Monitoring Windows Service's that start with the same Prefix

[FrontlineIT]

Is there a way that I could run a check to check running windows services that start with the same prefix?
I currently have about 15 windows services on a host that start with the prefix VC3 then from there it could vary.
Ex: "VC3 School Service" or "VC3 School Service1, etc.

It would be optimal if I could just plug in "VC3" then a wildcard to accept anything after that to check all services are running with that prefix. Any help would be appreciated!

[dwhitfield]

Could you tell us a bit more about what you are trying to do? The following document goes over, among other things, the API as it relates to hosts: https://assets.nagios.com/downloads/nag ... gement.pdf . The API documentation for Services is under the Help menu.

There's not a way to plug in variables on the fly in XI, if that's what you are asking.

However, in Powershell, you can use wildcards like the following:
Get-Service | Where-Object {$_.name -like "VC3*"}

You can test with something simple like
Get-Service | Where-Object {$_.name -like "n*"}

You may need to open up Powershell as an administrator to get it to work.

You'll need to wrap that up in a ps1 file and have either NCPA or NSClient call it. You'll also need some logic to tell you about warnings and criticals, but that's the building block. Thanks to @cdienger for the tip!

[mcapra]

I think the check_service handler for NSClient++ can support such matches:
https://docs.nsclient.org/reference/win ... ck_service

Perhaps something like this:

Code: Select all

check_nrpe -H 192.168.142.137 -t 30 -c check_service -a "filter=name like 'VC3'"

You would still need to know the exact number of VC3 services that should be running, though. Even then, it would be difficult to tell which VC3 service specifically was down. Unless you refined your NSClient++ filter rule to include the whole list:

Code: Select all

check_nrpe -H 192.168.142.137 -t 30 -c check_service -a "filter=name in ('VC3 School Service', 'VC3 School Service1', ... 'VC3 School Servicen')"

If the remote machine is not currently running NSClient++, this documentation should be helpful:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf
https://assets.nagios.com/downloads/nag ... ios-XI.pdf

[dwhitfield]

Thanks @mcapra!

One thing I'd like to note about NSClient: be very careful about version #s. Our documentation is tested against the version #s tested. Going to the latest NSClient may break things. We did write NCPA, but looks like NSClient has a built in for you, so if this is the only thing you need to check, NSClient definitely seems like the better option here.

[FrontlineIT]

Thanks to you all. I will be going the powershell way to pull this info. I appreciate both of your feedback on this matter.

[bolson]

May we close this topic?

[FrontlineIT]

I was able to create a powershell script to ultimately pull all the VC3 services and output if there is a stopped windows service or not.
If I run the command, Get-Service -DisplayName "VC3*" | Where-Object {$_.Status -eq "Stopped"}, it would write to host all the services that are stopped or running.
Is there a way that I could output in a result the name of the services that are stopped? (I understand that the ps1 script below is checking services that are running).

$ok = 0
$warning = 1
$critical = 2

if (Get-Service -DisplayName "VC3*" | Where-Object {$_.Status -eq "Running"}) {
write-host OK - VC3 Services are running.
exit $ok
}
else{
write-host Critical - VC3 Service is NOT running!!!
exit $critical
}

[FrontlineIT]

This is what was done to do this:

Code: Select all

#Script to allow Nagios to run powershell script to check certain Windows Services
#Sets the outside parameter set from the NSC ini file

param(
   [Parameter(Mandatory=$true)][string]$service
   )

#This sets the values for ok, warn, critical
$ok = 0
$warning = 1
$critical = 2

#This creates the array bucket. It also pulls together which services we want to monitor and creates a variable.
$myarray = @()
$svc = Get-service -name "$service"

#For each item in the array that is "stopped" greater than 0, write host with a critical alert with the name ($k) - Stopped
#If it equals 0, write host "Ok"
foreach ($i in $svc){
if($i.status -eq "Stopped"){
$myArray += $i.Name
}
}
if($myarray.length -gt 0){
foreach($k in $myarray){
write-host ""$k " - Stopped,"| -NoNewline 
}exit $critical}


elseif ($myarray.length -eq 0){
write-host "OK - All Services are all running as expected."
exit $ok
}

[bolson]

Is it working as you hoped it would and returning the name(s) of the services which are stopped?

[FrontlineIT]

Sure is! Thank you all for your help. you can close now