Get-TSTMGMTLogsEvent
List of events that occurred within all devices
Written by
Last published at: December 12th, 2022List of events that occurred within all devices
SYNTAX
DESCRIPTION
Audit of events recorded within each device that is connected to a Managament Server. The list of collected events depends on the initial configuration of what events will be collected, if not all.
EXAMPLES
1. Retrieve Connect and Disconnect events for one device using -DeviceIds parameter. The Event Types list is found at the bottom of this article.
Get-TSTMGMTLogsEvent -DeviceIds 'e01c6763-983a-4c17-b415-611bc31cbe44' -EventTypes 1,2
PARAMETERS
-Device
Filters all events connected to one device.
| Type: | ThinScale.Management.DataObjects.Device |
| Required: | No |
| Accept Pipeline Input: | Yes |
-DeviceIds
Retrieves filtered events based on ObjectIds of one or more devices.
| Type: | GUID |
| Required: | No |
| Accept Pipeline Input: | Yes |
-DeviceNames
A comma delimited list of filtered events based on one or more Devices using their fully qualified names.
| Type: | String |
| Required: | No |
| Accept Pipeline Input: | No |
-DevicePks
A comma delimited list of events based on DevicePk database entries.
| Type: | Int32 |
| Required: | No |
| Accept Pipeline Input: | No |
-MaxResults
A maximum number of latest results by date and time.
| Type: | Int |
| Required: | No |
| Accept Pipeline Input: | No |
-Start
The date and time of the Access Policy results used when you want to specify a starting date to show results from that point onwards in time.
| Type: | DateTime |
| Required: | No |
| Accept Pipeline Input: | No |
-End
The date and time of the Access Policy results used when you want to specify an ending date to show results until that point in time.
| Type: | DateTime |
| Required: | No |
| Accept Pipeline Input: | No |
-EventTypes
A comma delimited list of audit log types to get results for.
| Type: | Int |
| Required: | No |
| Accept Pipeline Input: | No |
-Force
If multiple objects are found with the same name, the first retrieved will be used otherwise the call will fail
| Type: | SwitchParameter |
| Required: | No |
| Accept Pipeline Input: | No |
-Interface
The interface ID returned by a previously successful call to Connect-TSTMGMTServer. This parameter is only required if you are connected to 2 or more Management Platform instances at the same time. If this parameter is not specified the connection to the last successful call to Connect-TSTMgmtServer will be used.
| Type: | Guid |
| Required: | No |
| Accept Pipeline Input: | No |
-Timeout
The time allowed in milliseconds for the call to complete before it is deemed to have timed out and is aborted
| Type: | Int32 |
| Required: | No |
| Accept Pipeline Input: | No |
INPUTS
ThinScale.Management.DataObjects.Devices
OUTPUTS
ThinScale.Management.DataObjects.String
LIST OF EVENT TYPES
| Event Name | Event Type |
| DeviceInventory | 0 |
| Connect | 1 |
| Disconnect | 2 |
| Lock | 3 |
| Unlock | 4 |
| UnlockAttemptFail | 5 |
| GuiStart | 6 |
| GuiEnd | 7 |
| DeviceLogin | 8 |
| DeviceLogoff | 9 |
| ConnectorLogin | 10 |
| ConnectorLogoff | 11 |
| ConnectorResourceList | 12 |
| ConnectorErrors | 13 |
| ResourceLaunch | 14 |
| ResourceEnd | 15 |
| ResourceLaunchFail | 16 |
| ActiveProfile | 17 |
| BrowserLinkSelect | 18 |
| LDAPPasswordChange | 19 |
| PowerAction | 20 |
| SecurityCenterStatus | 21 |
| WindowsUpdateStatus | 22 |
| WindowsFirewallStatus | 23 |
| WifiAdapterStatus | 24 |
| VMDetectionStatus | 25 |
| ProcessActionApply | 26 |
| ProcessActionRelease | 27 |
| LocalApplicationLaunch | 28 |
| AEPAllow | 29 |
| AEPDeny | 30 |
| SessionActionApply | 31 |
| SessionActionRelease | 32 |
| SEPStop | 33 |
| SEPNotify | 34 |
| ValidationToolResult | 35 |
| DeviceInventoryInstalledWindowsUpdate | 36 |
| UrlBocked | 37 |
| USBDeny | 38 |
| SE{Start | 39 |
| AMPBlocked | 40 |
| DEPBlocked | 41 |
| AuthSuccess | 42 |
| AuthFail | 43 |