Tom Lasswell

technology executive leadership

PowerShell

PowerShell: Connect to LogicMonitor’s REST API

By · · Updated · 1 min read

Originally published on TechColumnist.

It’s been a while since I’ve posted. Way too long. I’ve had this script for quite a while that I wanted to share with the world. LogicMonitor is releasing a new REST API which requires some session based login. This script helps you obtain that session and download the audit log for the last hour. The start time is calculated in UTC, so no timezone settings need changing.

Requirements

  • Windows PowerShell 3.0 or later (Invoke-RestMethod).
  • A LogicMonitor user that is allowed to read the access (audit) logs.
  • HTTPS access to <account>.logicmonitor.com.

Parameters

The script takes no parameters. Edit these values before running it.

NameTypeRequiredDescription
$userStringYesLogicMonitor username. Replace <username>.
$passStringYesPassword for that user. Replace <password>.
<account>StringYesYour LogicMonitor account (portal) name, in the $uri host name.
$hoursIntNoHow many hours back the audit log starts. Defaults to 1.
$filterStringNoAccess log filter. Defaults to _all~update; see the LogicMonitor documentation.
$fieldsStringNoComma-separated fields to return. Defaults to username,happenedOnLocal,description.

Usage

Edit the variables at the top of the script, then run it.

powershell
.\Get-LogicMonitorAuditLog.ps1

To keep the result, redirect the output to a file.

powershell
.\Get-LogicMonitorAuditLog.ps1 | Out-File .\logicmonitor-audit.txt

Script

powershell
<#
.SYNOPSIS
    Downloads the LogicMonitor audit (access) log for the last hour through the REST API.
.DESCRIPTION
    Builds the start time as UTC epoch seconds, builds a Basic authentication
    header from the user name and password, and calls the /santaba/rest/setting/accesslogs endpoint of
    your LogicMonitor account. The events are returned with the username, local time and description
    fields and displayed.
.EXAMPLE
    .\Get-LogicMonitorAuditLog.ps1
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.1 (2026-09-20)
    History : 1.0 2016-02-22 Initial version.
              1.1 2026-09-20 Start time is computed in UTC instead of a fixed EST offset;
                  removed the unused end time.
    Requires: Windows PowerShell 3.0+ (Invoke-RestMethod), a LogicMonitor user with access log rights
#>
$user = "<username>"
$pass = "<password>"

# How many hours back to read the audit log.
$hours = 1

# Get the start time as UTC epoch seconds, rounded to not have decimals.
$epoch = New-Object DateTime 1970, 1, 1, 0, 0, 0, ([DateTimeKind]::Utc)
$epochStart = [math]::Round(((Get-Date).ToUniversalTime().AddHours(-$hours) - $epoch).TotalSeconds)

# Check the LogicMonitor documentation on filters.
$filter = "_all~update"
$fields = "username,happenedOnLocal,description"

# Build the URI for the access logs.
$uri = "https://<account>.logicmonitor.com/santaba/rest/setting/accesslogs?sort=-happenedOn&filter=$filter,happenedOn>:$epochStart&fields=$fields"

# Build the base64 authentication string for the header.
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $user, $pass)))

# Get the events.
$events = Invoke-RestMethod -Headers @{Authorization = ("Basic {0}" -f $base64AuthInfo)} -Uri $uri

# Display the events that were gathered.
$events

Notes

  • Update 2026-09-20 (v1.1): the start time used to be the local time plus a hard-coded 4 hours (EST, and wrong during daylight saving), and an end time was calculated but never used. The start is now computed in UTC from $hours, so it works in any timezone.

Keep reading