Monitor Windows Patching Reboots

[jkinning]

Each and every month we patch our Windows servers, normally the 3rd Sunday of the Month, which is our maintenance window. On a few occasions like this month the maintenance window gets moved up due to Holidays like Father's Day. We currently use IBM Tivoli Endpoint Manager, aka BIgFix, to patch our Windows servers. Several times now we have a few servers that don't get the reboot and causes production issues. I am tasked to see if Nagios Xi can be used to monitor the system to see if the reboot happened or not after the patching. So, I am wondering if anyone is monitoring for Windows Updates reboots and using Nagios to notify groups of the issue that after the patch the server didn't reboot. It sounds possible I am just not able to wrap my head around how to go about monitoring this action.

[rkennedy]

I believe there are multiple ways this could be done, but it will need to be done a bit backwards since you just need checks every few weeks, and not all the time. With that said, I would set these up without thresholds / notifications, and just use the XI interface to make sure they are all correct.

Looking at our Exchange I found one that works with WMI, https://exchange.nagios.org/directory/P ... MI/details

Another way is by monitoring the event logs for whatever indicates a reboot, https://outsideit.net/real-time-eventlog-monitoring/

The last option I can think of (there are probably other ways, too) is to just use a powershell script that tells you how long the machine has been up. There wouldn't be any thresholds with this, but you could add all of these to one service group for management purposes. This link https://4sysops.com/archives/calculatin ... ime-script has a nice paragraph that outlines using this code as a function. You can create a powershell that contains this -

Code: Select all

$os = Get-WmiObject win32_operatingsystem
$uptime = (Get-Date) - ($os.ConvertToDateTime($os.lastbootuptime))
$Display = "Uptime: " + $Uptime.Days + " days, " + $Uptime.Hours + " hours, " + $Uptime.Minutes + " minutes" 
Write-Output $Display

Feel free to modify it to your needs, perhaps adding thresholds is something you all would like to do. The output for those 4 lines will be similar to this, so you'd be able to see which machines have rebooted, and which have not. Uptime: 9 days, 4 hours, 59 minutes

[WillemDH]

With this plugin: https://outsideit.net/check-ms-win-updates/ you can check last successful update date on a Windows Server. Make it create a critical when it exceeds 32 days or so? (I'm using Reactor to install WSUS updates based on this output)
It also checks for pending reboot.

[lmiltchev]

jkinning, let us know if rkennedy and WillemDH answered your question.