IMELogParser

PowerShell tooling for troubleshooting Microsoft Intune Management Extension (IME) compliance/detection scripts on Windows endpoints.

Scripts

Get-IMELog.ps1

Reads the CMTrace-format logs under IntuneManagementExtension\Logs and merges them into a single chronological, color-coded stream.

CMTrace records are not line-oriented — a stack trace or multi-line script output lives inside one record — so the parser matches whole records rather than lines. Each entry is normalized to one row with its full message intact.

# Default: last 200 records from every log in the standard IME log folder
.\Get-IMELog.ps1

# Warnings and errors only
.\Get-IMELog.ps1 -Type Warning,Error

# One script GUID across specific logs, untruncated messages
.\Get-IMELog.ps1 -TailLines 0 -IncludedLogs HealthScripts,AgentExecutor -Filter <guid> -FullMessage

# Objects instead of console output: grid, filtering, export
.\Get-IMELog.ps1 -TailLines 0 -Filter <guid> -PassThru | Out-GridView
.\Get-IMELog.ps1 -TailLines 0 -Filter <guid> -PassThru | Export-Csv out.csv -NoTypeInformation

Parameters: -LogPath, -TailLines (counts records, not physical lines; 0 reads whole files), -Filter (regex on message text), -SinceMinutes, -Type (Info/Warning/Error/All), -Source, -IncludedLogs, -FullMessage.

• -PassThru emits objects (Timestamp, Source, Component, Type, Message) to the pipeline instead of rendering — the only mode that puts anything on the pipeline. For wrapped columns, pipe to Format-Table Timestamp, Source, Message -Wrap.
• -IncludeRolled also reads archived logs (HealthScripts-<stamp>.log, ...) and de-duplicates entries written either side of a rollover. Without it, a run that spans a rollover silently misses everything in the archived half.

Correlating a policy to its check-in traffic:

.\Get-IMELog.ps1 -TailLines 0 -IncludedLogs HealthScripts,AgentExecutor,IntuneManagementExtension -IncludeRolled -Filter <guid> -CorrelateSessions

-CorrelateSessions adds the gateway calls that actually carried this policy. The IME log records the check-in transport — [Location Service], [SendWebRequestInternal], [EcsFlighting] — and never names a policy, so admitting all of it buries the policy's own entries by roughly 60:1. Instead, HealthScripts logs Got result with session id <guid> next to the policy, and that id reappears in the gateway URL as SideCarGatewaySessions('<guid>'); entries are joined on it, with adjacent [Location Service] lines (which carry no id) matched within two seconds. Requires the HealthScripts log in the set — it is the only one that logs session ids — and warns if none are found.

Notes

• Scanning every rolled log reads tens of MB; progress is reported via Write-Progress. Suppress it with $ProgressPreference = 'SilentlyContinue'.
• CSV/JSON exports and stray .log copies are git-ignored — see .gitignore.