Run this read-only PowerShell script against your Cognos server, then paste what it
produces into the form, and your report is written from real counts. It can also turn
up things a questionnaire won't, like legacy content no one remembers building.
What it collects, and what it leaves out
It collects
- Counts of every object type in your content store
- Names of packages, data modules, and custom visualizations
- Names of legacy Query Studio, Analysis Studio, and PowerPlay content
- How many schedules exist, how many are active, and how often they run
- Data source types, such as Db2 or SQL Server
- How many authentication namespaces you have
It leaves out
- Every object name, if you run it with -CountsOnly
- Report titles, unless you add a switch to include them
- Report content, data, and query results
- Connection strings, server names, and credentials
- User names, groups, and anything else about people
- Your personal folders, unless you ask for them
Running it
You'll need Windows PowerShell 5.1 or later on a machine that can reach your Cognos
server. The script asks for the server address, then for an API key or your sign-in.
# Unzip it, then work from the folder it creates
Expand-Archive .\cognos-inventory.zip -DestinationPath .
cd .\cognos-inventory
# Read what it does before you run it
Get-Help .\Get-CognosInventory.ps1 -Full
# Once you've read it, tell Windows you trust this file (see below)
Unblock-File .\Get-CognosInventory.ps1
# Run it
.\Get-CognosInventory.ps1
# Same counts, but no object names at all
.\Get-CognosInventory.ps1 -CountsOnly
# If your server uses an internal certificate
.\Get-CognosInventory.ps1 -SkipCertificateCheck
An account with read access to the content store is enough. If the script can't reach
something, it makes a note and keeps going, and the gap shows up in your report under
"What we couldn't check."
If Windows says the file "is not digitally signed"
Windows marks any script downloaded from the internet, and on most machines it won't
run a marked script that isn't signed. This one isn't signed yet. After you've read it,
Unblock-File removes the mark from that one file and nothing
else. If your organization requires every script to be signed, you can run it once
without changing any settings:
powershell -ExecutionPolicy Bypass -File .\Get-CognosInventory.ps1
That applies only to the PowerShell window it starts. If group policy blocks both, your
security team will want to look at the script first, and they can run it themselves.
It only reads, and nothing leaves your network
Every call it makes is an HTTP GET, except the one that starts your session, which
Cognos requires to be a PUT. The script has no upload step: it prints the result and
saves cognos-inventory.json next to itself. Read that file,
and paste it into the form only if you're comfortable with what's in it. To check the
script yourself before running it:
# Should print exactly one line: the session call
Select-String -Path .\Get-CognosInventory.ps1 -Pattern 'Method\s+(Post|Put|Patch|Delete)'
# Should print nothing at all
Select-String -Path .\Get-CognosInventory.ps1 -Pattern 'Invoke-Expression|IEX|DownloadString|FromBase64String'