Page 2 of 2
Re: windows log file monitoring
Posted: Fri Sep 17, 2021 9:26 am
by benjaminsmith
HI,
So you are using NSClient with check_nrpe, and I believe you're hitting the error described in the stack exchange post below:
https://serverfault.com/questions/63999 ... nal-script
Check the file path in the NSClient.ini file, that might be wrong. We also have KB article on how to set up scripts with NSClient, I would recommend following the sample script in the article and try to get that working, and then move on to the plugin.
https://serverfault.com/questions/639991/nagios-nsclient-cannot-run-included-external-script
If you cannot get it working please, attach the nsclient.ini file to the post (remove any password or sensitive data). NCPA is our agent, so that's what we recommend for Windows systems as it's developed and supported by the team here.
--Benjamin
Re: windows log file monitoring
Posted: Fri Sep 17, 2021 10:39 am
by localit
I have batch files working in the same location.(scripts\)
here is the part of the config file
; A list of scripts available to run from the CheckExternalScripts module. Syntax is: <command>=<script> <arguments>
[/settings/external scripts/scripts]
test=scripts\test.bat
McAfee=scripts\McAfee.bat
McAfeeAM=scripts\McAfeeAM.bat
McAfeeENS=scripts\McAfeeENS.bat
modtime=scripts\modtest.ps1
my mcafee bat files work. but for ps1 file its not likening that
i have my service to look for modtime , which is suppose to run the modtest.ps1 file (i have it setup exactly like this for my bat files)
here is what i have in the ps1 as a test, let me know if thats wrong, just trying nagios folder mod time.
param (
[string]$file = "stop",
[string]$time
)
#########################
##
## vars
##
#################
$error.clear()
$response = ""
$crit = 0
$output = ""
$args = 0
cd ${env:ProgramFiles(x86)}\Nagios\
if ($file -eq "stop") {
Write-Output "no file name specified, stopping"
exit 3}
$lastwrite = (ls $file).LastWriteTime.Minute
if ( $lastwrite -gt $time) {
Write-Output "not modified in last " $time "120 minutes"
exit 2
}
Write-Output "modified in last " $time "120 minutes"
exit 0
Re: windows log file monitoring
Posted: Fri Sep 17, 2021 10:41 am
by localit
i also restarted nsclient service after i edited the config.
Re: windows log file monitoring
Posted: Fri Sep 17, 2021 11:35 am
by localit
I am able to see the ps1 file now by changeing to this in the config file.
modtime = cmd /c echo scripts\modtest.ps1; exit($lastexitcode) | powershell.exe -command
now my output in nagios is this :
At C:\Program Files\NSClient++\scripts\modtest.ps1:19 char:24
+ if ($file -eq "stop") {
+ ~
Use `{ instead of { in variable names.
+ CategoryInfo : ParserError: (:) [], ParseException
+ FullyQualifiedErrorId : OpenBraceNeedsToBeBackTickedInVariableName
my current ps1 file is this: I may not have the parameters set right for what im trying to achieve?
param (
[string]$file = "stop",
[string]$time
)
#########################
##
## vars
##
#################
$error.clear()
$response = ""
$crit = 0
$output = ""
$args = 0
cd ${env:ProgramFiles(x86)\Nagios\
if ($file -eq "stop") {
Write-Output "no file name specified, stopping"
exit 3}
$lastwrite = (ls $file).LastWriteTime.Minute
if ( $lastwrite -gt $time) {
Write-Output "not modified in last " $time "120 minutes"
exit 2
}
Write-Output "modified in last " $time "120 minutes"
exit 0
Re: windows log file monitoring
Posted: Fri Sep 17, 2021 12:51 pm
by localit
thank you guys for your support, i figured it out. for the ps1 file it should look like this.
$lastWrite = (get-item "C:\conti.bmp").LastWriteTime
$timespan = new-timespan -days 0 -hours 0 -minutes 120
if (((get-date) - $lastWrite) -gt $timespan) {
Write-Output "2"
exit 2
} else {
Write-Output "0"
exit 0
}
This will output 2 if time is longer then 120min and then 0 if less then.
your service should point to modtime like stated above> which then points to the script which is located in script folder.
Re: windows log file monitoring
Posted: Fri Sep 17, 2021 2:36 pm
by gsmith
Hi
I'm glad you were able to solve this, I am going to lock
this topic. You can always re-open it if you have more
questions.
Thanks