windows log file monitoring

[benjaminsmith]

HI,

So you are using NSClient with check_nrpe, and I believe you're hitting the error described in the stack exchange post below:

https://serverfault.com/questions/63999 ... nal-script

Check the file path in the NSClient.ini file, that might be wrong. We also have KB article on how to set up scripts with NSClient, I would recommend following the sample script in the article and try to get that working, and then move on to the plugin.

https://serverfault.com/questions/639991/nagios-nsclient-cannot-run-included-external-script

If you cannot get it working please, attach the nsclient.ini file to the post (remove any password or sensitive data). NCPA is our agent, so that's what we recommend for Windows systems as it's developed and supported by the team here.

--Benjamin

[localit]

I have batch files working in the same location.(scripts\)

here is the part of the config file


; A list of scripts available to run from the CheckExternalScripts module. Syntax is: <command>=<script> <arguments>
[/settings/external scripts/scripts]
test=scripts\test.bat
McAfee=scripts\McAfee.bat
McAfeeAM=scripts\McAfeeAM.bat
McAfeeENS=scripts\McAfeeENS.bat
modtime=scripts\modtest.ps1


my mcafee bat files work. but for ps1 file its not likening that

i have my service to look for modtime , which is suppose to run the modtest.ps1 file (i have it setup exactly like this for my bat files)


here is what i have in the ps1 as a test, let me know if thats wrong, just trying nagios folder mod time.

param (
[string]$file = "stop",
[string]$time
)
#########################
##
## vars
##
#################

$error.clear()
$response = ""
$crit = 0
$output = ""
$args = 0

cd ${env:ProgramFiles(x86)}\Nagios\

if ($file -eq "stop") {
Write-Output "no file name specified, stopping"
exit 3}

$lastwrite = (ls $file).LastWriteTime.Minute

if ( $lastwrite -gt $time) {
Write-Output "not modified in last " $time "120 minutes"
exit 2
}
Write-Output "modified in last " $time "120 minutes"
exit 0

[localit]

i also restarted nsclient service after i edited the config.

[localit]

I am able to see the ps1 file now by changeing to this in the config file.

modtime = cmd /c echo scripts\modtest.ps1; exit($lastexitcode) | powershell.exe -command


now my output in nagios is this :

At C:\Program Files\NSClient++\scripts\modtest.ps1:19 char:24
+ if ($file -eq "stop") {

+ ~

Use `{ instead of { in variable names.

+ CategoryInfo : ParserError: (:) [], ParseException

+ FullyQualifiedErrorId : OpenBraceNeedsToBeBackTickedInVariableName



my current ps1 file is this: I may not have the parameters set right for what im trying to achieve?


param (
[string]$file = "stop",
[string]$time
)
#########################
##
## vars
##
#################

$error.clear()
$response = ""
$crit = 0
$output = ""
$args = 0

cd ${env:ProgramFiles(x86)\Nagios\

if ($file -eq "stop") {
Write-Output "no file name specified, stopping"
exit 3}

$lastwrite = (ls $file).LastWriteTime.Minute

if ( $lastwrite -gt $time) {
Write-Output "not modified in last " $time "120 minutes"
exit 2
}
Write-Output "modified in last " $time "120 minutes"
exit 0

[localit]

thank you guys for your support, i figured it out. for the ps1 file it should look like this.

$lastWrite = (get-item "C:\conti.bmp").LastWriteTime
$timespan = new-timespan -days 0 -hours 0 -minutes 120

if (((get-date) - $lastWrite) -gt $timespan) {
Write-Output "2"
exit 2
} else {
Write-Output "0"
exit 0
}


This will output 2 if time is longer then 120min and then 0 if less then.

your service should point to modtime like stated above> which then points to the script which is located in script folder.

[gsmith]

Hi

I'm glad you were able to solve this, I am going to lock
this topic. You can always re-open it if you have more
questions.

Thanks