Custom Report Based on Logging Data Filter Criteria

Question

Hello,

I'd like to create a custom Adaxes report based on the following Logging Filters -

I'm currently having to filter the logs manually each time I want to gather this data but am wondering if there's some way to build a custom report using these same filters?

Let me know if it would be easier to jump on a call to discuss this further?

Thank you in advance!

Comments

Hello,

Could you, please, clarify whether an external database is used for log records? For information on how to check/change the setting, please, have a look at the following help article: https://www.adaxes.com/help/?Logging.EnableMSSQL.html. Should the filters be hardcoded into the report or selected via report parameters? Live examples and any additional information about the desired report would be much appreciated.

---

Hello,

It looks like we are using the builtin SQLite database.

If the report filters could be selected via paramaters that would be preferred but if its easier to hardcode the values into the report that works for me too.

I'd be happy to share some live examples but would probably prefer to do it over a call as it does contain some potentially sensitive information.

Thanks!

Answer 1

Hello,

Thank you for the clarification. To create the report:

1. Launch Adaxes Administration Console.
2. In the Console Tree, expand your service node.
3. Copy the Adaxes log built-in report (located in Reports\All Reports\Miscellaneous\Logging by default). For information on how to copy directory objects, please, have a look at the following help article: https://www.adaxes.com/help/?HowDoI.ManageActiveDirectory.CopyObjects.html.
4. Right-click the new report.
5. In the context menu, click Edit.
6. Activate the Parameters tab.
7. Delete the Show operations initiated automatically by Adaxes and Show errors only parameter.
8. Click New.
9. Select Drop-down list.
10. Click Next.
11. Specify a parameter name and display name (e.g. ObjectType).
12. Click Next.
13. Click New.
14. Specify an object type (e.g. user for the User object type) in the Value field.
15. Click OK.
16. Repeat steps 13-15 for all the object types that should be available for filtering in the report (e.g. group, contact, computer, organizationalUnit, etc.). If you want to specify an item as the default value of the parameter, it can be done via the Set as Default option in the item context menu:
17. Click Finish.
18. Activate the Script tab.
19. Paste the below script into the corresponding field. In the script, the $objectTypeParamName variable specifies the name of the parameter entered on step 11 with the param- prefix.

$objectTypeParamName = "param-ObjectType" # TODO: modify me

# Get parameter values
$objectType = $Context.GetParameterValue($objectTypeParamName)
$days = $Context.GetParameterValue("param-Days")
$initiator = $Context.GetParameterValue("param-Initiator")

$initiatorUser = $initiator.IndexOf("1") -ge 0
$initiatorScheduledTask = $initiator.IndexOf("2") -ge 0
$anyInitiator = $initiatorUser -and $initiatorScheduledTask

# Bind to Service Log
$serviceLogPath = $Context.GetWellKnownContainerPath("ServiceLog")
$serviceLog = $Context.BindToObject($serviceLogPath)

# Get log records
$generalLog = $serviceLog.GeneralLog
$generalLog.StartDateTime = (Get-Date).AddDays(- $days)
$generalLog.EndDateTime = Get-Date

$log = $generalLog.Log
$records = $log.GetPage(0)

foreach ($record in $records)
{
    if ($Context.Items.Aborted)
    {
        return
    }

    if ($record.TargetObjectType -ne $objectType)
    {
        continue
    }

    if (-not $anyInitiator)
    {
        $initiatorClass = $record.Initiator.ObjectClass
        if ((($initiatorUser -eq $False) -and $initiatorClass -ieq "user") -or
            (($initiatorScheduledTask -eq $False) -and
                ($initiatorClass -ne "user")))
        {
            continue
        }
    }

    $operationTypes = $record.GetOperationTypes()
    if (-not $operationTypes.Contains("set properties"))
    {
        continue
    }

    $Context.Items.Add($record)
}

20. Click OK.

Comments

Hello,

I followed the steps provided but the report it generates does not filter by Operation Type (Modify) + the additional 'JIT' filter. (See screenshot)

How would I incorporate those filters as well?

Thanks,

---

Hello,

Please, try the updated script below:

$objectTypeParamName = "param-ObjectType" # TODO: modify me

# Get parameter values
$objectType = $Context.GetParameterValue($objectTypeParamName)
$days = $Context.GetParameterValue("param-Days")
$initiator = $Context.GetParameterValue("param-Initiator")

$initiatorUser = $initiator.IndexOf("1") -ge 0
$initiatorScheduledTask = $initiator.IndexOf("2") -ge 0
$anyInitiator = $initiatorUser -and $initiatorScheduledTask

# Bind to Service Log
$serviceLogPath = $Context.GetWellKnownContainerPath("ServiceLog")
$serviceLog = $Context.BindToObject($serviceLogPath)

# Get log records
$generalLog = $serviceLog.GeneralLog
$generalLog.StartDateTime = (Get-Date).AddDays(- $days)
$generalLog.EndDateTime = Get-Date

$log = $generalLog.Log
$records = $log.GetPage(0)

foreach ($record in $records)
{
    if ($Context.Items.Aborted)
    {
        return
    }

    $description = $record.Description
    if (($record.TargetObjectType -ne $objectType) -or (-not ($description -like "*JIT*")))
    {
        continue
    }

    if (-not $anyInitiator)
    {
        $initiatorClass = $record.Initiator.ObjectClass
        if ((($initiatorUser -eq $False) -and $initiatorClass -ieq "user") -or
            (($initiatorScheduledTask -eq $False) -and
                ($initiatorClass -ne "user")))
        {
            continue
        }
    }

    $operationTypes = $record.GetOperationTypes()
    if (-not $operationTypes.Contains("set properties"))
    {
        continue
    }

    $Context.Items.Add($record)
}

---

Thank you for the response! The updated script is definitely a step in the right direction as its now pulling only the events that I want to report on.

One final ask -

1 - How can I modify the script or implement another parameter to only show events with a status of 'Completed' and not 'Failed' or 'Suspended'

2 - Is is possible to add the 'Department' of the Initiator to the report as well? I've tried doing it on my end but so far the report just returns empty values. Ideally this would be something I could put into a parameter.

eg

param-InitiatorDepartment

Then have some set department values available

Department A Department B Department C ALL

Thank you for all your help thusfar.

---

Hello,

To update the report:

1. Launch Adaxes Administration Console.
2. In the Console Tree, expand your service node.
3. Navigate to and right-click your report.
4. In the context menu, click Edit.
5. Activate the Parameters tab.
6. Click New.
7. Select Drop-down list.
8. Click Next.
9. Specify a parameter name and display name (e.g. Department).
10. Click Next.
11. Click New.
12. Specify a department in the Value field.
13. Click OK.
14. Repeat steps 11-13 for all the departments that should be available for filtering in the report.
15. Click New.
16. Specify ALL in the Value field.
17. Click OK.
18. Click Finish.
19. Activate the Columns tab.
20. In the Report-specific columns section, click Add.
21. Specify a Display name for the column (e.g. Initiator department).
22. Click Next.
23. Select Template.
24. In the field below, enter a default value (e.g. empty). The value will never be present in the report and is only required to create the custom column.
25. Click Finish.
26. Activate the Script tab.
27. Paste the below script into the corresponding field. In the script, the following variables were added:
    • $departmentParamName – Specifies the name of the parameter entered on step 9 with the param- prefix.
    • $initiatorDepartmentColumnID – Specifies the identifier of the custom column that will display the initiator department. To get the identifier:
      1. On the Columns tab, right-click the custom column.
      2. In the context menu, navigate to Copy and click Column ID. The identifier will be copied to clipboard.

$objectTypeParamName = "param-ObjectType" # TODO: modify me
$departmentParamName = "param-Department" # TODO: modify me
$initiatorDepartmentColumnID = "{ba783f1c-4da5-4dd5-b123-4b9d1caa3154}" # TODO: modify me

# Get parameter values
$objectType = $Context.GetParameterValue($objectTypeParamName)
$department = $Context.GetParameterValue($departmentParamName)
$days = $Context.GetParameterValue("param-Days")
$initiator = $Context.GetParameterValue("param-Initiator")

$initiatorUser = $initiator.IndexOf("1") -ge 0
$initiatorScheduledTask = $initiator.IndexOf("2") -ge 0
$anyInitiator = $initiatorUser -and $initiatorScheduledTask

# Bind to Service Log
$serviceLogPath = $Context.GetWellKnownContainerPath("ServiceLog")
$serviceLog = $Context.BindToObject($serviceLogPath)

# Get log records
$generalLog = $serviceLog.GeneralLog
$generalLog.StartDateTime = (Get-Date).AddDays(- $days)
$generalLog.EndDateTime = Get-Date

$log = $generalLog.Log
$records = $log.GetPage(0)

foreach ($record in $records)
{
    if ($Context.Items.Aborted)
    {
        return
    }

    if (($record.TargetObjectType -ne $objectType) -or (-not ($record.Description -like "*JIT*")) -or ($record.State -ne 4))
    {
        continue
    }

    if (-not $anyInitiator)
    {
        $initiatorClass = $record.Initiator.ObjectClass
        if ((($initiatorUser -eq $False) -and $initiatorClass -ieq "user") -or
            (($initiatorScheduledTask -eq $False) -and
                ($initiatorClass -ne "user")))
        {
            continue
        }
    }

    $operationTypes = $record.GetOperationTypes()
    if (-not $operationTypes.Contains("set properties"))
    {
        continue
    }

    $initiatorObj = $Context.BindToObject($record.Initiator.AdsPath)
    try
    {
        $initiatorDepartment = $initiatorObj.Get("department")
    }
    catch
    {
        $initiatorDepartment = $NULL
    }
    if (($department -ine "all") -and ($department -ne $initiatorDepartment))
    {
        continue
    }

    $Context.Items.Add($record, @{$initiatorDepartmentColumnID = $initiatorDepartment})
}

28. Click OK.

---

Thank you! This worked perfectly!