[{"data":1,"prerenderedAt":789},["ShallowReactive",2],{"post:\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api\u002F":3},{"post":4,"newer":740,"older":748,"related":758,"series":787},{"id":5,"title":6,"body":7,"canonical":719,"categories":720,"date":723,"description":724,"extension":725,"featured":726,"hero":727,"image":727,"meta":728,"navigation":395,"path":729,"readingTime":202,"seo":730,"series":727,"seriesOrder":727,"sites":731,"source":733,"stem":734,"tags":735,"updated":737,"url":738,"__hash__":739},"blog\u002Fblog\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api.md","PowerShell: Connect to LogicMonitor’s REST API",{"type":8,"value":9,"toc":712},"minimark",[10,14,19,41,45,48,182,186,189,210,213,241,245,696,700,708],[11,12,13],"p",{},"It’s been a while since I’ve posted. Way too long. I’ve had this script for quite a while that I wanted to share with the world. LogicMonitor is releasing a new REST API which requires some session based login. This script helps you obtain that session and download the audit log for the last hour. The start time is calculated in UTC, so no timezone settings need changing.",[15,16,18],"h2",{"id":17},"requirements","Requirements",[20,21,22,31,34],"ul",{},[23,24,25,26,30],"li",{},"Windows PowerShell 3.0 or later (",[27,28,29],"code",{},"Invoke-RestMethod",").",[23,32,33],{},"A LogicMonitor user that is allowed to read the access (audit) logs.",[23,35,36,37,40],{},"HTTPS access to ",[27,38,39],{},"\u003Caccount>.logicmonitor.com",".",[15,42,44],{"id":43},"parameters","Parameters",[11,46,47],{},"The script takes no parameters. Edit these values before running it.",[49,50,51,70],"table",{},[52,53,54],"thead",{},[55,56,57,61,64,67],"tr",{},[58,59,60],"th",{},"Name",[58,62,63],{},"Type",[58,65,66],{},"Required",[58,68,69],{},"Description",[71,72,73,93,110,128,147,165],"tbody",{},[55,74,75,81,84,87],{},[76,77,78],"td",{},[27,79,80],{},"$user",[76,82,83],{},"String",[76,85,86],{},"Yes",[76,88,89,90,40],{},"LogicMonitor username. Replace ",[27,91,92],{},"\u003Cusername>",[55,94,95,100,102,104],{},[76,96,97],{},[27,98,99],{},"$pass",[76,101,83],{},[76,103,86],{},[76,105,106,107,40],{},"Password for that user. Replace ",[27,108,109],{},"\u003Cpassword>",[55,111,112,117,119,121],{},[76,113,114],{},[27,115,116],{},"\u003Caccount>",[76,118,83],{},[76,120,86],{},[76,122,123,124,127],{},"Your LogicMonitor account (portal) name, in the ",[27,125,126],{},"$uri"," host name.",[55,129,130,135,138,141],{},[76,131,132],{},[27,133,134],{},"$hours",[76,136,137],{},"Int",[76,139,140],{},"No",[76,142,143,144,40],{},"How many hours back the audit log starts. Defaults to ",[27,145,146],{},"1",[55,148,149,154,156,158],{},[76,150,151],{},[27,152,153],{},"$filter",[76,155,83],{},[76,157,140],{},[76,159,160,161,164],{},"Access log filter. Defaults to ",[27,162,163],{},"_all~update","; see the LogicMonitor documentation.",[55,166,167,172,174,176],{},[76,168,169],{},[27,170,171],{},"$fields",[76,173,83],{},[76,175,140],{},[76,177,178,179,40],{},"Comma-separated fields to return. Defaults to ",[27,180,181],{},"username,happenedOnLocal,description",[15,183,185],{"id":184},"usage","Usage",[11,187,188],{},"Edit the variables at the top of the script, then run it.",[190,191,196],"pre",{"className":192,"code":193,"language":194,"meta":195,"style":195},"language-powershell shiki shiki-themes github-light",".\\Get-LogicMonitorAuditLog.ps1\n","powershell","",[27,197,198],{"__ignoreMap":195},[199,200,203,206],"span",{"class":201,"line":202},"line",1,[199,204,40],{"class":205},"sgsFI",[199,207,209],{"class":208},"sYu0t","\\Get-LogicMonitorAuditLog.ps1\n",[11,211,212],{},"To keep the result, redirect the output to a file.",[190,214,216],{"className":192,"code":215,"language":194,"meta":195,"style":195},".\\Get-LogicMonitorAuditLog.ps1 | Out-File .\\logicmonitor-audit.txt\n",[27,217,218],{"__ignoreMap":195},[199,219,220,222,225,229,232,235,238],{"class":201,"line":202},[199,221,40],{"class":205},[199,223,224],{"class":208},"\\Get-LogicMonitorAuditLog.ps1",[199,226,228],{"class":227},"sD7c4"," |",[199,230,231],{"class":208}," Out-File",[199,233,234],{"class":205}," .\\logicmonitor",[199,236,237],{"class":227},"-",[199,239,240],{"class":205},"audit.txt\n",[15,242,244],{"id":243},"script","Script",[190,246,248],{"className":192,"code":247,"language":194,"meta":195,"style":195},"\u003C#\n.SYNOPSIS\n    Downloads the LogicMonitor audit (access) log for the last hour through the REST API.\n.DESCRIPTION\n    Builds the start time as UTC epoch seconds, builds a Basic authentication\n    header from the user name and password, and calls the \u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs endpoint of\n    your LogicMonitor account. The events are returned with the username, local time and description\n    fields and displayed.\n.EXAMPLE\n    .\\Get-LogicMonitorAuditLog.ps1\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.1 (2026-09-20)\n    History : 1.0 2016-02-22 Initial version.\n              1.1 2026-09-20 Start time is computed in UTC instead of a fixed EST offset;\n                  removed the unused end time.\n    Requires: Windows PowerShell 3.0+ (Invoke-RestMethod), a LogicMonitor user with access log rights\n#>\n$user = \"\u003Cusername>\"\n$pass = \"\u003Cpassword>\"\n\n# How many hours back to read the audit log.\n$hours = 1\n\n# Get the start time as UTC epoch seconds, rounded to not have decimals.\n$epoch = New-Object DateTime 1970, 1, 1, 0, 0, 0, ([DateTimeKind]::Utc)\n$epochStart = [math]::Round(((Get-Date).ToUniversalTime().AddHours(-$hours) - $epoch).TotalSeconds)\n\n# Check the LogicMonitor documentation on filters.\n$filter = \"_all~update\"\n$fields = \"username,happenedOnLocal,description\"\n\n# Build the URI for the access logs.\n$uri = \"https:\u002F\u002F\u003Caccount>.logicmonitor.com\u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs?sort=-happenedOn&filter=$filter,happenedOn>:$epochStart&fields=$fields\"\n\n# Build the base64 authentication string for the header.\n$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes((\"{0}:{1}\" -f $user, $pass)))\n\n# Get the events.\n$events = Invoke-RestMethod -Headers @{Authorization = (\"Basic {0}\" -f $base64AuthInfo)} -Uri $uri\n\n# Display the events that were gathered.\n$events\n",[27,249,250,256,264,270,278,284,290,296,302,310,316,324,330,336,342,348,354,360,366,379,390,397,403,414,419,425,476,509,514,520,531,542,547,553,580,585,591,627,632,638,679,684,690],{"__ignoreMap":195},[199,251,252],{"class":201,"line":202},[199,253,255],{"class":254},"sAwPA","\u003C#\n",[199,257,259,261],{"class":201,"line":258},2,[199,260,40],{"class":208},[199,262,263],{"class":227},"SYNOPSIS\n",[199,265,267],{"class":201,"line":266},3,[199,268,269],{"class":254},"    Downloads the LogicMonitor audit (access) log for the last hour through the REST API.\n",[199,271,273,275],{"class":201,"line":272},4,[199,274,40],{"class":208},[199,276,277],{"class":227},"DESCRIPTION\n",[199,279,281],{"class":201,"line":280},5,[199,282,283],{"class":254},"    Builds the start time as UTC epoch seconds, builds a Basic authentication\n",[199,285,287],{"class":201,"line":286},6,[199,288,289],{"class":254},"    header from the user name and password, and calls the \u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs endpoint of\n",[199,291,293],{"class":201,"line":292},7,[199,294,295],{"class":254},"    your LogicMonitor account. The events are returned with the username, local time and description\n",[199,297,299],{"class":201,"line":298},8,[199,300,301],{"class":254},"    fields and displayed.\n",[199,303,305,307],{"class":201,"line":304},9,[199,306,40],{"class":208},[199,308,309],{"class":227},"EXAMPLE\n",[199,311,313],{"class":201,"line":312},10,[199,314,315],{"class":254},"    .\\Get-LogicMonitorAuditLog.ps1\n",[199,317,319,321],{"class":201,"line":318},11,[199,320,40],{"class":208},[199,322,323],{"class":227},"NOTES\n",[199,325,327],{"class":201,"line":326},12,[199,328,329],{"class":254},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[199,331,333],{"class":201,"line":332},13,[199,334,335],{"class":254},"    Version : 1.1 (2026-09-20)\n",[199,337,339],{"class":201,"line":338},14,[199,340,341],{"class":254},"    History : 1.0 2016-02-22 Initial version.\n",[199,343,345],{"class":201,"line":344},15,[199,346,347],{"class":254},"              1.1 2026-09-20 Start time is computed in UTC instead of a fixed EST offset;\n",[199,349,351],{"class":201,"line":350},16,[199,352,353],{"class":254},"                  removed the unused end time.\n",[199,355,357],{"class":201,"line":356},17,[199,358,359],{"class":254},"    Requires: Windows PowerShell 3.0+ (Invoke-RestMethod), a LogicMonitor user with access log rights\n",[199,361,363],{"class":201,"line":362},18,[199,364,365],{"class":254},"#>\n",[199,367,369,372,375],{"class":201,"line":368},19,[199,370,371],{"class":205},"$user ",[199,373,374],{"class":227},"=",[199,376,378],{"class":377},"sYBdl"," \"\u003Cusername>\"\n",[199,380,382,385,387],{"class":201,"line":381},20,[199,383,384],{"class":205},"$pass ",[199,386,374],{"class":227},[199,388,389],{"class":377}," \"\u003Cpassword>\"\n",[199,391,393],{"class":201,"line":392},21,[199,394,396],{"emptyLinePlaceholder":395},true,"\n",[199,398,400],{"class":201,"line":399},22,[199,401,402],{"class":254},"# How many hours back to read the audit log.\n",[199,404,406,409,411],{"class":201,"line":405},23,[199,407,408],{"class":205},"$hours ",[199,410,374],{"class":227},[199,412,413],{"class":208}," 1\n",[199,415,417],{"class":201,"line":416},24,[199,418,396],{"emptyLinePlaceholder":395},[199,420,422],{"class":201,"line":421},25,[199,423,424],{"class":254},"# Get the start time as UTC epoch seconds, rounded to not have decimals.\n",[199,426,428,431,433,436,439,442,445,448,450,452,454,457,459,461,463,465,467,470,473],{"class":201,"line":427},26,[199,429,430],{"class":205},"$epoch ",[199,432,374],{"class":227},[199,434,435],{"class":208}," New-Object",[199,437,438],{"class":205}," DateTime ",[199,440,441],{"class":208},"1970",[199,443,444],{"class":227},",",[199,446,447],{"class":208}," 1",[199,449,444],{"class":227},[199,451,447],{"class":208},[199,453,444],{"class":227},[199,455,456],{"class":208}," 0",[199,458,444],{"class":227},[199,460,456],{"class":208},[199,462,444],{"class":227},[199,464,456],{"class":208},[199,466,444],{"class":227},[199,468,469],{"class":205}," ([",[199,471,472],{"class":227},"DateTimeKind",[199,474,475],{"class":205},"]::Utc)\n",[199,477,479,482,484,487,490,493,496,499,501,504,506],{"class":201,"line":478},27,[199,480,481],{"class":205},"$epochStart ",[199,483,374],{"class":227},[199,485,486],{"class":205}," [",[199,488,489],{"class":227},"math",[199,491,492],{"class":205},"]::Round(((",[199,494,495],{"class":208},"Get-Date",[199,497,498],{"class":205},").ToUniversalTime().AddHours(",[199,500,237],{"class":227},[199,502,503],{"class":205},"$hours) ",[199,505,237],{"class":227},[199,507,508],{"class":205}," $epoch).TotalSeconds)\n",[199,510,512],{"class":201,"line":511},28,[199,513,396],{"emptyLinePlaceholder":395},[199,515,517],{"class":201,"line":516},29,[199,518,519],{"class":254},"# Check the LogicMonitor documentation on filters.\n",[199,521,523,526,528],{"class":201,"line":522},30,[199,524,525],{"class":205},"$filter ",[199,527,374],{"class":227},[199,529,530],{"class":377}," \"_all~update\"\n",[199,532,534,537,539],{"class":201,"line":533},31,[199,535,536],{"class":205},"$fields ",[199,538,374],{"class":227},[199,540,541],{"class":377}," \"username,happenedOnLocal,description\"\n",[199,543,545],{"class":201,"line":544},32,[199,546,396],{"emptyLinePlaceholder":395},[199,548,550],{"class":201,"line":549},33,[199,551,552],{"class":254},"# Build the URI for the access logs.\n",[199,554,556,559,561,564,566,569,572,575,577],{"class":201,"line":555},34,[199,557,558],{"class":205},"$uri ",[199,560,374],{"class":227},[199,562,563],{"class":377}," \"https:\u002F\u002F\u003Caccount>.logicmonitor.com\u002Fsantaba\u002Frest\u002Fsetting\u002Faccesslogs?sort=-happenedOn&filter=",[199,565,153],{"class":205},[199,567,568],{"class":377},",happenedOn>:",[199,570,571],{"class":205},"$epochStart",[199,573,574],{"class":377},"&fields=",[199,576,171],{"class":205},[199,578,579],{"class":377},"\"\n",[199,581,583],{"class":201,"line":582},35,[199,584,396],{"emptyLinePlaceholder":395},[199,586,588],{"class":201,"line":587},36,[199,589,590],{"class":254},"# Build the base64 authentication string for the header.\n",[199,592,594,597,599,601,604,607,610,613,616,619,622,624],{"class":201,"line":593},37,[199,595,596],{"class":205},"$base64AuthInfo ",[199,598,374],{"class":227},[199,600,486],{"class":205},[199,602,603],{"class":227},"Convert",[199,605,606],{"class":205},"]::ToBase64String([",[199,608,609],{"class":227},"Text.Encoding",[199,611,612],{"class":205},"]::ASCII.GetBytes((",[199,614,615],{"class":377},"\"{0}:{1}\"",[199,617,618],{"class":227}," -f",[199,620,621],{"class":205}," $user",[199,623,444],{"class":227},[199,625,626],{"class":205}," $pass)))\n",[199,628,630],{"class":201,"line":629},38,[199,631,396],{"emptyLinePlaceholder":395},[199,633,635],{"class":201,"line":634},39,[199,636,637],{"class":254},"# Get the events.\n",[199,639,641,644,646,649,652,655,658,661,663,666,669,671,674,676],{"class":201,"line":640},40,[199,642,643],{"class":205},"$events ",[199,645,374],{"class":227},[199,647,648],{"class":208}," Invoke-RestMethod",[199,650,651],{"class":227}," -",[199,653,654],{"class":205},"Headers ",[199,656,657],{"class":227},"@",[199,659,660],{"class":205},"{Authorization ",[199,662,374],{"class":227},[199,664,665],{"class":205}," (",[199,667,668],{"class":377},"\"Basic {0}\"",[199,670,618],{"class":227},[199,672,673],{"class":205}," $base64AuthInfo)} ",[199,675,237],{"class":227},[199,677,678],{"class":205},"Uri $uri\n",[199,680,682],{"class":201,"line":681},41,[199,683,396],{"emptyLinePlaceholder":395},[199,685,687],{"class":201,"line":686},42,[199,688,689],{"class":254},"# Display the events that were gathered.\n",[199,691,693],{"class":201,"line":692},43,[199,694,695],{"class":205},"$events\n",[15,697,699],{"id":698},"notes","Notes",[20,701,702],{},[23,703,704,705,707],{},"Update 2026-09-20 (v1.1): the start time used to be the local time plus a hard-coded 4 hours (EST, and wrong during daylight saving), and an end time was calculated but never used. The start is now computed in UTC from ",[27,706,134],{},", so it works in any timezone.",[709,710,711],"style",{},"html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}",{"title":195,"searchDepth":258,"depth":258,"links":713},[714,715,716,717,718],{"id":17,"depth":258,"text":18},{"id":43,"depth":258,"text":44},{"id":184,"depth":258,"text":185},{"id":243,"depth":258,"text":244},{"id":698,"depth":258,"text":699},"techcolumnist",[721,722],"ps","scripts","2016-02-22T20:53:26Z","It’s been a while since I’ve posted. Way too long. I’ve had this script for quite a while that I wanted to share with the world.","md",false,null,{},"\u002Fblog\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api",{"title":6,"description":724},[732,719],"lasswell","both","blog\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api",[736,194],"logicmonitor","2026-09-20T00:00:00Z","\u002F2016\u002F02\u002F22\u002Fpowershell-connect-to-logicmonitors-rest-api\u002F","SzghD3jAIHwmv58O73NuFBG8ZbGtQvH20b-PVAThkmw",{"title":741,"description":742,"date":743,"url":744,"categories":745,"tags":746,"image":727,"readingTime":202,"canonical":719,"sites":747,"series":727,"seriesOrder":727},"First post in a long time — changing hosting providers","Wow, it’s been a while since I’ve done a real post on this site. I’ve got many interesting things to discuss, but it has been a great last few years.","2018-03-28T22:59:53Z","\u002F2018\u002F03\u002F28\u002Ffirst-post-in-a-long-time-changing-hosting-providers\u002F",[],[],[732,719],{"title":749,"description":750,"date":751,"url":752,"categories":753,"tags":754,"image":727,"readingTime":202,"canonical":719,"sites":757,"series":727,"seriesOrder":727},"PowerShell: Autotask – Get Picklist Values","When using AutoTask’s API it’s required to lookup a various amount of picklist values that are used in updating you’re web request.","2015-02-06T18:11:32Z","\u002F2015\u002F02\u002F06\u002Fpowershell-autotask-get-picklist-values\u002F",[721,722],[755,194,756],"autotask","soap",[732,719],[759,767,777],{"title":760,"description":761,"date":762,"url":763,"categories":764,"tags":765,"image":727,"readingTime":202,"canonical":719,"sites":766,"series":727,"seriesOrder":727},"PowerShell: Autotask – Enable Client Portal for All Users","This is a quick one, it’s been forever since I’ve posted here. After moving back to Autotask, there’s still a ton of things to automate.","2022-10-12T14:13:37Z","\u002F2022\u002F10\u002F12\u002Fautotask-powershell-enable-client-portal-for-all-users\u002F",[721,722],[755,194],[732,719],{"title":768,"description":769,"date":770,"url":771,"categories":772,"tags":773,"image":727,"readingTime":202,"canonical":719,"sites":776,"series":727,"seriesOrder":727},"PowerShell: Get Exchange Mailboxes Over XXGB","Simple command turned crazy. I ended up coming up with this due to the fact we have duplicate display names and needed to update for Exchange Online to get mailbox sizes.","2021-02-18T14:46:29Z","\u002F2021\u002F02\u002F18\u002Fpowershell-get-exchange-mailboxes-over-xxgb\u002F",[721,722],[194,774,775],"exchange","exchange-online",[732,719],{"title":778,"description":779,"date":780,"url":781,"categories":782,"tags":783,"image":785,"readingTime":258,"canonical":719,"sites":786,"series":727,"seriesOrder":727},"PowerShell: ConnectWise Documents API, Uploading a Document or Attachment to a Ticket","PowerShell: upload a document or attachment to a ConnectWise ticket through the form-based Documents API.","2019-01-09T09:46:57Z","\u002F2019\u002F01\u002F09\u002Fpowershell-connectwise-documents-api-uploading-a-document-or-attachment-to-a-ticket\u002F",[721,722],[784,194],"connectwise","\u002Fuploads\u002F2019\u002F01\u002Fimage.png",[732,719],{"doc":727,"posts":788},[],1790949961472]