App-V 5 – Troubleshooting the Client using the Event Logs
Hi all,
The App-V event log holds lots of great information but the challenge you my face is you have to jump between logs to figure out what actually happened on the client if errors occur.
There are 3 default logs that you can use when troubleshooting, they are the Admin, Operational and Virtual Applications log.
The challenge with having three logs is that you have to look into them individually, you can’t see them all together unless you are using logman tracing.
https://blogs.technet.microsoft.com/virtualshell/2016/05/16/app-v-5-0-etw-tracing-automation-update/
Following on from a post I did about the Operational Log, there are times where when you collect event log information you don’t want to collect certain events that create “noise” in your trace, these were explaining in the following post.
https://blogs.technet.microsoft.com/virtualshell/2016/04/12/app-v-5-operational-log-usage/
The post above explains the filter to remove the streaming events, with the App-V 5.1 client there are some new event ids which are quite chatty so they have been included below:
So you know how to do a filter manually using the GUI but how about via script? With PowerShell there is a cmdlet which collects event log information which is called “Get-WinEvent” and it has a great parameter called “-FilterXml” and its explained below.
-FilterXml
Uses a structured XML query to select events from one or more event logs.
To generate a valid XML query, use the Create Custom View and Filter Current Log features in Event Viewer. Use the items in the dialog box to create a query, and then click the XML tab to view the query in XML format. You can copy the XML from the XML tab into the value of the FilterXml parameter. For more information about the Event Viewer features, see Event Viewer Help.
Typically, you use an XML query to create a complex query that contains several XPath statements. The XML format also allows you to use a "Suppress" XML element that excludes events from the query. For more information about the XML schema for event log queries, see the following topics in the MSDN (Microsoft Developer Network) library.
-- "Query Schema": https://go.microsoft.com/fwlink/?LinkId=143685
-- "XML Event Queries" in "Event Selection": https://go.microsoft.com/fwlink/?LinkID=143608
To use the filter using Get-WinEvent you need to get the XML you want to use, so if you create your filter in Event Viewer and then select the “XML” tab you can see the generated XML with the filtering out of Operational Log event IDs (14023,14024,14025,14026,101,102) and its filtering on the last 24 hours of logs.
So you have your filter you can now use Get-WinEvent to collect the Operational Log information with the filter set.
$FilterXML_Operational = @"
<QueryList>
<Query Id="0" Path="Microsoft-AppV-Client/Operational">
<Select Path="Microsoft-AppV-Client/Operational">*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
<Suppress Path="Microsoft-AppV-Client/Operational">*[System[(EventID=101 or EventID=102 or EventID=14023 or EventID=14024 or EventID=14025 or EventID=14026)]]</Suppress>
</Query>
</QueryList>
"@
Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue
Note: I’ve used the -ErrorAction SilentlyContinue due to the fact that if there is no information it will display an error stating there are no events.
To expand this to the Admin Log and Virtual Applications log the following code can be used:
$FilterXML_Admin = @"
<QueryList>
<Query Id="0" Path="Microsoft-AppV-Client/Admin">
<Select Path="Microsoft-AppV-Client/Admin">*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
"@
Get-WinEvent -FilterXml $FilterXML_Admin -ErrorAction SilentlyContinue
$FilterXML_VirtApps = @"
<QueryList>
<Query Id="0" Path="Microsoft-AppV-Client/Virtual Applications">
<Select Path="Microsoft-AppV-Client/Virtual Applications">*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
"@
Get-WinEvent -FilterXml $FilterXML_VirtApps -ErrorAction SilentlyContinue
Now we have all three event you can join these together and sort them by “TimeCreated” so that it shows them in chronological order.
$GWE_All = Get-WinEvent -FilterXml $FilterXML_Admin -ErrorAction SilentlyContinue
$GWE_All += Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue
$GWE_All += Get-WinEvent -FilterXml $FilterXML_VirtApps -ErrorAction SilentlyContinue
$GWE_All | sort TimeCreated -Descending
This will output the following data:
It’s great to show this in PowerShell but did you notice that only four column properties have been specified in the output to screen? What if you want more data from the event log to be shown?
You can run the Get-WinEvent command with the Get-Member switch which will show all the properties available on the object:
Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue | get-member
This will show all the properties that you can use on the output.
To specify the properties that you want to output you need to select the objects that you require, for demo purposes I’ve used the following:
$GWE_All | select TimeCreated,Id,LogName,TaskDisplayName,LevelDisplayName,Message
Now we have all the properties available there are better ways of formatting the output, you may like Out-GridView or ConvertTo-Html so I’ve included them both in the script below.
<#
.DISCLAIMER The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.
#>
# Adding threading culture change so that get-winevent picks up the messages, if PS culture is set to none en-US then the script will fail
[System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"
$FilterXML_Admin = @"
<QueryList>
<Query Id="0" Path="Microsoft-AppV-Client/Admin">
<Select Path="Microsoft-AppV-Client/Admin">*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
"@
$GWE_All = Get-WinEvent -FilterXml $FilterXML_Admin -ErrorAction SilentlyContinue
$FilterXML_Operational = @"
<QueryList>
<Query Id="0" Path="Microsoft-AppV-Client/Operational">
<Select Path="Microsoft-AppV-Client/Operational">*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
<Suppress Path="Microsoft-AppV-Client/Operational">*[System[(EventID=101 or EventID=102 or EventID=14023 or EventID=14024 or EventID=14025 or EventID=14026)]]</Suppress>
</Query>
</QueryList>
"@
$GWE_All += Get-WinEvent -FilterXml $FilterXML_Operational -ErrorAction SilentlyContinue
$FilterXML_VirtApps = @"
<QueryList>
<Query Id="0" Path="Microsoft-AppV-Client/Virtual Applications">
<Select Path="Microsoft-AppV-Client/Virtual Applications">*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
"@
$GWE_All += Get-WinEvent -FilterXml $FilterXML_VirtApps -ErrorAction SilentlyContinue
$GWE_All = $GWE_All | sort TimeCreated -Descending
#################
# Out-GridView
#################
$GWE_All | select TimeCreated,Id,LogName,TaskDisplayName,LevelDisplayName,Message | Out-GridView
#################
# Convertto-Html
#################
# HTML output path and name
$HTML_Output = "c:\temp\allEL.html"
# Style Sheet for HTML Report
$CSS = "<style>"
$CSS = $CSS + "BODY{background-color:white;font-family:Arial;}"
$CSS = $CSS + "TABLE{border-width: 1px;border-style: solid;border-color: #00668a;border-collapse: collapse; font-family:Arial; font-size:12px;}"
$CSS = $CSS + "TH{height: 20px;border-width: 1px;padding: 0px;border-style: solid;border-color: #00668a;background-color:#00668A; color:white; font-size:12px;}"
$CSS = $CSS + "TD{border-width: 1px;padding: 4px;border-style: solid;border-color: #00668a;background-color:PaleBlue; vertical-align:top;}"
$CSS = $CSS + "</style>"
$GWE_All | select TimeCreated,Id,LogName,TaskDisplayName,LevelDisplayName,Message | ConvertTo-Html -head $CSS -body "<H3>All App-V 5 Event Logs</H3>" | Out-File "$HTML_Output"
invoke-item $HTML_Output
Out-GridView will be displayed like this:
ConvertTo-Html will show something like this:
SCRIPT DISCLAIMER
The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.
This helps us internally troubleshoot the App-V 5 client as it allows us to see everything in a single view, so I hope it helps you as well.
David Falkus | Senior Premier Field Engineer | Application Virtualization, PowerShell, Windows Shell