In this article, I introduce the topic of reading session data from memory along with some of the pitfalls and some words of caution.
Month: October 2015
Better Practices for Reading Event_file Targets
In this article, I am going to address some better practices for Reading Event_file targets attached to an XEvent Session.
Dynamically Read event_file Data
There needs to be a more efficient means of grabbing the file without having to know the location. Knowing the session name should be adequate enough to parse the payload data from the target. This is exactly what I am going to show in this article – retrieving the file and path based strictly on the name of the session.
Auditing Needs Reporting
No matter the mechanism used to capture the data to fulfill the “investigation” phase of the audit, if the data is not analyzed and reports generated, then the audit did not happen. With that in mind, I settled on a quick intro in how to get the audit data in order to generate reports.
Intro to Reading Event_File Target Data
The event_file target is an asynchronous consumer for Extended Events. This target stores the received payload in a proprietary binary format. Because of this, one needs to use the sys.fn_xe_file_target_read_file function. This article will discuss this function and show how to use it in its simplest form.
Simplified Session Backups
I have demonstrated how to backup a deployed session to a script previously. In this article I demonstrate how to create Simplified Session Backups.
Deployed Target Metadata with PoSH
This article shows a deeper dive that will show how to expose the Deployed Target Metadata with PoSH and familiarity with this powerful tool.
Deployed Action and Predicate Metadata with PoSH
This article shows a deeper dive that will show how to expose the Deployed Action and Predicate Metadata with PoSH and familiarity with this powerful tool.
Exposing Deployed Event Metadata with PoSH
Now that some of the basics concerning how to access Extended Events via PowerShell have been covered, it is appropriate to start digging in a little deeper. This deeper dive will continue in the direction of Exposing Deployed Event Metadata with PoSH and familiarity with this powerful tool.
Extended Event Management Power Tools
PowerShell can pack a pretty big punch when dealing with Extended Events. Using PowerShell as one of your Extended Events Management Tools, there could be a bit of a learning curve, and it may not be the right tool all the time, but it can sure pack a big hit.