Enterprise Admins.org

I recently helped out on a project where DNS services were being moved to different hosts with new IP addresses. After updating the DHCP scope options and static DNS configuration settings on all servers, the team turned on DNS logging to look for any hosts still using the old DNS servers. The logs contained a lot more records than originally anticipated, so I wrote the following code to help summarize the logs.

This first block of code found all of the DNS queries that didnt come from domain controllers, manipulated the log file entry to get just the source IP and stored all the results in a collection named myResults.

# Create a pipe separated list of domain controllers
$listOfDCs = "192.168.0.40|192.168.5.20|192.168.10.60"
$loopbackIPv6 = [regex]::Escape("::1")
 
$myResults = @()
Get-Content e:\dnslogs\dns.log | ?{$_ -match ' PACKET  ' -and $_ -match "UDP Rcv " -and $_ -notmatch $listOfDCs -and $_ -notmatch $loopbackIPv6} | %{
  $sourceIP = (($_ -split("UDP Rcv "))[1] -split(" "))[0]
  $myResults += New-Object psobject -Property @{
    SourceIP = $sourceIP
    FullLine = $_
  } # end new object
} # end dns log loop

Once we rearranged the data so that it would be more usable, we wanted to find the source IP addresses responsible for the majority of the lookups. The idea here is that once you resolve the issue with these hosts, you can recreate the DNS log file and the next pass through will contain fewer entries and therefor run faster. Using powershell this is a pretty quick one liner after you run the block of code above.

$myResults | Group-Object -Property SourceIP | Sort-Object Count -Descending

That is helpful, but the team really wanted to know host name. Using the data from host naming convention, they could tell what team would be responsible for resolution of the issue. With just a few more lines of code we can easily return that information too.

# Since server guys are more likely to know host names than IP address, we will loop through the resutls and
# lookup the host name, then sort the list to find the largest number of lookups
$myResults | Group-Object -Property SourceIP | Sort-Object Count -Descending | %{
  $sourceName = try { [system.net.dns]::GetHostByAddress($_.Name).HostName } catch { "UNKNOWN" }
  New-Object psobject -property @{
    HostName = $sourceName
    IP = $_.Name
    Count = $_.Count
  }
}

Every now and then I get a simple script idea in my email, like this one from a couple weeks ago:

Do you have any way of getting server name from the attached list of IPs?

This is a pretty simple request, and there are probably thousands of possible solutions, but I threw together a quick function that accepts an IP Address as a string and returns the IP address and a host name… like this:

Function Get-HostName ([string]$ipAddress) {
  New-Object psobject -Property @{
    IPAddress = $ipAddress
    HostName = try { [system.net.dns]::GetHostByAddress($ipAddress).HostName } catch { "UNKNOWN" }
  }
}

That’s almost a solution… the only thing remaining would be to read in the text file, call the function for each line and then export the results. That can all be done in one line of code, but I put in some line breaks to make it easier to read:

Get-Content ipList.txt | 
%{ Get-HostName $_ } | 
Export-Csv MyIPsExport.csv -NoTypeInformation

As most people know, Microsoft releases patches on the second Tuesday of the month. In some organizations these patches are deployed to development, test and QA systems within a couple of days of the release. However, production systems can’t be patched until the next maintenance window. Assuming this patch window is on a Saturday, we need to find the first Saturday after the second Tuesday. When looking at a calendar this is pretty simple for most people to figure out. However, when you need a whole years worth it takes a few minutes to calculate. What we need is some code to look these up for us…like this function:

Function Get-WsusSaturday {
 param([datetime]$date=(Get-Date) ) 
 $numberOfTuesdays=0 
 
  1..([datetime]::DaysInMonth( $date.year , $date.month )) | %{ 
   $thisDate = Get-Date "$($date.month)/$($_)/$($date.year)"
   if ([string]$thisDate.DayOfWeek -eq 'Tuesday') {
    $numberOfTuesdays++ 
    if ($numberOfTuesdays -eq 2) {  
     $thisDate.AddDays(4).ToLongDateString() 
    }
   }
 }
}

Line 2: accept the date as a parameter and cast it to a date/time value, defaulting to today’s date if nothing is provided
Line 3: max sure we don’t think its Tuesday already
Line 5: starting on the first of each month, loop through the max number of days in the month
Line 8: if the date is Tuesday, add one to the counter
Line 9: once we find the second Tuesday
Line 10: add 4 more days to find the following Saturday and return the date text

You can take this function and do something creative, like find the next 5 years worth of patch Saturdays.

13..18 | %{
  $year = $_
  1..12 | %{ Get-WsusSaturday "$_/1/$year" }
}