Lost in Monitoring Onedrive

In this blog, I will explain why it’s important to monitor OneDrive and show you how to set up OneDrive monitoring on your endpoints.

When you enable KFM (OneDrive Known Folder Move) and mount some Team sites, as I showed in one of my blogs, you must ensure OneDrive is always working and your files are up-to-date.

1.PowerShell Script

Monitoring your user’s OneDrive can be a pain because there are no real event logs or register values you can monitor to ensure OneDrive is working. Luckily, you can use some OneDrive logs in the user’s local AppData folder.

This syncdiagnostics.log will show you some important things.

• Time stamp of the log itself
• Syncprogressstate
• UtcNow

It’s a funny thing, syncprogressstate is nowhere mentioned in Microsoft’s documentation. So getting the error codes can be a little bit hard. After some tests to break OneDrive, I noticed some things.  The syncprogressstate can be:

• 16777216 or 0  =  “Up-to-Date”
• 65536    = “Paused”
• 8194 = “Not syncing”
• 1854 = “Having syncing problems”
• Or the value: syncprogressstate, just does not exist…

So now we have some information to begin monitoring but we still need to check some other information.

• Is OneDrive running?
• Is a Entra ID user logged in?
• Compare the current time and the timestamp to see the difference.

When using Solarwinds you can create some PowerShell scripts to begin monitoring OneDrive. Of course, this is my first beta script so it’s not perfect yet. I need to test it some more… but here it is.

#Search onedrive logs in the user folders
	$folderMask = "C:\Users\*\AppData\Local\Microsoft\OneDrive\logs\Business1\*.*"
	$files = Get-ChildItem -Path $folderMask  -Filter SyncDiagnostics.log |  Where-Object { $_.LastWriteTime -gt [datetime]::Now.AddMinutes(-1440)}
	$filesfound = $files -ne $null

#search progressstate and date
$progressstate = Get-Content $files| Where-Object { $_.Contains("SyncProgressState") } 
$checkdate = Get-Content $files| Where-Object { $_.Contains("UtcNow:") }  

#Select progressstate
	$status = $progressstate | %{ -split $_ | select -index 1 }

#Check if Onedrive is active

	$ProcessActive = Get-Process OneDrive -ErrorAction SilentlyContinue
	if($processactive.count -eq 0) 
		{ 
			$checkprocess = $false
		} 
	else 
		{ 
			$checkprocess = $true
		}

#check if azuread user is logged on
	$user = Get-WMIObject -class Win32_ComputerSystem | select username
	$user.username
	$userloggedin = $user.username -match "azuread"


#####convert progressstate to name####
Function Convert-ResultCodeToName
{
	param( [Parameter(Mandatory=$true)]
	[int] $status
	)
	$Result = $status
	switch($status)
	{
		{($_ -eq 16777216) -or ($_ -eq 42) -or ($_ -eq 0)} 
		{
			$statusname = "Up-to-Date"
		}
		65536
		{
			$statusname = "Paused"
		}
		8194
		{
			$statusname = "Not syncing"
		}
		1854
		{
			$statusname = "Having syncing problems"
		}
		default 
		{
			$statusname =  "Unknown ($status)" 
		}
	}
	return $statusname
}
$Resulttext = Convert-ResultCodeToName $status

#checking if progressstate is up to date
	$state = ($progressstate -match 16777216) -or ($progressstate -match 42) -or ($progressstate -match 0) 

#comparing log file dates
	$convertdate = $checkdate | %{ -split $_ | select -index 1 }
	$convertdate = $convertdate -as [DateTime]
	$datumnow = get-date
	$TimeSpan = new-timespan -start $datumnow -end $convertdate
	$difference = $timespan.hours


#Returning solarwinds status
Try 
{
If ($userloggedin -eq  $False)
{
	write-host "No azuread user is logged on. Skipping OneDrive monitoring."
	#exit 0
}
elseif ($checkprocess -eq $false -and $userloggedin -eq $true)
{
	write-host "User logged in but Onedrive is not running!"
	#exit 1001
}
elseif ($state -eq "True" -and $difference -le 24 -and $files.count -gt 0 -and $checkprocess -match "True")
{
	write-host "Onedrive is working great! Onedrive is $resulttext and there are no syncing problems"
	#exit 0
}
else
{
	write-host "Onedrive is really really really broken! Onedrive is $resulttext | Last sync time:$difference hours ago | Beware, possible syncing problems detected"
	#exit 1001
}
}
catch
{
	Write-Warning "Value Missing"
	#exit 1001
}

2. Office Admin Center

Finally, there is a new possibility/option created by Microsoft themselves to start monitoring your OneDrive clients!

Go open config.office.com and log in with your credentials, you will notice a new tab has appeared: “Onedrive Sync”

As shown above, I now have 17 devices. If you end up with zero devices, you will still need to do some manual labor before it starts working. Open the settings menu and generate a new tenant association key.

When you have copied this key, open your Intune administrative templates again and search for “Sync Admin Reports” and paste the key.

Make sure you apply this policy to all devices you want to monitor, I guess that means all of your devices…

Now let’s take a look at what the OneDrive Sync health is telling us!

Isn’t that beautiful? You will see all of the sync errors occurring on all of your enrolled Endpoints, even when they were last synced! I can’t be happier!

A final note: Beware… it could take up to 3 days before any of your devices shows up make sure your Onedrive is up to date because you will need to use the OneDrive Sync app version 21.078

Conclusion

Implementing OneDrive is crucial to your modern workplace journey but not monitoring OneDrive will come back to bite you. Keeping your files up-to-date is just as important as keeping your Windows up-to-date. With these 2 options I showed you, you can start monitoring OneDrive on your endpoints