I am working on script which should output audit logs report in csv file for selected fields. Due to rest api result limitation I can not get all data at once. If I pass continuation token manually I can get next set of data but I want script to generate all logs for given time frame
I tried this script which does not return all data -
$personalAccessToken = ""
$auth = [Convert]::ToBase64String([Text.Encoding]::
ASCII.GetBytes(":$($personalAccessToken)"))
$headers = @{}
$headers.Add("Authorization", "Basic $auth")
do
{
$uri = "https://auditservice.dev.azure.com/{org}/_apis/audit/auditlog?
startTime=2020-07-01T00.00.00&endTime=2020-10-
15T16.00.00&continuationToken=$continuationToken&api-version=6.0-
preview.1"
$TestRuns = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get
| Select-Object -ExpandProperty decoratedAuditLogEntries |
Where-Object { $_.actionId -eq 'Git.RepositoryCreated' } |
Select-Object actorDisplayName, ProjectName, actionId, details,
timestamp
$continuationToken = $TestRuns.Headers.'x-ms-continuationtoken'
$TestRuns
}
while ($continuationToken -ne $null)
I also tried with Invoke-webrequest it also does not provide all data. I have large chuck of logs.
How can I get all the data ?
Here is the solution which worked for me -
$personalAccessToken = ""
$auth =
[Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes
(":$($personalAccessToken)"))
$headers = @{}
$headers.Add("Authorization", "Basic $auth")
do
{
$uri =
"https://auditservice.dev.azure.com/{organization}/_apis/audit/auditlog?
startTime=2020-09-20T20:42:20:3094806Z&endTime=2020-10-
15T20:42:20:3094806Z&continuationToken=$continuationToken&api-version=6.0-
preview.1"
$TestRuns = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get
$result = @( $TestRuns | Select-Object -ExpandProperty
decoratedAuditLogEntries |
Where-Object { $_.actionId -eq 'Git.RepositoryCreated' } |
Select-Object actorDisplayName, ProjectName, actionId, details,
timestamp )
$continuationToken = $TestRuns.continuationToken
$result | Export-Csv "/data.csv" -Append
}
while ($null -ne $continuationToken)
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.