59 lines
2.3 KiB
PowerShell
59 lines
2.3 KiB
PowerShell
|
function Get-FileBeatsService {
|
||
|
|
<#
|
||
|
|
.SYNOPSIS
|
||
|
|
Returns list of installed FileBeat Services
|
||
|
|
|
||
|
|
.PARAMETER SearchPrefix
|
||
|
|
Additional refining prefix for searching. When not present, defaults to checking the paths returned by Get-FileBeatsPath
|
||
|
|
|
||
|
|
.PARAMETER IncludeDisabled
|
||
|
|
Should include disabled services in the output
|
||
|
|
|
||
|
|
.OUTPUTS
|
||
|
|
Returns the same data format structure as Get-ServiceInfoByCIMFragment
|
||
|
|
#>
|
||
|
|
[CmdletBinding()]
|
||
|
|
[OutputType([string[]])]
|
||
|
|
Param(
|
||
|
|
[Parameter(Mandatory = $false)]
|
||
|
|
[string[]]$SearchPrefix,
|
||
|
|
|
||
|
|
[switch]$IncludeDisabled
|
||
|
|
)
|
||
|
|
|
||
|
|
$logLead = (Get-LogLeadName)
|
||
|
|
|
||
|
|
$disabledStartMode = "Disabled"
|
||
|
|
|
||
|
|
if ([string]::IsNullOrWhiteSpace($SearchPrefix)) {
|
||
|
|
# We know the service is likely registered under at least one of these paths
|
||
|
|
# It is entirely possible to have two services installed on one machine under one or more paths
|
||
|
|
|
||
|
|
# This is either returned as an @array OR $null - do NOT force it to @(array) or you break the world
|
||
|
|
# because your @(array) can come back as an error technically "empty" and "null" even though it has
|
||
|
|
# a single element, which just happens to be null
|
||
|
|
$SearchPrefix = Get-FileBeatsPath
|
||
|
|
}
|
||
|
|
|
||
|
|
if (Test-IsCollectionNullOrEmpty $SearchPrefix) {
|
||
|
|
Write-Warning "$logLead : Could not find any properties/paths to check for FileBeats Services. Is the service installed?"
|
||
|
|
return @()
|
||
|
|
}
|
||
|
|
|
||
|
|
$services = @()
|
||
|
|
foreach($pathOrPrefix in $SearchPrefix) {
|
||
|
|
$service = (Get-ServiceInfoByCIMFragment -QueryFragment $pathOrPrefix)
|
||
|
|
if ($null -ne $service) {
|
||
|
|
# if the flag to include disabled services is passed _and_ the service is disabled, return it
|
||
|
|
# if the flag to include disabled services is NOT passed _and_ the service is disabled, DO NOT return it
|
||
|
|
if ((!$includeDisabled -and $service.StartMode -ne $disabledStartMode) -or ($includeDisabled -and $service.StartMode -eq $disabledStartMode)) {
|
||
|
|
$services += $service
|
||
|
|
} else {
|
||
|
|
Write-Host "$logLead : Found service [$($service.DisplayName)] but it was disabled and disabled services are not included in the return results. To include in the future, use the flag -IncludeDisabled"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
return $services
|
||
|
|
}
|