This was solved by extracting the VEM500-201201140102-BG-release.zip, opening index.xml (wordpad is suitable) and modifying the code XML node from CSCO to csco. We then rezipped the folder contents and imported it successfully.

Thanks to http://www.thatcouldbeaproblem.com/?p=341 for the nod in the right direction :)

Two approaches sprang to mind:

• Invoke-Command by way of WinRM
• The remote capabilities of either Get-WinEvent or Get-EventLog

Rolling out WinRM is an ongoing project and so the latter it was. A read around online and Get-WinEvent was touted a quickest especially when querying remote computers so I started with that. I constructed my query to retrieve any errors or critical messages in the application eventlog since 4am which is the time of patching:

$computerName = "remoteserver"
# Create a timestamp after which to retrieve events. This should be from 4am on the current day:
$currDatetime = Get-Date
$day = $currDatetime.Day
$month = $currDatetime.Month
$year = $currDatetime.Year
$patchDateTime = New-Object -TypeName System.DateTime($year,$month,$day,04,00,00)
$appLog = Get-WinEvent -LogName "Application" -ComputerName $computerName -ErrorAction SilentlyContinue | Where-Object { ( ($_.LevelDisplayName -eq "Error" -or $_.LevelDisplayName -eq "Critical") -and ($_.TimeCreated -ge $patchDateTime) ) } | Select-Object TimeCreated,LogName,ProviderName,Id,LevelDisplayName,Message

It took forever to run. Ok not quite, but it took 11 minutes! Very slow.

“Back to basics” I thought. Let’s test the execution time of a simpler query on my local machine:

$yesterday = (get-date) - (new-timespan -day 1)
Measure-Command -Expression { Get-WinEventLog -LogName "Application" -ErrorAction SilentlyContinue | Where-Object { ($_.TimeCreated -ge $yesterday) -and ($_.LevelDisplayName -eq "Error") } }

22 seconds for 1 result (out of 104 records in the last 24 hours). Hmmm.

How about against the original server?:

Measure-Command -Expression { Get-WinEventLog -LogName "Application" -ErrorAction SilentlyContinue | Where-Object { ($_.TimeCreated -ge $yesterday) -and ($_.LevelDisplayName -eq "Error") } }

330 seconds (5.5 minutes) for 2 results (out of 128 records in the last 24 hours). Very disappointing. We have 140 servers and querying them all was not going to happen using this approach and standard sequential / synchronous processing. While it would be possible to save time by using asynchronous processing (background jobs or multiple threads) I was certain that this command should be orders of magnitude faster.

I did a little more reading and discovered the -FilterHashTable parameter of the Get-WinEvent cmdlet. This filters the objects while being retrieved on the server, rather than retrieving all the objects and then filtering as happens with Where-Object.

Get-Help Get-WinEvent -Parameter FilterHashTable

showed the key:value pairs accepted by the parameter. The user friendly “LevelDisplayName” key was not one of these, but luckily “Levels” of events (error,warning,information etc.) are also given the “Level” property which is accepted by FilterHashTable. “Error” = Level 2. If you want to know how to see this sort of information the easiest way is to double click an eventlog entry, click the “details” tab and then select XML view.

A new, equivalent query was born using this new method and executed against my local computer:

Measure-Command -Expression { Get-WinEvent -FilterHashTable @{LogName='Application'; Level=2; StartTime=$yesterday} -ErrorAction SilentlyContinue }

0.09 seconds! Some 244x faster. I stripped off the Measure-Command to find it was indeed pulling back the same single error record as previously (without -FilterHashtable). Fantastic!

Now against the remote server:

Measure-Command -Expression { Get-WinEvent -FilterHashTable @{LogName='Application'; Level=2; StartTime=$yesterday} -ErrorAction SilentlyContinue -ComputerName $remoteserver }

0.43 seconds.

So back to my original command. As we’re not allowed duplicate keys in a hash table two queries were needed:

$appErrors = Get-WinEvent -FilterHashTable @{LogName='Application'; Level=2; StartTime=$yesterday} -ErrorAction SilentlyContinue -ComputerName $remoteserver | Select-Object TimeCreated,LogName,ProviderName,Id,LevelDisplayName,Message
$appCritical = Get-WinEvent -FilterHashTable @{LogName='Application'; Level=1; StartTime=$yesterday} -ErrorAction SilentlyContinue -ComputerName $remoteserver | Select-Object TimeCreated,LogName,ProviderName,Id,LevelDisplayName,Message
# Combine and sort the arrays
$appCombined = $appErrors + $appCritical | Sort TimeCreated

1.85 seconds. Outstanding :)

I then went on my merry way about creating a fully fledged script. Ultimately it worked very well and against a batch of 20 servers took 3.89 minutes with some 18,000 records returned, although it did complain with many “There are no more endpoints available from the endpoint mapper.” error messages which I noticed were against our 2003 servers. It appears that Get-WinEvent doesn’t work against 2003 but at least from a 2008R2 server it happily works against 2008+ with -FilterHashTable. I may have to construct a different, equivalent Get-EventLog query purely for the 2003 servers.

Word of warning: The script will attempt to copy pending.xml before deleting it. If it cannot copy it it will delete it. Personally I have never been able to copy the file; most likely because I have not rebooted the server after taking ownership and granting myself full permissions to the file. I should add however that in all my use of this script I have not suffered any problems when deleting the file. Windows Update will recreate it the next time you/the computer downloads required updates.

:: Windows Update Multiple Fix Script
:: v1.00
@echo off
cd "C:\Windows\WinSxS"
echo Taking ownership of pending.xml
takeown /f C:\Windows\WinSxS\pending.xml
echo;
echo;
echo Granting you permissions on pending.xml
cacls C:\Windows\WinSxS\pending.xml /G %Username%:F
echo;
echo;
echo Attempting to copy pending.xml as pendingbackup.xml
copy "C:\Windows\WinSxS\pending.xml" "C:\Windows\WinSxS\pendingbackup.xml"
echo;
echo;
echo Deleting pending.xml
del "C:\Windows\WinSxS\pending.xml"
echo;
echo;
echo Exporting HKEY_LOCAL_MACHINE\COMPONENTS to C:\HKLM_backup.reg
REG EXPORT HKLM\Components C:\HKLM_backup.reg
echo;
echo;
echo Removing noted problematic registry keys
REG DELETE HKLM\Components /v AdvancedInstallersNeedResolving
REG DELETE HKLM\Components /v PendingXmlIdentifier
REG DELETE HKLM\Components /v NextQueueEntryIndex
echo;
echo;
echo Restarting Windows Update related services...
net stop "Background Intelligent Transfer Service"
net start "Background Intelligent Transfer Service"
net stop "Cryptographic Services"
net start "Cryptographic Services"
net stop "Windows Update"
net start "Windows Update"
echo;
echo;
echo Please try running Windows Update / patching again.
echo;
echo;
PAUSE

Copy the code and save it as a batch file.

1. Using DNStools.com it’s possible to see that the domain was registered on the 18th Feb 2009. Has the site only just appeared? If so, why? They have “blog/news” articles dating back to 2002.
2. For some reason, the robots.txt has been used to block a whole host of internet search engines. Why? A domain history in the “Way Back Machine” is blocked too.
3. The checkout process is insecure, carried out entirely over http:// rather than https://
   Take a look at a few of the checkout options:
   
   Enter your credit card details, over standard http! Haha, I think not.
   
   

4. They display a truste.org seal on their homepage. On a legitable website clicking this would redirect your browser to the truste.org website, which would subsequently display some kind of seal of approval. On this site however clicking it takes you to a copied version of the truste.org verification page, hosted on their own server. Here it is. Unsurprisingly when searching for seal holders on the truste website Embikes are not there, meaning they do not hold any seal of approval at current.
5. Almost every product has 1 review, and of course those reviews are always 5 stars.
6. They have all the bikes in the entire world in stock! Ok, not quite… but they have more than well known online retailers have. For instance, I could apparently choose any size Jake the Snake from the past 3 years (2007-2009 models). Unlikely.
7. I entered a brief email correspondance with the “owner” about purchasing a bike. As soon as I asked for some reassurance on the authenticitiy of their site (by providing some of the above concerns), all correspondance stopped.

Worryingly I found this site through Google Shopping. I haven’t yet found a way of reporting fraudulent shops but when I do I’ll be sure to send my “evidence” their way.

Update: Embikes.com no longer appears in Google Shopping results. I wonder how much money they made away with though :/

]]> http://theboywonder.co.uk/2009/04/13/embikescom-scam-site/feed/ 10 http://theboywonder.co.uk/2009/01/07/adaptec-3805-and-seagate-st31500341as/ http://theboywonder.co.uk/2009/01/07/adaptec-3805-and-seagate-st31500341as/#comments Wed, 07 Jan 2009 13:32:23 +0000 Robin http://theboywonder.co.uk/?p=246 Losing my main hard drive to a mechanical fault recently (and having to pay lots of money to have it professionally recovered) was the final push needed to shell out some cash and get myself setup with a RAID configuration to protect all my data.

Having decided on RAID 6 and knowing that I wanted upto 8 drives to be protected I did some reading around and went for the Adaptec 3805 unified serial (SAS/SATA) RAID controller.

Originally I had planned on kitting myself out with six 1.5TB Seagate drives (ST31500341AS), and although these weren’t in the compatibility list for the controller I had hoped they’d be ok. Luckily I checked with Adaptec and received this suprisingly detailed reply:

The new 1.5 TB drives from Seagate are currently under compatibility testing with several of our controllers, but currently are classified as unsupported. Until this testing is complete, we cannot recommend the use of these drives with any of our current controllers. The drive’s firmware appears to be incompatible with many of our controllers and in many cases, although the drives are detected, the array may not be able to be created properly or there can be behavioral issues with these drives. At this point, we woul recommend using drives listed in the compatibility report for this controller at: http://www.adaptec.com/NR/rdonlyres/154B1035-A97E-4E5B-9558-68E597C7E7E6/0/20081_ARCSASCompatibilityReport_030708_3x05_3085.pdf

So at the time of writing, unfortunately the Seagate ST31500341AS drives are not compatible with Adaptec 3805 RAID controllers. I think I’ll have to fill my case up with 1TB Samsung spinpoints instead…

]]> http://theboywonder.co.uk/2009/01/07/adaptec-3805-and-seagate-st31500341as/feed/ 0 http://theboywonder.co.uk/2007/01/02/top-web-20/ http://theboywonder.co.uk/2007/01/02/top-web-20/#comments Tue, 02 Jan 2007 10:32:41 +0000 Robin http://theboywonder.co.uk/2007/01/02/top-web-20/ Michael Arrington of techcrunch.com has written (updated) a very handy article listing some excellent Web 2.0 companies you should get to grips with. I can’t say I use all of them but I do use a fair few (Flickr, Gmail, Netvibes, Digg, WordPress, Skype, Youtube), and I love them. I dare say I’ll be signing up for a few more, and hopefully with the increased convergence of web services, 2007 will see people adopting and contributing to sites such as netvibes more frequently.
]]> http://theboywonder.co.uk/2007/01/02/top-web-20/feed/ 1 http://theboywonder.co.uk/2006/08/08/last-fm-weekly-artists-wordpress-plugin/ http://theboywonder.co.uk/2006/08/08/last-fm-weekly-artists-wordpress-plugin/#comments Tue, 08 Aug 2006 12:20:25 +0000 Robin http://theboywonder.co.uk/2006/08/08/last-fm-weekly-artists-wordpress-plugin/ Firstly, complete credit to tijs for the original plugin, allowing you to display your recent tracks on your wordpress blog. I wanted a weekly artists option, and noticed some other people were after the same, so I modified a few parts and decided to make it available :)

You can download it here: lastfm_artists.phps

Installing:

1. Save the file, and change .phps to .php
2. Upload to your plugins folder.
3. Call the weekly_artists function (as explained in the plugin) somewhere in your template (for example, sidebar.php).

Hope this helps some people! :)

]]> http://theboywonder.co.uk/2006/08/08/last-fm-weekly-artists-wordpress-plugin/feed/ 3