ToString('yyyy-MM-ddTHH:mm:ssZ'))'"
2016

21-
if ($failedEntity) {
22-
$message = "Skipping search ID: $SearchId for tenant: $TenantFilter - Previous attempt failed within the last 4 hours"
23-
Write-LogMessage -API 'AuditLog' -tenant $TenantFilter -message $message -Sev 'Info'
24-
Write-Information $message
25-
exit 0
26-
}
27-
} catch {
28-
Write-Information "Error checking for failed downloads: $($_.Exception.Message)"
29-
}
17+
Measure-CippTask -TaskName 'AuditLogSearchResultsCache' -EventName 'CIPP.AuditLogsProfileRoot' -Script {
18+
Measure-CippTask -TaskName 'CheckFailedDownloads' -EventName 'CIPP.AuditLogsProfile' -Script {
19+
try {
20+
$FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads'
21+
$fourHoursAgo = (Get-Date).AddHours(-4).ToUniversalTime()
22+
$failedEntity = Get-CIPPAzDataTableEntity @FailedDownloadsTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId' and Timestamp ge datetime'$($fourHoursAgo.ToString('yyyy-MM-ddTHH:mm:ssZ'))'"
3023

31-
try {
32-
Write-Information "Starting audit log cache process for tenant: $TenantFilter"
33-
$CacheWebhooksTable = Get-CippTable -TableName 'CacheWebhooks'
34-
$CacheWebhookStatsTable = Get-CippTable -TableName 'CacheWebhookStats'
35-
# Check if we haven't already downloaded this search by checking the cache table
36-
$searchEntity = Get-CIPPAzDataTableEntity @CacheWebhooksTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId'"
37-
if ($searchEntity) {
38-
Write-Information "Search ID: $SearchId already cached for tenant: $TenantFilter"
39-
exit 0
24+
if ($failedEntity) {
25+
$message = "Skipping search ID: $SearchId for tenant: $TenantFilter - Previous attempt failed within the last 4 hours"
26+
Write-LogMessage -API 'AuditLog' -tenant $TenantFilter -message $message -Sev 'Info'
27+
Write-Information $message
28+
exit 0
29+
}
30+
} catch {
31+
Write-Information "Error checking for failed downloads: $($_.Exception.Message)"
32+
}
4033
}
4134

42-
# Record this attempt in the FailedAuditLogDownloads table BEFORE starting the download
43-
# This way, if the function is killed before completion, the record will remain
4435
try {
45-
$FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads'
46-
$attemptId = [guid]::NewGuid().ToString()
47-
$failedEntity = @{
48-
RowKey = $attemptId
49-
PartitionKey = $TenantFilter
50-
SearchId = $SearchId
51-
ErrorMessage = 'Download attempt in progress'
36+
Write-Information "Starting audit log cache process for tenant: $TenantFilter"
37+
38+
Measure-CippTask -TaskName 'CheckExistingCache' -EventName 'CIPP.AuditLogsProfile' -Script {
39+
$CacheWebhooksTable = Get-CippTable -TableName 'CacheWebhooks'
40+
$CacheWebhookStatsTable = Get-CippTable -TableName 'CacheWebhookStats'
41+
# Check if we haven't already downloaded this search by checking the cache table
42+
$searchEntity = Get-CIPPAzDataTableEntity @CacheWebhooksTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId'"
43+
if ($searchEntity) {
44+
Write-Information "Search ID: $SearchId already cached for tenant: $TenantFilter"
45+
exit 0
46+
}
5247
}
53-
Add-CIPPAzDataTableEntity @FailedDownloadsTable -Entity $failedEntity -Force
54-
Write-Information "Recorded download attempt for search ID: $SearchId, tenant: $TenantFilter"
55-
} catch {
56-
Write-Information "Failed to record download attempt: $($_.Exception.Message)"
57-
}
5848

59-
$downloadStartTime = Get-Date
60-
try {
61-
Write-Information "Processing search ID: $($SearchId) for tenant: $TenantFilter"
62-
$searchResults = Get-CippAuditLogSearchResults -TenantFilter $TenantFilter -QueryId $SearchId
63-
foreach ($searchResult in $searchResults) {
64-
$cacheEntity = @{
65-
RowKey = $searchResult.id
66-
PartitionKey = $TenantFilter
67-
SearchId = $SearchId
68-
JSON = [string]($searchResult | ConvertTo-Json -Depth 10)
49+
# Record this attempt in the FailedAuditLogDownloads table BEFORE starting the download
50+
# This way, if the function is killed before completion, the record will remain
51+
Measure-CippTask -TaskName 'RecordDownloadAttempt' -EventName 'CIPP.AuditLogsProfile' -Script {
52+
try {
53+
$FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads'
54+
$attemptId = [guid]::NewGuid().ToString()
55+
$failedEntity = @{
56+
RowKey = $attemptId
57+
PartitionKey = $TenantFilter
58+
SearchId = $SearchId
59+
ErrorMessage = 'Download attempt in progress'
60+
}
61+
Add-CIPPAzDataTableEntity @FailedDownloadsTable -Entity $failedEntity -Force
62+
Write-Information "Recorded download attempt for search ID: $SearchId, tenant: $TenantFilter"
63+
} catch {
64+
Write-Information "Failed to record download attempt: $($_.Exception.Message)"
6965
}
70-
Add-CIPPAzDataTableEntity @CacheWebhooksTable -Entity $cacheEntity -Force
7166
}
72-
Write-Information "Successfully cached search ID: $($SearchId) for tenant: $TenantFilter"
73-
try {
74-
$FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads'
75-
$failedEntities = Get-CIPPAzDataTableEntity @FailedDownloadsTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId'"
76-
if ($failedEntities) {
77-
Remove-AzDataTableEntity @FailedDownloadsTable -Entity $failedEntities -Force
78-
Write-Information "Removed failed download records for search ID: $SearchId, tenant: $TenantFilter"
67+
68+
$downloadStartTime = Get-Date
69+
Measure-CippTask -TaskName 'DownloadAndCacheResults' -EventName 'CIPP.AuditLogsProfile' -Script {
70+
try {
71+
Write-Information "Processing search ID: $($SearchId) for tenant: $TenantFilter"
72+
$searchResults = Get-CippAuditLogSearchResults -TenantFilter $TenantFilter -QueryId $SearchId
73+
foreach ($searchResult in $searchResults) {
74+
$cacheEntity = @{
75+
RowKey = $searchResult.id
76+
PartitionKey = $TenantFilter
77+
SearchId = $SearchId
78+
JSON = [string]($searchResult | ConvertTo-Json -Depth 10)
79+
}
80+
Add-CIPPAzDataTableEntity @CacheWebhooksTable -Entity $cacheEntity -Force
81+
}
82+
Write-Information "Successfully cached search ID: $($SearchId) for tenant: $TenantFilter"
83+
84+
Measure-CippTask -TaskName 'RemoveFailedRecord' -EventName 'CIPP.AuditLogsProfile' -Script {
85+
try {
86+
$FailedDownloadsTable = Get-CippTable -TableName 'FailedAuditLogDownloads'
87+
$failedEntities = Get-CIPPAzDataTableEntity @FailedDownloadsTable -Filter "PartitionKey eq '$TenantFilter' and SearchId eq '$SearchId'"
88+
if ($failedEntities) {
89+
Remove-AzDataTableEntity @FailedDownloadsTable -Entity $failedEntities -Force
90+
Write-Information "Removed failed download records for search ID: $SearchId, tenant: $TenantFilter"
91+
}
92+
} catch {
93+
Write-Information "Failed to remove download attempt record: $($_.Exception.Message)"
94+
}
95+
}
96+
97+
$searchResults
98+
} catch {
99+
throw $_
79100
}
80-
} catch {
81-
Write-Information "Failed to remove download attempt record: $($_.Exception.Message)"
82101
}
83-
} catch {
84-
throw $_
85-
}
86102

87-
$downloadEndTime = Get-Date
88-
$downloadSeconds = ($downloadEndTime - $downloadStartTime).TotalSeconds
103+
$downloadEndTime = Get-Date
104+
$downloadSeconds = ($downloadEndTime - $downloadStartTime).TotalSeconds
105+
106+
Measure-CippTask -TaskName 'RecordStats' -EventName 'CIPP.AuditLogsProfile' -Script {
107+
$statsEntity = @{
108+
RowKey = $TenantFilter
109+
PartitionKey = 'Stats'
110+
DownloadSecs = [string]$downloadSeconds
111+
SearchCount = [string]($searchResults ? $searchResults.Count : 0)
112+
}
113+
Add-CIPPAzDataTableEntity @CacheWebhookStatsTable -Entity $statsEntity -Force
114+
Write-Information "Completed audit log cache process for tenant: $TenantFilter. Download time: $downloadSeconds seconds"
115+
}
89116

90-
$statsEntity = @{
91-
RowKey = $TenantFilter
92-
PartitionKey = 'Stats'
93-
DownloadSecs = [string]$downloadSeconds
94-
SearchCount = [string]($searchResults ? $searchResults.Count : 0)
117+
return ($searchResults ? $searchResults.Count : 0)
118+
} catch {
119+
Write-Information "Error in New-CIPPAuditLogSearchResultsCache for tenant: $TenantFilter. Error: $($_.Exception.Message)"
120+
throw $_
95121
}
96-
Add-CIPPAzDataTableEntity @CacheWebhookStatsTable -Entity $statsEntity -Force
97-
Write-Information "Completed audit log cache process for tenant: $TenantFilter. Download time: $downloadSeconds seconds"
98-
return ($searchResults ? $searchResults.Count : 0)
99-
} catch {
100-
Write-Information "Error in New-CIPPAuditLogSearchResultsCache for tenant: $TenantFilter. Error: $($_.Exception.Message)"
101-
throw $_
102122
}
103123
}

0 commit comments

Comments
 (0)