Octopus Events Audit Script by Time Frame -- Example

[DocOck (Alex)]

Hi Octopus support,

I was reviewing one of your support tickets:

Continuous Audit log exported into Splunk?

Is their a way to export a live continuous (constant refresh) audit log with the paremeters “any user,any project,any environment” into a file which we can then use splunk to accept ? This would be for an enterprise wide logging tool.

I see there was a PowerShell script posted by one of your members:
https://gist.github.com/Dalmirog/1b5bd23938d0e1da5014 3
Get-OctopusEvents.ps1

But the full script wasn’t posted–there is link, which is broken unfortunately:

Get-OctopusEvents.ps1

Function Get-OctopusEvents ([datetime]$From,[datetime]$To,[string]$OctopusAPIKey,[string]$OctopusURL){

    $fromStr =  ($from).ToString("yyyy-MM-ddTHH:mm:ss")
    $toStr = ($to).ToString("yyyy-MM-ddTHH:mm:ss")

    $header = @{ "X-Octopus-ApiKey" = $OctopusAPIKey }
    $events = @()
    $skip = 0

    do{

Do you have another example of this script or another that performs a similar function in retrieving certain events with a specified from and to date? I am having trouble putting one together that retrieves a specific Library Variable Set and checks if changes were made every 1 hour.

I did get a version of the script to work, but the default check goes back a month. The other option I am using is the built-in subscriptions based on the Audit log (but your Audit logs cannot specify specific library variable sets–it grabs everything).

Using Octopus v2019.3.8

Thanks,
Alex

[jeremy.miller]

Hi Alex,

Thanks for reaching out. Unfortunately, that link is dead as it wasn’t posted to our github, but an individual user’s.

I did find one in our repository that seems to serve the same purpose.

FindByDate.ps1

Please let me know if that will work for you or if you need further help.

Thanks,
Jeremy

[DocOck (Alex)]

Thanks Jeremy. I will review this one and see if I can merge it with my existing script.