Lost in monitoring Onedrive

Lost in monitoring Onedrive

In this blog, I will be showing you why it’s very important to monitor OneDrive and how to set up Onedrive Monitoring on your endpoints.

When you enabled KFM and mounted some Team sites as I showed in one of my blogs, you have to make sure OneDrive is always working and your files are up-to-date.

Monitoring your users OneDrive can be a Bitch, because there are no event logs or register values you can monitor to make sure OneDrive is working. Luckily there is some kind of log file in the user local AppData folder.

This syncdiagnostic.log will show you some important things.

  • Time stamp of the log itself
  • Syncprogressstate
  • UtcNow

It’s a funny thing, syncprogressstate is nowhere mentioned in Microsoft’s documentation. So getting the error codes can be a little bit hard. After some tests to break OneDrive I noticed some things.  The syncprogressstate can be:

  • 16777216 or 0  =  “Up-to-Date”
  • 65536    = “Paused”
  • 8194 = “Not syncing”
  • 1854 = “Having syncing problems”
  • Or the value: syncprogressstate, just does not exist…

So now we have some information to begin monitoring but we still need to check some other information.

  • Is OneDrive running?
  • Is an azuread\ user logged in?
  • Compare current time and the Timestamp to get the difference.

When using Solarwinds you can create some PowerShell scripts to begin monitoring OneDrive. Of course, this is my first beta script so it’s not perfect yet. I need to test it some more… but here it is.

#Search onedrive logs in the user folders
	$folderMask = "C:\Users\*\AppData\Local\Microsoft\OneDrive\logs\Business1\*.*"
	$files = Get-ChildItem -Path $folderMask  -Filter SyncDiagnostics.log |  Where-Object { $_.LastWriteTime -gt [datetime]::Now.AddMinutes(-1440)}
	$filesfound = $files -ne $null

#search progressstate and date
$progressstate = Get-Content $files| Where-Object { $_.Contains("SyncProgressState") } 
$checkdate = Get-Content $files| Where-Object { $_.Contains("UtcNow:") }  

#Select progressstate
	$status = $progressstate | %{ -split $_ | select -index 1 }

#Check if Onedrive is active

	$ProcessActive = Get-Process OneDrive -ErrorAction SilentlyContinue
	if($processactive.count -eq 0) 
		{ 
			$checkprocess = $false
		} 
	else 
		{ 
			$checkprocess = $true
		}

#check if azuread user is logged on
	$user = Get-WMIObject -class Win32_ComputerSystem | select username
	$user.username
	$userloggedin = $user.username -match "azuread"


#####convert progressstate to name####
Function Convert-ResultCodeToName
{
	param( [Parameter(Mandatory=$true)]
	[int] $status
	)
	$Result = $status
	switch($status)
	{
		{($_ -eq 16777216) -or ($_ -eq 42) -or ($_ -eq 0)} 
		{
			$statusname = "Up-to-Date"
		}
		65536
		{
			$statusname = "Paused"
		}
		8194
		{
			$statusname = "Not syncing"
		}
		1854
		{
			$statusname = "Having syncing problems"
		}
		default 
		{
			$statusname =  "Unknown ($status)" 
		}
	}
	return $statusname
}
$Resulttext = Convert-ResultCodeToName $status

#checking if progressstate is up to date
	$state = ($progressstate -match 16777216) -or ($progressstate -match 42) -or ($progressstate -match 0) 

#comparing log file dates
	$convertdate = $checkdate | %{ -split $_ | select -index 1 }
	$convertdate = $convertdate -as [DateTime]
	$datumnow = get-date
	$TimeSpan = new-timespan -start $datumnow -end $convertdate
	$difference = $timespan.hours


#Returning solarwinds status
Try 
{
If ($userloggedin -eq  $False)
{
	write-host "No azuread user is logged on. Skipping OneDrive monitoring."
	#exit 0
}
elseif ($checkprocess -eq $false -and $userloggedin -eq $true)
{
	write-host "User logged in but Onedrive is not running!"
	#exit 1001
}
elseif ($state -eq "True" -and $difference -le 24 -and $files.count -gt 0 -and $checkprocess -match "True")
{
	write-host "Onedrive is working great! Onedrive is $resulttext and there are no syncing problems"
	#exit 0
}
else
{
	write-host "Onedrive is really really really broken! Onedrive is $resulttext | Last sync time:$difference hours ago | Beware, possible syncing problems detected"
	#exit 1001
}
}
catch
{
	Write-Warning "Value Missing"
	#exit 1001
}

Conclusion

Implementing OneDrive is crucial to your modern workplace journey but not monitoring OneDrive will come back to bite you. Keeping your files up-to-date is just as important as keeping your Windows up-to-date.

5 thoughts on “Lost in monitoring Onedrive

  1. The script is great, thank you!

    One thing I noticed is that if I pause OneDrive, and then re-enable sync, the log file does not update and still shows the 65536 state.

  2. I found if I add code to delete the SyncDiagnostics.log as last step, then the code reports the correct status on next check. The log seems to only generate on some interval or when an error occurs.

    1. Hi,

      Thats indeed correct, I noticed the same thing (did not had the time to post an update bout it). the log will not update the status (after you paused onedrive) unless you kill/stop/start onedrive or indeed delete the .log file.

Leave a Reply

Your email address will not be published. Required fields are marked *