mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
474af7f78c
Two V2 IME fixes, verified against client logs of sessions fc48c71a / 6b4993e5. Bug 1 — on an ESP terminal failure of the DeviceSetup Apps subcategory the only device app was stuck mid-install (RealmJoin stuck Downloading 0%) and IME logged no per-app error, so app_tracking_summary showed 0 failed and the failure was visible only via the opaque "Apps (Error)" registry string. New esp_apps_failure_correlation event names the in-flight (IsActive: InProgress/ Downloading/Installing) device app(s) as the likely cause WITHOUT mutating state (no fabricated app_install_failed) and only on the Apps subcategory. Bug 2 — AgentExecutor.exe hosts both platform and proactive-remediation scripts interleaved in the shared AgentExecutor.log; the policyId-less PS-AGENT-EXITCODE / PS-AGENT-OUTPUT lines from a remediation invocation bled into the last-started platform script via the sticky pointer (c3e0124c emitted result=Failed but with exit 0 + the Teams remediation's "[Compliant] No Classic Teams found" stdout). New PS-AGENT-INVOCATION pattern (resetPlatformScriptContext) clears the platform line-capture pointer at every "ExecutorLog AgentExecutor gets invoked" boundary, so a remediation invocation cannot capture into a platform slot; the platform result stays keyed by policyId via PS-SCRIPT-RESULT. Agent-only, V2, inert until redeploy; no ConfigVersion bump. New event type added to the MCP resource catalog (dual-sync). Green: V2.Core 1522, DecisionCore 400, Backend BuiltInRules 8, MCP vitest 252. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
103 lines
3.5 KiB
JSON
103 lines
3.5 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://raw.githubusercontent.com/OliverKieselbach/Autopilot-Monitor/main/rules/schema/ime-log-pattern.schema.json",
|
|
"title": "Autopilot Monitor IME Log Pattern",
|
|
"description": "Defines a regex pattern for Intune Management Extension (IME) log parsing during Autopilot enrollment.",
|
|
"oneOf": [
|
|
{ "$ref": "#/$defs/imeLogPattern" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": { "type": "string" },
|
|
"rules": {
|
|
"type": "array",
|
|
"items": { "$ref": "#/$defs/imeLogPattern" }
|
|
}
|
|
},
|
|
"required": ["rules"],
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"$defs": {
|
|
"imeLogPattern": {
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": {
|
|
"type": "string",
|
|
"description": "JSON Schema reference for editor IntelliSense."
|
|
},
|
|
"patternId": {
|
|
"type": "string",
|
|
"description": "Unique pattern identifier (e.g., \"IME-ESP-PHASE\")."
|
|
},
|
|
"category": {
|
|
"type": "string",
|
|
"description": "Pattern category controlling when the pattern is active.",
|
|
"enum": ["always", "currentPhase", "otherPhases"]
|
|
},
|
|
"pattern": {
|
|
"type": "string",
|
|
"description": "Regex pattern string to match against IME log message content. Supports named capture groups. Uses {GUID} as placeholder for the standard GUID capture pattern."
|
|
},
|
|
"action": {
|
|
"type": "string",
|
|
"description": "Action to perform when the pattern matches. Must match an action handler in the agent's ImeLogTracker.",
|
|
"enum": [
|
|
"setCurrentApp",
|
|
"updateStateInstalled",
|
|
"updateStateDownloading",
|
|
"updateStateInstalling",
|
|
"updateStateSkipped",
|
|
"updateStateError",
|
|
"updateStatePostponed",
|
|
"espPhaseDetected",
|
|
"imeStarted",
|
|
"policiesDiscovered",
|
|
"ignoreCompletedApp",
|
|
"imeAgentVersion",
|
|
"espTrackStatus",
|
|
"updateName",
|
|
"updateWin32AppState",
|
|
"cancelStuckAndSetCurrent",
|
|
"imeSessionChange",
|
|
"imeImpersonation",
|
|
"enrollmentCompleted",
|
|
"updateDoTelemetry",
|
|
"scriptStarted",
|
|
"scriptContext",
|
|
"scriptExitCode",
|
|
"scriptOutput",
|
|
"scriptCompleted",
|
|
"resetPlatformScriptContext",
|
|
"healthScriptResult",
|
|
"healthScriptDetectionResult",
|
|
"captureExitCode",
|
|
"captureHResult",
|
|
"captureAppVersion",
|
|
"captureAppTypeWinGet",
|
|
"captureAppTypeMsi",
|
|
"captureAttemptNumber",
|
|
"captureDetectionResult"
|
|
]
|
|
},
|
|
"parameters": {
|
|
"type": "object",
|
|
"description": "Optional extra parameters for the action handler (all values are strings).",
|
|
"additionalProperties": { "type": "string" }
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"description": "Human-readable description of what this pattern detects and why."
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this pattern is enabled. Set to false to add a pattern without activating it immediately.",
|
|
"default": true
|
|
}
|
|
},
|
|
"required": ["patternId", "category", "pattern", "action"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|