Research Triangle PowerShell Users Group User Group, 16 Jan 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Eventlogs: Learn to Search like a "Boss" in PowerShell! with Phil Bossman January 16th, 2019

Description

Windows Event Logs... You know they contain a ton of useful information, but they aren't exactly the easiest to search. Let's face it, everyone can use some helpful pointers on how to efficiently search event logs! Join Phil Bossman as he shows you the ins and outs of Event Logs and tricks he has developed over the years to making searching "less painful".

Phil is an accomplished Windows administrator and is a Citrix architect for a national building materials supplier. Phil has a passion for technology, automation, and learning all things PowerShell. Phil is here to help anyone get started searching event logs quickly and efficiently. He's got tips for PowerShell n00bs as well as the veterans alike. Be sure to join Phil as he shares his wealth of knowledge on a topic that everybody can relate to.

Resources:

Content from presentations can be found at our github:
https://github.com/rtpsug/Meetups

Watch our previous meeting on Infrastructure testing with Pester:
https://www.youtube.com/edit?o=U&video_id=YYupOzqTgTs

SUBSCRIBE to learn about PowerShell!
https://www.youtube.com/channel/UCiTuB6HZiupE8CJ71vkMFnA/example?sub_confirmation=1

LET'S CONNECT!
-- https://twitter.com/rtpsug
-- https://www.meetup.com/Research-Triangle-PowerShell-Users-Group/

A

B

Everybody's recorded, you know, region.

A

Over that yep we're recording.

B

A

Get started so.

B

I want to say, welcome and thank you. Everybody for joining GE out.

A

B

Our soul, music group meeting, my name is Phil Bachman on I will speaking be speaking today. You get a bunch of introductions and all that for, but today's topic is going to be event logs or you.

A

B

Event, logs and searching it like a boss. Does my lady's office man.

A

Oh hey Martha,.

B

A

You've expected there will be Wilson, okay, I.

A

Just got a some.

B

A

B

All right so then ting and hurdle a small.

B

So what we're basically talking about today is Windows Event log and using a PowerShell to advance or to help you with working with event logs.

A

One of the we'll also start with is well start with backing.

B

On PowerShell first started power tool version two and everything they had a commandment called get event. Log.

A

So, just two quick little so.

B

Whenever you're trying to do some discovery and kind of do some discovery, get help is.

A

Always your friend, okay,.

B

So this is one of the best places to start with you're trying to do bunch of stuff to the PowerShell. This gives you synopsis descriptions so.

B

This the parameters, what you can use with it and we'll go from there, one of the good things your time of trial is logo. 101 is also has example. You can certify this as well from.

A

There so talking about event logs. What is it that log so.

B

You're working with a year, 1 is Event Viewer. This is the default place where Windows puts all its logs. There is an application log security, log system, log. That's what makes basically system security and application is what post people use at this stage. So you get of errors and warnings and and such so most people when they're working they're doing what does administration does up in here and it is gooey monster. Ok, it's pretty powerful. You can do a bunch with it, but it's your doing and that's not why we're here.

B

You know we're here to you, know, exploit.

A

The power in PowerShell, so it's a capital, P power. Ok! So that's my other page.

B

So you know what do we get when we use Windows get event on so.

A

Let's use get the pen log, they get adventure, information.

B

And we're to say, 20th machine.

A

A

There we go so.

B

This is the output you typically get when you're working with those event loss. So you see it's roughly. The same thing just saw with the event then, but now we get some slightly more information, but is this really something you can work with? Okay, so hey? We just got first into just 20 items, so you can get power, you can get events directly from there and hopefully, but this is big enough. People can see in the room and it's been different, remote kind of little bigger than I thought.

B

So the other things you could do we kind of look when we didn't help is we look at all the different parameters that are available to you? So, of course, the log names we Tommy talked about. There are parameters for before after and get.

A

B

Let me do the newest, but again being powershell, you can say hey. I don't want to actually type in that huge date-time format and all that I don't have I, don't really care. I can do get date. I can specify the exact date itself. If we wrap it in parentheses, we can actually do.

A

B

With that you know and a days you can play this game and you can dynamically build out pieces like that. Okay, so you can do that and say: hey give me the event bugs that happen locked with the third and before the fourth. Ok, so again, just as easy there's all the events on my local computer. That happens two days ago, but it's only formational that, because.

A

That's what connects both I should find applause. How long does windows keep the event log? Is there like a default so.

B

Windows, the there's a property of all of each event, log, and it's based upon that, and so it can. You can keep it forever as long as it will grow. So, basically, if it's a file that actually just rose, it's a log file and so the default on the default.

A

Is done by size, I.

B

A

The folks to roll over and it's like three or five math.

B

A

So in the GUI ball-sized with.

B

Quit this log key clicking these properties again, you define what that is, so it overrides the events as needed or- and this is very amazing- but I you know in most organizations, you can control that different ways, yeah so at least on our servers control that side by your policy, and you can define it there and what it rolls to, and you know how much we keep so certain logs, we keep another ones, you'd also defined. What.

A

They actually file is you can make a backup of the logs. You can export them, so we have just been wrong wrong. Yeah! Yes, yes can backup the log itself. So that's you know. That's.

B

The point is that various that.

A

B

A

B

Then one of the other things that we do as well as we redirect those well to a different location. So you can do that as well. You can doesn't have to be under siege on your sister drive computer on the driver, so other drivers eat, but that's more like an event logs in the.

A

Event service so.

B

With get event log, there are parameters for before and after so when we get before one of the things one of the biggest things, here's a get all the events. This is event logs. It just rolls.

A

And rolls and rolls because.

B

There's just so much and that's.

A

B

We get down to the idea that you can refine your search. You know the whole point of this. Is you know hey you can get all this large amounts of data. The beauty is to take some of these parameters and take some of these properties to refine. What is in that search, so you can get more granular details.

B

So in the get event log is since ID we left the event ID, it's not the same thing it's where if it is the same thing, so this is so. This is all event ID 0, so you can just as easily do that.

B

Give you the last 20 application vents that are d0 and then do the same thing, but one of the things that we need to always remember when we're doing shell is that day we have a list of the same user. Three items I see five properties here across here. Well, it's not just our property. These are objects that are just for faulting out to.

A

B

Console in that fashion, so we have get members, so there are other properties that are not actually display. Here you get all the pieces that are there. You get machine names, get index entry type data, a container that it happens to be in the time it was generated. The title is written, so all of that detail is available.

A

To you, you just need to pull it back out. Okay,.

B

One of the things that I want to bring up at this point is, you, may see stuff and as you're doing some research and and looking around for our shell or for working with event logs and hey I'm, trying to get this particular event. Log well,.

A

That long again,.

B

Started wave and I can version two or get to get win event. You might even see we're going to actually get to.

A

Get rid of it there's.

B

A different command: it gets the newer version of power shop, so with version PowerShell three and above will be get win event which most everybody uses nowadays, but original was getting that log and, as you look around the internet- and you may see stuff so refers to get event long and then you just try and put it in there and doesn't work this rifle understand. There are two different amendments for that. The advantage.

A

Because when log huh advantage of Edwin log I know we're talking about event, logs get.

B

A

B

Get one event will do is the like version, 2.0 of get event log, so the point here I'm going to show there is that get event. Log will give you only just that list of logs there. So when you're dealing with so the application services logs and work with our windows, they introduced what I think it's with 2008 and.

A

Above that, all of we.

B

A

Now, right out, lunch is different, so.

B

Many more than sort of that logs just services like your own logs is you, as you can write your own. You can create your own logs. They can write you and you can fill that in, but can't access.

A

You can get.

B

That all you need to just get one.

A

Event also, there's nothing that get event can do that get win event can do it's a super sad right, correct.

B

A

Difference in fact, correct. This is different, like some people feel that, if get the event, log is easier for man. Like did you.

B

A

After I don't think they existed right and, like you said, subset of lives, but for those logs, some people think that the old command is faster as well. The retrieve data yeah. So so it's like two different one is just going to cat almost yeah.

B

So again, there's the list of all this.

A

B

It was inside there, so this is this is where I want to just talk through the whole idea of so you're, going to see me jumping around and kind of going through a bunch of stuff, so.

B

We do this in PowerShell. The reason we do this in PowerShell is to do potentially filtering or get more power out of the event log. So the fact that I say I said before is give me all the errors or actually yeah um to him, but it still doesn't really matter. Give me all the errors. Okay, when I want to group them all by event. Id and I want to sort by count. So what is that really give me so now going through my computer?

B

Give me all these errors, then I sort them by event log and then so by event. Id. There are 673 errors that happen to be event, ID 14. So this is really doesn't give us any real value, but the idea is that if you understand the concept that we're dealing with objects to making objects have properties and everything- and we can use other tools within our PowerShell background- then our powershell toolkit to then expand those parts. So just by getting the event log now we can use group. Now we can use sort.

B

We can do some magic at that point and so um becomes a real big tool. Okay, so one of the other points to is we're going to do almost the exact same thing and then we're going to send it out to a variable so that we can actually work with it.

B

So now here this is basically the events. Is that at that point, give me so now here is all the items of that happen to be so. No event is effectively a big, an array of all the events. Then what I want to do is I want to actually figure out what dishearten 72 74 is, so we can then figure out hey. This is what that event log is.

B

This is what that area, and so we can go at that point, not sure why or that's dummy value, but the idea that you can use that and use PowerShell to expand beyond that. So here's another example of get event, get any applications, the airs or sort by that, but now we're actually going to do some some powershell fun and we're going to give me the count. These name we're going to actually do some fun with.

A

B

For all the we're going to define the new property club sources, we're going to take the group and we're going to put them all together. So let's see what we get you.

A

Want to explain that expression me yeah looks to be a little confusing.

B

So might be easier to understand at this point, so what we did is took to begin all everything we just had and for every event ID who group them together now, in this case the de 10:23 event appear 51 times, but he was actually created by both personalized and MSI installer. So what we did is we created a new property called sources again and great. This is actually called a hash table, so.

B

Property child name, so we define the name of the property, and then we can find me an expression of what that property is going to take currently and then I select out its source property of the group and only want the unique ones. I don't need. You know, I, don't need you know: five copies of MSI installer Z. Of course, there's going to be more than one and then I just joined them with a comma. So that's how I get a unique perk lied, followed by a unique.

A

B

Installer, so it's a little bit of fun, magical idea that I can now figure out well how many different types of these of errors are there and it's perfect timing, who's contributing to those errors. First lot and MSI installer.

A

B

Again, because we're dealing straight with objects, we can just as easily pull out the event. Id say give me everybody for errors there's.

B

So we saw my sign installer and we can using this method, you can say, give me the 1024 vents.

B

This is not much different than what we just saw but again using PowerShell to expand, but the data we have get those same events, but this time we're going to actually send it out to out grid. So, instead of inside the console, we're going to throw it out and we're going to get a doing representation of what it is. So if you're not familiar with what out grid genius is.

A

With Windows PowerShell you can you sub review partial cores.

B

Stones and stuff to try and make a blog at work, but now we can give you interview that maybe would help you intarsia net data. So again, there's just another option. We bring the plate. Oh.

A

We have to return from what are they the same object or they completely different 30 different options? It's not. They have different properties. There's probably a wonder wonder there.

B

There are different properties, there are different properties, they're, just freeing up yep.

A

We clarify or add another point to the question of whether get in a net and get them on are the same so get one, and then is the newer version working to point out the one piece that separates it being one of that hour get eventlog Rather's click, what's called the filter hash table, so essentially you don't have to if bill goes in at that log, everything and then you pipe that to where object equals this.

A

That actually is much slower and using a filter hash table on get what event so same thing with the ad user. Any user allows you to filter something by name by an employee ID by same account, name and then pipe the rest of the result out, but.

B

A

Log you just get it all and then you've got filtering so get one is it is extra quicker, especially for remote computers? So if you're running on a lot of event log on more than one computer, your local machine get one of that much quicker, easier to process remote advance. Do they use the same remoting technique which is not win RM, it's I believe the far end I can verify.

B

A

Another yeah I, think of those the folks we hash table is on gate where that I'm sure, let's use time. Thank you for.

B

Introducing that, because that's.

A

B

Exact name next topic hey well now, that's basically, all the kind of fun. That's the extent of all the fun that you can do. We excuse me I get one event or we get event log. Is that you're limited to just that it you have to do all your filtering afterwards. Good point is as a in Express different. You have to do all your filtering after doesn't there's not much filtering in beginning, so you get the whole thing. So that's kind of why you saw people at the time. Stick give me them.

B

Doers 20, giving the name is 90 only giving just the parts that I need when you move into get one event when they built that you have a lot more more properties that are available to you. I think, don't think I close or I did closes so again with Randy's help. There sure there are three command. You should always know if demand get help and get member. So that's when you're working PowerShell, so they're against also saw the same thing with computer name, but we also now have control.

B

We have filter hash table with Jonathan with just referring to. We also have filter, XPath and filter XML, and so we'll talk about both of those as we can move on.

B

It has able to list the look list of providers and then we kind of do logs max events as effectively kind of let the newest we kind of talked about okay. So then we can also say the oldest and stuff like that.

B

So again, it's always a good idea to reference the the help.

B

So let's go back yep.

A

Yep, have they incorporated any of the features functionality of the log, the log viewer utility in into this I, don't under a command-line utility that you could use and it would process the number of event.

B

You till, then, you tell that you see that what you're referencing.

A

I was like log log viewer, but you could you.

B

A

Process any number of different kinds of log log files with this I was wondering if they've incorporated that functionality into PowerShell now I'm.

B

Not I'm not familiar with that. Okay.

A

B

So, as Mark was over there asking you might be able to see that it's sitting here filtering in it's still spitting along. So just as before, when you say get win event, you can get the entire application log and what we did. My computer fan is like spinning with a beast trying to input all that come.

A

B

I just go to lunch, and so there we go so it will give you everything in it in it as it can see so, like we just talked, we have the oldest to newest. We have.

A

B

Event, so you can you'll, you should be when you're working with um when you work with get win event or even get a vent log. You should be using. You know a max number that you're dealing with that's pretty much the best way to do it, but one of the things that you'll kind of quickly see is that as you're talking about, they are different objects and they are represented in different ways as well, because you, here you see, is actually grouping all the events as they come by their provider.

B

Name so that hey, you can see hey. These are doctor service events and then you know inventory service and it puts them all it groups them. So you can see them slightly different, so it represents them as events differently because they are actually different objects, okay, and so they do have different properties.

B

Okay, so we have keyword, display names, level ID, which is its ID. So it is not effectively the same thing because the properties don't even match, but there they are one for one representation of what they are so but win event is a superset. So there's more detailing win event. Then there is an event: log, okay,.

A

That log property is an analogous property in a win event. Boxing.

B

Correct these are air event. Log records actually I, don't know.

A

And Oh help get mine.

A

Well me: patient.

A

Máximo, it was.

B

So get eventlog responds back with.

B

Blog entries, that's the X, will then type of the log entry. So it's not the same. But again you have different properties and you can certainly investigate from there. So other things that Jonathan just talked about these hash tables are.

A

Really good for no.

B

You're good, let me jump to heavy ok, yeah sure.

A

We should time out afterwards, okay, so.

B

You can you, can um you can define a hash table, okay and get more granular? The idea that I can now say that I want the application. Log I want just NSI installers and here's the same event ID we talked about before. So if we define this whole thing and we're going to do is.

A

So we're going to do this.

B

Sorry can you do that I would do this on my computer's had a lot more screen real estate, not fine f8 so go see, it does a lot faster than it did before, because what we're doing is we're now. Actually we're telling the system itself don't give me all the application logs. Don't give and then give me the ID that only give me 1024 and we give the MSI installer. Does all that filtering at the end level and only gives you return to back this part.

B

So the only things across the pipeline are just what you got okay. So when you're dealing with filter hash tables, okay, you can filter on. You can define any one of these. You can define the log name provider name cap, so I'll maybe write a name. You can do the partials. So give me everything that is- and you know, Microsoft and then go from there. Okay, how long has that been defined? That way, all right, you can define the ID.

B

So the idea is that the event ID level is actually critical morning ever informational, though actually have index numbers start time and end time. Well, that's you don't, after herbivore of.

A

This event log event items they sometimes.

B

They say I think they're. Always time didn't have a user. Id is suppose to find the entry. Then you can actually parse the data itself bulimia. So those are all optional. For you know.

A

Spring like when you say Microsoft, you say Microsoft star that what you mean you defined you yes ice table is my Christmas tree Microsoft star. Yes,.

B

You can say I would you can just as easily do MSI installer and a sign dot star if there are multiple there now.

A

B

Dollar, I'm pretty sure it's a strictly a.

A

Like not a match, it's.

B

A string comparison I think it's not a ton of full regex. Okay, I, don't believe it's a full regex! Oh.

A

Well, I have a question for you: okay, everything in that hash table. We just listed yep, also match up to parameters, only get one event command right, as you can say, get win event. Log name application. Yes, so the question is: is using the filter hash table with that set of with that hash table faster than, if you just said, get wit event at event, hash, like you're passing for the parameters it?

A

No, you can't get level. You can't get start time. You can't get other things. Every property isn't exposed to the two that get one of the parameters.

B

A

B

A

Properties can only be exposed. You.

B

Would wrap it off into a hash table? Sorry now and I know, so my previous answer is no. So this whole there are not properties for all of these right.

A

B

Is no property for.

A

B

Get win event. You already know there is no property to that.

A

Okay, so it's clearly two different mechanisms corrective is the filter. Hash table is activating versus the print if you're, just using you know yet, underneath its completely mechanisms and thus would have different speed presentations well, really just remotely not.

B

Because not because it of speed itself, but because it's the filter, it's using is different. The other one has no filter, filter respectively, star everything, and this one is now saying give me a subset of your.

A

Passing the remote machine thing: here's the algorithm to use this in back just the necessary right. It's the only sending back this much stuff instead of this much definitely right and and I understand that, when you're piping it to a where clause, what I was asking is, if you're, using the parameter rod name on get win event that has the same actual implementation as if you're passing.

B

A

Hash table of logs a mapping to do that just pass that information as a small filter to the other end in the other vendor right click. What's good, I've done that before a single property? Yes, let's go property; a book.

B

A

Asking using different widgets pattern.

A

Uses different mechanisms, and so perhaps take we use. So if you like an event together all the existence, all three options are parameters. If you want to splat them, instead of use, Fisher filter hash table, which is faster, yeah. Look at this scale.

B

Is there may be a difference and I'm, not sure you know yeah, it's I'm, not sure you need to find out. I, never thought to look and, to be perfectly honest, I, don't really care right.

A

B

A

Be really on yeah.

B

A

For you on a filter, hash table tip in the future in a future version of EOS, another property is returned that doesn't exist now. Could that be used in the in the filter, hash table.

B

Not at this stage, no, because that hash table has been defined and it is so, it was a limited with generally to be a breaking change. Okay,.

A

B

So most likely would be something else. We're.

A

B

Do it that way, I would assume that they wouldn't do it that way. Okay, okay,.

B

So we kind of talk about it's kind of tough to see so I think we defined before here's my hash table I actually spit it out to MSI installer events, so I did that and I threw it back out into a array. I can then use if you're not excuse-me, familiar with it. If you put square braces behind an array- and you actually use a number you index it, our eggs are always indexed off of a zero. So this is actually the second item.

B

So always remember that it is the second item in the array and then what I'm doing is format list. So now, I'm going to say, give me what everything is inside of this and you can kind of see at this point the properties as you're trying to scroll up. So the properties of this.

B

Has it has its message? It has your machine ID, there's your ID, your event, ID as your provider, so all the parts that we kind of had before are there as well and so just like any object. The idea is that there is that actually individual event itself. um So here we are with with events when you're dealing with the fact that you can use a an event record. An event record actually has another really cool property in that you can actually convert it to an XML okay.

B

So in that's, what we're going to do very next is we're gonna actually take that second item and we're going to stick it back into an XML and kind of see what that is, and why is why is that important to us and so okay, we just have an event. We have an XML now so now, we've left that that that individual event itself so granted. The second item: okay, we've converted to an XML everything. We've used this.

B

We define a new variable and this is actually called reflection, so we're saying that this variable we're going to actually cast it directly into an XML property and PowerShell is going to say this is whatever we stick in. There is going to be an XML format, so now we have a an object that we can reference just as an XML reference itself, so it is kind of see it is in that same form, yeah, so smell, like outer XML.

B

So there is the actual raw XML of what that event is so in raw form, but hey. We can then dot notate the actual event itself. So here's all the details within the event itself right here, so we can kind of now parse out, so they have idea is that now, hey now I have a way to get inside the event itself and actually do something so I stuck it into a variable and now I'm gonna start parsing those variables. So now we're going to go into a little peer, not familiar.

B

We can come here and you probably do that or each and we'll do this to calm at table because that's best practice, so we're going to take you our entire list of events and for each event that we go through we're going to actually cast it into an XML document and then we're going to create a brand new PS custom object and we're going to pull out the parts that we want. So I'm gonna say: hey, look!

B

What's the app name, what's go ahead and let the error code for this particular event and actually these events are application. Error, events? Okay, so if we do it that way with some powershell magic, we now have AP and now have a list.

B

Of all the what happened to the events, what app is actually crashed or what app that was what the grid is and the error code that happened on it. So now we can take those events and we can then put it into a CSV if we wanted to, we can do more stuff with it, so we can then, if we start playing and with the event, so one of the points that I want to bring up to is that you'll see me do a bunch of this stuff in action.

B

I'm purposely leaving this in here is that hey I got a bunch of events. I just took up the first one going okay, this is what I want now I thought: can you take the first one? Stick it into an XML. Okay! Is this what I'm, looking with so now, I'm using the con so I'm using PowerShell to get me the data back out, then going okay.

B

So if I get the single event XML that what I want and then I went down the chain and figured out exactly what I wanted so once I had now I know what data I'm looking for well now, I can pull out the parts that I was looking for. So I then use the data that I grabbed here and I built this you know line 49 through 56 is I, then, okay, so almost reproduce.

B

What I did up here, effectively reproduce it there, but then I built the custom, object that and then spit out the end. So really the power inside of PowerShell is the fact that I can take my events in the form. They are generate: new objects, new effectively, DPS custom objects or whatever object and then go from there and build my own object and then no two is that there's also.

B

This is really.

A

B

That there is an entire different XML part, so I have the other parts and you might not notice that it was there. So all the other parts are still there as well. So.

A

Yeah David online caught wind of your little scrub data thing, so we have a chance who's curious as to what that's, what that's doing all right.

B

A

B

Scrub data is one of the one of the challenges I came up with for that I had here with doing this is I wanted to get real data and you'll notice that there's a set. The computer name is called that local dot whatever so I'm actually pulling real data from my live environment and going okay. Well, because this is getting recorded all right, well, I've created a function that basically just scrubs all our corporate stuff from it, and so you'll see a bunch of places where I use scrub data.

B

So if there's an opportunity for me to scrub out our corporate stuff I do it. So that's really what it's all about, because well, the intention was not so much to like. If we were just being this and just being broadcast and not being recorded, then I'd have no problems. We could show corporate at home because nobody's going to remember Indonesia.

A

B

The fact that it's getting recorded I wanted to take that opportunity to use scrubbed it. If I could.

A

B

Gonna put some some fuzzies all over the screen and scroll it up and down so there's some fuzzy scrubbing.

A

B

One of the good things is: if you're, if you want some more details, Ashley McComb go TP. Efi did an awesome job not to fund it, but we will have that link in there later, but I will there. Hansen did a bunch of good stuff with there's a really good article. He kind of talked about the same kind of thing about parsing the pieces and he talks about.

B

He gives a bunch of good examples with using group policy, so this is also another good reference and I wanted to just bring it up and and talk about it. So we kind of talked about lists providers, so he kind of talked about so we I wanted to give before is hey. What can you get out of? What is all the the logs that you can pull from that event log?

B

Well, you got the you know list of seven well, we just did that and just scroll right up, screen, I think there's like probably one hundred and ninety something there's tons of them and then again you can do that same thing. Here's the list of just stuff to talks about policies. So you know there's a lot of details now that we're using get win event.

B

We can get a lot more date, a lot more information out of event logs out of the event things system, just by doing that, just by using moving to get what event so this all possible event IDs and descriptions from a provider. So that does the same thing so, based upon what provider I have will tell me all the event IDs that are coming out, and so you can kind of do some fun and dig into it. So this is like really deep weeds, but I don't, but I want to do laid out there.

B

So we kind of talked about this is a direct representation. Here's just your policy, the operational things they can put in there, so you notice before is we just called application? But here when here it's Microsoft group policy operational just like if we go back down.

A

B

Application Microsoft Windows find the actual app scroll scroll.

B

B

So this guy operational, and so everything in here if we use some of the five thousand five thousand, seventy four. If we do this and we'll get all five thousand seventy four long so again, it's that if we use get win event, we can now access that event log and not just the application system that so.

A

B

An opportunity to get more more information using get one event, and you can dig more into that later on.

B

A

Writer clips on these.

B

All right so you'll see some more bunch of stuff I think so, if you did.

A

So did some stuff with dad think.

B

I jumped before so again you can get the entire application log and again because we're using get one event or it will just run and run and run until we're done or we get first. Fifty.

A

From that event,.

B

Now we talked about get on hash table, hit, filter, hash table or a.

A

B

Of parameters well, I, don't use that very often primarily because I use um get XML. And let's talk about why? So, if you look at event logs itself, okay- and if you clicked on to did you do so, let's actually click on details of what set this event occurred. So this event, you put out his details, you notice this is the friendly day, but then we also think helps smle. So all the event of themselves, all the event entries are actually raw XML.

B

A

Why can't I see is ml to fold this in a fact just.

B

Because it's not available to me I can use XML to actually flip the pieces. I want. So the fact that I with filter filter.

A

B

Table I was limited to when diving to the start time. I was living to that, but I can get more. I can refine that search even more by using XML. So let's do some examples. There. Oh.

A

B

A

Jumped to well.

B

One of the things if you're using event to yours as well business thing called filter. So you can do this whole nice boobies kind of thing here. I only I want just B's I wanted to vent ID on this trouble for one seven, all right so now the event log up. Does it didn't only errors and those are all informational.

B

So now I only see four one, one, seven on my list, so what the heck just happened. But hey look at this thing over here. We have this thing filled XML, so.

A

I can now so.

B

This GUI I mean Microsoft in their wisdom, gave us an opportunity to say hey. This is the XML that we're using to generate this data back there. So all right, so I can just copy this out and I can put it into my create a hash statement. I mean actually a here string. So this is effectively my dagger acting on, but this is actually here. What's it doing not informational within seven days, so it does a bunch of stuff I'm you're, going to use the application log.

A

B

One two and three, which is effectively critical errors and warnings, and we don't really care about most of this. This is some funky stuff in the background, but this says where the current time is less than seven times. You know milliseconds. This is how many milliseconds are in seven days. So that's what is doing it. So you don't really care at some point. So if I define this she's supposed to five so now, I'm going to define my filter.

B

So now here are using that same filter. Here is all.

A

The levels I will people.

B

A

B

Are all errors or wines within seven days on this computer so now I, instead of using all that other stuff I I can now use XML to then parse it so even better I get more granularity to define what I'm looking for, but we kind of talked in that same fashion, where hey I can say this level, but we can do some fun with hey. Give me only these event IDs. So now we're going to reference the system, log we're going.

A

B

Stay heirs, we're going to say that so I'll going to do read to find my eggs.

A

Milk Oakland Andrew.

B

So we're going to we're going to we're going to kind of talk exactly that so I use this, give me the base of it and figure out what I'm looking for. So. This gives me the good structure, the original structure, okay as a template, and then we're going to kind of talk about what you might see in just a little bit as to where we're going through that there.

A

Was a box on there to edit manually? That means you can edit in that window. If you want yes, yes does it have syntax checking and all that yes, well.

B

It's not really syntax checking will tell you, there's no if left way left and no so if you put it like.

A

B

Go okay, it does not actually I, don't know if.

A

Good for this drama, let.

B

Me put some garbage in here all right. Let me put some wrong garbage: hey I, get in and out of query and I get no data returned back. So if you give a garbage, it will try and tell you that you have an invalid Clery just the same ways if you define this wrong, that will do that right. So this isn't going to run at this track. I run this one, but the idea that these days and now I have a huge, it's actually wrapped in bubble votes.

B

So that means I can stick variable to you again. This is a capital P PowerShell. Okay, we.

A

Want to use this.

B

To our benefit, I wanted to find here string on the fly based upon another variable. I have a little bit so I can do the same thing. I can change. I can pre-populate the the law and then change this at another time. We're pulling from somewhere else. I can say some give me all interactive services from that I think that's! Actually what we're doing here a given give application log define some random number or whatever the number.

A

I'm looking for.

B

Wearing my help there and now I can on the fly, so there's no reason why I couldn't redefine an event, filter and rerun XML each time and it's rebuilding the XML filter each time it runs through. Ok,.

B

So this is some of what I did again I'm just parsing out stuff. That's you know I'm scrubbing, but the whole point is that this is stuff that I use typically so I would do this. I would define use a couple of these to say: hey I can define my single system. Variable I can define a single circuiting. I can actually use some other query or somebody I'm getting partials of it or I can actually just build on the fly.

B

You know this actually one through eight so give me there's an index number, so they just build. The numbers go over one, two, three, four: five, six, seven, eight nine- and it gives me that so now I have an array of the server's that I have again using the same magic. We did before hey giving all the server's actually define what the current server is will give you the event logs, throw that XML filter above and actually did that.

B

So again, this is pre stage information, so I can't not actually talking there anymore, but I can step it down to an XML to event, and so here is live.

A

Data that was rubbed. So what was this I.

B

Don't remember what this event was, so this is I kind of wanted to put this in. Here too, this is stuff that I do on a normal face. You'll see some of my.

A

Stuff and I use on daily basis.

B

Looks like this is that you'll come here and okay I'll leave this line in there come here. Fa thanks, my friend, okay design. Here, hey give me the first one again, it's just a message. Oh well, that's look the actual message here to do too. Here's the actual message from that single event: the first one, all right, that's really what I was looking for and so all right. So now of all the events that came back to me, I went query dollars on nine servers came back.

B

We take the con that filter that we had, and so I come here. Alright, so the reason I do this is going hey. I find a server that potentially has an issue or also.

A

Is having some event well.

B

Now I can then use set up my XML filter I. Have my systems I can easily refine what that system list is and now come here. Take all the events. Here's my machine, ID, where's mine, all right I can do that. Hey a bunch of servers are having this problem. It's not just 158. If you 76, this is an issue. It's just a.

A

B

And then I hey, let me sort it by time created again we're still in the same ones: I'm gonna, sort things and I'm going to select the parts that I want and then go from there. I can even sort and then just make the whole list itself. So this isn't really like somewhat.

A

B

Of its practical, some of its not but the idea is that, if you're using one events and you're using PowerShell, you can get a lot of data from it. So the reason I typically do something like this is I just throw it out there is that I can then see that hey whatever this events, a number people is not just. Oh, it's only on certify all right.

B

Well, now, I'm, looking at that kind of problem, I'm looking at that kind of event and on Oh No, actually, every single server has one or two of them just like just systemically villains,.

A

B

That won't really care that whatever this is happening, but it now gives me more than more that information overall, so.

A

B

By doing by getting those events and getting just the parts that I want, I don't have to go clear. These I, don't the log into nine circles. Those look it's in those events, Scrolls role that yeah I would say: I got one or the next one scroll, Scroll scroll I got one I. Don't have to do that. I can easily jump every single one bill, the filter milking neck. How.

A

Many servers: will you query at a time using this, this type of technique.

B

As many as I need, so I've done this before and literally queried my entire environment. Oh it's a while and you get you get you.

A

B

Understand what you're doing so, you don't crush the environment. Try to pull that data back and that's where you know you really want to get.

A

B

About filtering really very angular.

A

B

That point, do you want to receive back 500 events per server out there or Google, not I, don't want any of that. I, don't want to know two events happen and then the other part is where you view your filter and filter left or right, where you want to do your filtering or do you want to do some aggregation on that server and.

A

B

Leave it there and then go pull this go, pull it later. I've done that as well. So some of the work I've done is is do all this filtering and then just dump it to a file that I'll go back and pick up.

A

B

So that we've done in the past to.

A

Get filter based on content. That's in the message! Oh the mark. Yes,.

B

Yes, and we will I- think that's this one coming up yes or it's in it's in one of these, so yes, so you can. You can build the event IP and think it's the next one yeah it's the next one, so we're back in that same world of so get one event. Security.

A

B

Is a particular ID I want only getting 100 it's reading. Some data I think this is live. I. Think I can do this.

B

Police or just log in events.

A

But why did I want to do this.

B

So we kind of see what we did before again, you kind of see what I'm doing with a I have in a single event, there's my system log and then think at this point. What I wanted to do is show that, depending upon the for like, if we go back to you, look at that reference from Ashton bone, he talked about all every single event. Log, every single event provider ends up, has its own format in its own template.

B

So just because you can write your own event log and write your own, you know sources kind of see it. Reference in that fashion is in, like, in the event event viewer. It's defined as a source yeah.

A

Source that was.

B

Brooklyn, the idea is that you can part you put in the of your own parts. I, don't know two of you. If you see this on other, um you may have seen it on some events. Is that it's like you know, there's no details here, just as unknown.

A

Unknown source, it's.

B

Not that thing I'm known sources, but but it can't represent the data properly because it's not an unknown source type, and you typically see that here. The description of this event is valid because there is no provider for it. This is a perfect example. They haven't defined what this is, but.

A

B

Actually has a detail so Windows the event log system doesn't have an accurate representation of what this is so there's going to defined format, template for the broker or docker server, so that you see this nice beautiful message, okay, but what's inside of it here, that's what they define out. That's the defined function, but this event is just throwing out two pieces of data.

B

It's just throwing these duties and the Event Viewer I, don't know what this is. It's just here's the data. So that's what you would see in the message but effectively um what was I trying to say here is that some types you'll get and you'll get a an event that has a type it doesn't that just has folks.

A

Back out as a the hash, I can explain that, and this is a really good example. Okay, the the login like the logon events are really good because the the message ID there, the message- data that you're seeing is basically just think of it as a form letter that's out there and all of us properties are required, values that get replaced the user ID the logon type domain. All of that stuff can vary system to system, but these are the values that get populated when the event fires.

A

So that's what you're doing is you're pulling that out and grabbing those events, the actual name and the data can vary by event, types and the different providers, but this is a way to expose that in the search for it yeah there.

B

You go. Thank you, so the idea that at this point is hey, here's the event type I'm looking for and at this point I still want to take this data and put it into a form that I can then play with. So we can do that same fun, magic that we do before take our event. Stick it into an XML and then reference out the second entry. The figure just did a cat. How I figured out which one hey I want processed name.

B

There's one two three find counted: I just counted until that's the number I want. That's the index. I want ft index I want and then what we turn into. We get back this okay. So now I get this. My process that so now I can then take this just like another. Any object that we work with in PowerShell. We can then take that and spit it back out. Wow I'm, so flow I didn't realize I'm just ago, so we're gonna speed this right up. Make us tell me to speed up. Remember.

A

Today, when you're, like I, don't know if I have enough contact.

A

In case I can't sir now.

B

A

B

A

B

I'm just talking trash anyway, so um you can also find it online. Ashlyn blown did this part, so the idea that hey I had to manually go here. The process I want but again we're dealing PowerShell we don't have to. We can go through this whole idea of I'm going to go through all the properties that are there, I'm going to count them and I just going to give me the name of the text.

B

So using that exact same thing, exactly we just did so these same events- and it now gives me this whole event list in a view so now I have a named property for each one of them and I can then export this out and do other things with it if I needed to now. This is not really valuable overall, but the idea is that there there is a mechanism to get me that I just grabbed to some random event. Do you have to use the index three?

B

You have to use the index effectively. What you're doing is dealing with XML. So in this case you have to use the index.

B

So the next thing get computer Microsoft log record count. What do we want to talk about here? I did the same thing. We want to reference a my primary role as a citrix administration, so I deal a lot with RDS and we deal with Terminal, Services and stuff, so this was used there I. Think of what I was using we're going to skip right over that, so somebody actually talked about or was asking about the idea. Can we can we filter upon parts inside the message?

B

So, if you are able to, then we can kind of see down here No. Let's do this. Okay, that's 1,000!

B

So application error. So this point, so here we go so I want to go pull upon pieces inside that inside there um I want to actually pull out that record. I wanted to say: hey, give me where that record and actually the way in which it's doing XPath it's using XPath. So you can look up XPath to do the searches.

B

That's why X star any record inside system where system is level two or if ends ID, equals that, and you can kind of see it back here, we're inside the event, data or event data or the data value or data is this, so it would match in if WDM EDAC is any one of these, so it would match this record. So you can then do some X past fun in order to get your data at that point, so you can do it that way. So I've used this in the past.

B

Tuesday tell me again what I've used this for is I predefined, a bunch of these XPath queries and then at that point I can then copy and paste them where I need to be and I can jump to and easily use that scroll down. Giving by giving my list of servers. I can use that over and over again and I have basically the entire description. Just like a control script go get. This chunk run that you'll get this chunk from that go check, uncheck and then jump around and I've done this in the same thing.

B

So this is the one this one here is expressly defined as ewm, but there's no reason why I couldn't say: hey define the property that I have.

B

You and go from there ERP now I'm going to jump right over that. So the idea is that hey I can give you my EAP where you know excel. You know hey, why is Excel crashing on the server, so we actually had this recently and the looking pay.

A

B

Had crazy working, crazy one I, don't know and then go look at the event log on with all these applications excels crashing well, what's happening with Excel I, don't know what's happening so and then global fine books been happening for five months. So that's not the problem. You know you find out it's winning across all the environments and some random dll's and you know happens to be some plugin that it just keeps crashing itself, but it's behind the scenes of throwing those air so that air I can absolutely ignore.

B

So it helps me in that fashion to go. Discover that hey we're so give me all the application events, log events that were not Excel. Here's now I can more easily do the reverse not just go. Get me find that well go get me all of it. That so give me all the events and then parse out the parts that I don't want. Oh.

A

The question was asked earlier: you're searching specifically through the message you have to do it they're aware of it, there's not a filter and it would've been. That would be based on part of the message.

B

No okay, so yeah, that's closer to the question, then no.

A

Well, you you can. If you build the XPath query correctly, you can find it. It helps if you have a very well structured provider. That's giving that to you, because you're going to have to know how to build it. Otherwise you're just going to get data and it can anything that could potentially have that value. So it makes it harder, but you certainly can yeah.

B

But it's done it's done directly through the XPath. You have to build the XPath yeah. Sorry I understand we're going to skip over some of this I'm gonna jump to this one. So this is another example in this prototype a good example of what I'm used. So the idea to some events, this particular event. If this is a logon event, okay, but the event it is actually it needs to actually say the.

A

B

Inside the event is actually the win or the CID user, so again, I kinda just want our references out. Is that hey? This is a capital P power show we have power here. Hey, but I can easily define the user name again then I can go get the city does I. Don't add to that now.

B

I have a variable that can just inject into my clients time query computer I want to clear upon, and so that was so that's just another example of how to build those expats excuse me filters, so you can use PowerShell to your benefit to build those on the fly.

B

What's this long time, warnings and errors that are critical, another one, just there's everything within that.

A

B

Really good as an example at this point we're not going to run into these because we're not live, but the idea that all right so give me all my servers. You guys think so. This is effectively we defined those X pass above and now I have I can use that same idea to I T. My my stuff out to data I take data. Is that what I'm looking for I can then sort by my time created I, select out the last 30 going? Is that really what I'm?

B

Looking for so I'm using some kind of pipeline and I'm running these lines, independently of each other, so I can then use PowerShell to its benefit? To get me the parts that I'm looking for and, of course, then we can use. You know, data to out grid view and I can do some fun and gooey form and if I need to something similar before here again we're doing effectively what we did before username building a sit on the fly.

B

This is bunch of the citric stuff. Give me my Zen app servers so I here again we're using Citrix we're using T's, be PowerShell on the fly to dynamically. Give me all the servers in my app environment. Okay, give me just a server name, so I can just execute the single line and I get all my servers that are currently active right now, and so it built on the fly so that when.

A

I come down here.

B

To line 70 to actually execute this code boom, now I'm doing it across my entire XenApp environment, not just the subset of it or a single server. In that regard, so Marcus, you asked about you know doing things in parallel: I used the PowerShell module on the invoke parallel, which does things in parallel, so you don't have to do for each one, two three, so it doesn't in parallel. So let's get then kind of talks about in the past.

A

That's the rambling, cookie cookie monster, one yeah coming.

B

A

B

Have it so one of the other things I want to point out here. It is inside of this basically script block for defining the parameter, doing some verbose stuff, but the first thing we're doing is again take the XPath we're doing our filter, we're defining the first last 50 logon events, log on and log off, so kind of see at this point, I'm one side and get all the events and on the fly, I actually start building my own object on the fly.

B

I just thought if it happens to be a 701, seven thousand one I create a log on property, the kind created so effectively. What I come out with is custom objects that define the user name computer, that they're on the time that this Windows felt either a log on our blog off happen and then a another property that it happens to be filled in for my logon or happens to be log off. So you get this hot pull chart of I have that is now hey who's logging in and who's logging off at what times.

B

So you can then usually look at this little chart on the fly. That's generated that says, hey I can see that this person logged in at this time and walked off at that time based upon those events, so this is really taking it to the next level. It's really tough to do on here, so I just wanted to show it so same kind of thing. It's giving my log on log off events, uh-huh.

A

This team of forensic man- that's cool, yeah cool, so this.

B

Is almost the exact same thing, but this is log on to disconnect reconnect and log off events. So again we're just query the security logs we're using the security logs and just all parsing from it yeah a lot of our events and then, if we do it exactly what we just did but slightly different, so we see again we're living a I would live in the Citrix environment, so people log on disconnect quite often and reconnect their session connected, then reconnect.

B

So this is pretty valuable that fashion and we're doing the exact same thing and then we're mostly in sizes, discussed an object. I stick to take my raw data, so if I can then stick it out using supplied to know and then I needed to actually get the raw security event log I have it I have, you know, beat mint log to the event itself, I, just stick it right back into the module, so I have that option.

A

B

A

Just when I scroll run for mustace pretty much done.

A

B

That's that's pretty much it. You know kind of I wanted to I, don't want to take up too much so everybody's trying my everybody as busy. So we want to look open up for questions and but.

A

B

Of jumped in to you for Gary, most of it yeah it's been pulled out. Yes, I will post most of this online, so I'll post it into our github. So three couple days of.

A

Finished ripping comments. Yeah. Do you look at any office, 365 I'm from a different made up office, 365 blogs, no.

B

But I don't know what's more of the question, is it well.

A

These are, these all seem to be local local um to individual machines and not up on the azure SharePoint under the covers that the SharePoint is a SharePoint site, a SharePoint instance that that people using for office, 365 and they've got their own logs and somebody actually questioned the person who was running the office. 365 meetup was talked about that headache.

A

I said you should come to the power show user group to play with that long I play with those lungs yeah to actually get in forget information and preserve them because they they after 90 days they that information is lost. Okay, so her problem was was lost, lost log data, uh-huh.

B

So she started pulling those logs off and that so.

A

B

A

Don't know I, don't know if and how she's solving the problem, but I thought when she described it. The power show would be a good well who created yeah.

B

Sounds feasible.

A

Yeah any questions on the phone line, I think.

B

A

Historical anyway, Windows is what.

B

Law, do you look for I've got a problem with VM connect for.

A

B

I just go message: equals.

A

Or message like VM.

B

Connect is that what I should do effectively you could, it would take a while, but you could, because you I, think you would have to you effectively. Could there's no reason why you couldn't just loop through all the logs that are available? Just like you saw here's the provider. If the log count is you know, you went through the first time to say: hey. Are there any events in the event log and if you'd want to do, you know, do some rough-looking, no reason to like looking at the video driver?

B

You know log if you're looking for a mentor is.

A

Probably quicker to Google stuff to get something to grab onto correct.

B

Yeah any we're.

A

Internet's down, what do you yeah.

B

A

I would just like to remind people, especially people who have come here for the first time or online for the first time, so obviously has an expertise in this area and that expertise comes from years of searching and building upon basics. So remember, if you watch this tonight, we went from 0 to 100 in literally an hour and could be very overwhelming computer with trying to defeat life. So what I suggested to basic amounts? Get a vampire get win event, practice doing simple searches when you have good at one, do the same searches if you.

B

A

Go down the 50s path, yet don't do the complex stuff, because what you're going to do is get yourself frustrated and then you're going to end up going back to the gooey event line. There were two basic searches when you get very comfortable of those and on alert tonight.

A

The films of first I will show here, because you see as you layer and as you get more comfortable with these, you can become very complex, very quick, but the idea is is that when data comes back, you doesn't work out the way you expect you need to understand what has been happening in order for you to correct the issue and if you just jump right with those serve, Sherman is cool thing, I copy it all I hit paste and I just got a bunch of red I.

A

Don't want to do that's like saying if you're joining our group first time, we're always going to have stuff like this, where code should be deep, sometimes will be on whole live it. The idea is that these are supposed to be idea, standards and reference points. That's why we record them. So you can go back and look at them a hundred and fifty times and maybe run by living, a super search guy like like so and don't you get children who's doing this conversation for two months.

A

You got time to put this together, we'll make it work the exactly where I want I'm sure he hit you we're back as well. You have to blow up fundamentals and a.

B

Lot of immediate.

A

Moral stuff and the fundamentals only gets done well of doing, and your Pete idli so that you can do it in your sleep start with something that gives you confidence then add on to it. Don't go right to the end of this presentation and say I'm going to do this trade next, a search against mine hunt and serving I'm going to stop by right, but my phone is always going to be stuff that goes over our head and becomes at these presentations.

A

It's not making anybody feel intimidated instead, show you what you can do with practice and home and all I want to be ideal started. So if it's your first time don't get intimidated as Joanna stupid evil. It's really not showcasing things. This is a not education. Person's like I'd, build and I run an MRI had an expert or even an intermediate. It's going to show you what you can do with time, but yeah.

B

And I hope that you know I I.

A

B

Took some time to try- and you know, I've seen two presentations where they just okay well here it is, but the idea that hey there's a reason why, on the screen is like a person you're giving out my application and then I, added and and I purposely write some stuff into my own code, so that I do it and you kind of see I think I did it down here. Is that hey you can see?

B

I did give me the first one in the list now I'm going to jump, I'm gonna jump this problem down into really small part, and once I have this small part. Well now, I know what I'm gonna do with this one and then what do I do to get to the next line? The next line is well now. How do I expand it to two of them and then you kind of see it here. Hey give me the first one for my list.

B

Okay, now I have knowing and I know exactly what I have this one item is this: what I'm looking for? Is this not what I'm looking for what is it I'm?

B

Looking for inside of here and I kind of tried to talk about that too, is that I came in here and going okay, which part of the data do I want, and at that point well effectively, you know you could have just taken it and just left it outside of XML and just give me the message you could have done just that and then just dump it to a CSV and then now you're attacked on. Why you're in Excel and playing with just like text, searches with that one. That's that that helps you!

B

That's absolutely look! That's all you need at the moment, and it's also exactly what you need at the moment. So there are times when I don't do all this cuz. That's not what I need, just whatever you need at the moment. So.

A

That means you do get a bit less I'm done. Yeah.

B

Yeah, you certainly don't do this, because this is you use this now it so in the in that same fashion. So I did just that the other day so I kind of tried to talk about this. Is that hey you haven't? You know these people are reporting these crashes. Things are happening and you come here you're on this particular server. You come in here and go hey I come here, administrative event, so I use it all the time. Good, hey just strolling. Through all events, hey, there's an error application. What is this application error? Well,.

A

B

Excel well, what's the next one well that one's DWDM, okay, maybe I, thought that one keep going and then well so then I then take that moment and because I going well can I figure out how many of them are just this well not easily in a GUI. Well, then, I jump down the power shell, so that I can get more detail on all I can get details and aggregate, but again I, don't know how to do that. Aggregate Commission I would then start exactly where I did start here, giving one of them.

B

What part of that one event do wonder, am I looking for and then how do I then move to the next one, and then it's kind of repetitive in fashion that we use this for parsing of the for each and go through the loops. You know effectively here's before each and then I build a single XML from that one and then I just build another object from that one.

B

So all little parts, individual discrete components to then chain them together and that's what I think is the beauty in the power of PowerShell is the idea that it should be small little parts. You chain a bunch of small parts together in order to get the final product- and you know some things: hey I want to put all these pieces and it's a huge one-liner. Well that may not be valuable to be just single one-liner and the ideas I pay. You should be a one-liner with like 15 pipes.

B

That's how I see a one-liner go so.

A

Before you made the comments goggle it, which is obviously many people, do it all in my organization, we're on a small server team and I happen to be supposedly the PowerShell expert Internet is far from the truth, but on my team, people come to me for answers yet I, don't always know the answers and I get frustrated because I can. In fact it's off.

A

Someone is up someone else's problem, that's great, but when I have a problem, I don't have anybody to turn to the point I'm trying to make is we have a PowerShell flat channel but Raleigh, but the PowerShell frack channel is a fantastic community. There's 500 plus people on there. Some of the guys in the chat today are active on that community. You literally can ask questions of Microsoft PF EES experts in the field, and there is there is no animosity there. People are just happy to help.

A

So if you are looking for resources along with Google, along with the Mex of help documents that are awesome, Microsoft online help backs, you really should be in the PowerShell slack community. There's a really a great community people that are willing to help those. You can get over your fear to ask a question: yeah.

B

It's really easy to get, there's its slack top posh code.org and there's an invite. You click on an invite. If you get an email, it says: hey you're, you join and then done so.

A

B

How you get on is slack posh code.org, so Joe Bennett set it up, so it will automatically send you an invite, but slack is invite only well. It just automatically invites you so put in your email. You get an invite and then you'll. Then you can join the channels as see fit where Raleigh has one most one. Just.

A

Work might have one, but there's also a help channel a bridge channel. There's a there's lots.

B

Of brands out there, but you could just ask and if.

A

You don't remember links you can always email. One of us would be happy to invite anybody who wants to.

B

Join we're asked.

A

B

A

B

Happy to pass you on and I think we're kind of done if you have any other questions or even other topics in kind of things that we want to talk about, I think we'd, certainly you know entertain it. You know any other questions on the phone or the web, so.

A