Search the Community
Showing results for tags 'remote monitor'.
Found 4 results
This post is largely just being moved from another thread into its own topic, BUT I have updated the monitor so that it is much simpler to implement. This is how I test for DHCP Servers: I use the DHCP Test Utility from https://blog.thecybershadow.net/2013/01/10/dhcp-test-client/ along with a VBScript I wrote to manage the EXE. (By default the tool will use a random MAC, and each query will consume another DHCP Lease) This tool is testing DHCP Client operations, so it should NOT be run on the DHCP server. It should be run from agents that are in a position to act like DHCP clients. (Even if they have a static IP, it's OK.) To install: Extract the ZIP files. Put the dhcptest.exe and dhcptest-wrapper.vbs into your LTShare\Transfer\Monitors folder. You can pull your own copy of dhcptest.exe from https://github.com/CyberShadow/dhcptest if desired. I have not had any problems with only using the 32 bit binary on 64 bit OS versions, but YMMV. Edit "EXE - DHCPEnvironmentCheck.sql" and replace the current agent id (1183) with a valid agent ID for the monitor. Save and then import in Control Center -> Tools -> Import -> SQL File. This monitor runs every 15 minutes. The VBS script will be automatically transferred to the agent by Automate. When it runs, it will check for dhcptest.exe and automatically download it from your server. Once the tool is in place, the script will perform a DHCP query on each active network interface and return the number of offers and DHCP Server IP's that responded. The Monitor Result should match ".*;DHCPServersActive=1;.*", which should be set to the number of valid DHCP Servers. I find this effective for the group monitor, and when I need to tailor it I can just check "Override Settings" and change the result expected to match the environment. You could easily add the IP of the DHCP server as part of the match condition, so that not only must the number of servers be correct, but the server IP must match. (Probably not important). So a result with DHCPServersActive=0 is telling you that you failed to get any offers. This is clearly bad (unless there should be NO DHCP servers). Active=1 means you got an offer (Typical State). Active=2 is saying that you got more than 1 offer. This is clearly bad If only 1 server is authorized. There are some DHCP error conditions that will not be caught: All responses are specific to this agent, what you see may not match other agents because of: 1. DHCP Server Out of Leases - If it has an offer for you, it will treat it like a lease even if you don't respond. Additional queries will continue to return the IP the server has reserved for you, but the server would ignore other requests if there are no leases available. 2: DHCP Request Filtering errors - If the switch is configured for DHCP Snooping and is blocking other devices, again success for you only is getting confirmation that YOU can get a lease offer. 3. Malfunctioning DHCP Clusters - An issue I have seen that is a blend of #1 and #2. If there are two DHCP Servers in a cluster, your initial request MIGHT prompt a response from both, but once they reconcile and decide which server should respond to you the other server will ignore you so you won't see two responses. But if YOU are getting an offer from an operating server, if the other DHCP cluster host is broken it may be ignoring other client requests. So this has limited utility for testing that your DHCP server is working. But it is perfect for testing if unauthorized DHCP servers are running, or if your DHCP server is failing to offer any leases (even if the service is running, etc.) DHCPMonitorCheck.zip
Hi All, First time posting so please be nice . I've recently configured some HP Hardware monitoring (thanks Joe.McCall !) and now am getting alerts for some systems which is great. I now need to configure the following: 1. Drive failure should alert within 5 minutes. The remote monitor is set to run every 5 minutes, and is continuous.This takes care of this requirement but introduces an issue with ticket alerts being generated continuously. Changing the monitor to 'once' would fix this but would introduce another issue which I am trying to solve (below) 2. The ticket should re-open once daily if the issue is still present. This would 'protect' us if a tech closed the ticket without the issue being resolved. Technically I can address the above by creating two monitors, but then this would create two tickets for each alert. As an alternative, I could 'silence' the alerts for a period of time, perhaps 24 hours by default? I'm not sure how to do this, but coming from a Zabbix/Nagios background, I assume this is pretty simple? I would like to be able to do this anyway, or at least create an exception because another issue I have with the hardware alerts is that some will always fail. We have some HP servers with non-genuine memory and HP SNMP will report this as a failure. Without removing the server from the search group the SNMP checks are applied to, how can I create an exception? It looks like exceptions are only possible with Internal Monitors and not Remote Monitors? Any assistance would be greatly appreciated. Thank you!
On Windows Agents, LabTech assumes that all volumes have a drive letter associated with them. Volumes mounted to a path (CSV volumes, etc.) are not reported in the drive listing. This is a solution that uses a Remote EXE Monitor to dynamically detect mounted volumes and alert if the free space is below a configurable value. The batch file is a powershell wrapper that queries for mounted volumes with no drive letter and returns a list of all volumes with less that 10 percent free space. The free space level can be passed as a parameter, so it is easy to monitor for 20%, 5%, etc. All volumes have the same threshold however, there is no support for different thresholds on different volumes. The powershell section could also be extracted and used directly. On systems with no matching volumes, the result "No Mounted Volumes detected." is returned. If there are mounted volumes with no drive letter, the output will either be "All Mounted Volumes have above $FreeThreshold% space free.", or "Mounted Volumes at or below $FreeThreshold% free space:" with a list of all volumes that met the criteria. This was implemented as a remote EXE monitor. SQL is included to import the monitor definition to an agent (configured for agent ID 1). See the MountedVolumesFreeSpaceMonitor-README.txt file in the attachment for more details. After importing, the Ticket and Report Category and Alert Template should be verified or assigned to valid values. The monitor command is 'MountedVolumeDiskCheck.bat 10', where 10 represents the free space alert threshold. You can change threshold this globally if assigned to a group, or override the monitor on a per-agent basis to use a different threshold. After importing and testing this monitor on an agent, the monitor can be added to an appropriate group so that Windows Servers will be monitored automatically. The attachment has been moved. See https://www.labtechgeek.com/files/file/20-free-space-monitor-for-mounted-volumes/
Remote Monitor definitions are stored in the "agents" table. Monitor Results are stored in the h_agents table. To get the current state (results) for a remote monitor: SELECT computers.computerid, agents.AgentID, IF(IFNULL(groupagentscontrol.notgroupmaintained,1)=0,groupagents.name,agents.Name) AS AgentName, ELT(IF(h_agents.LastSuccessDate>h_agents.LastFailDate AND h_agents.LastSuccessDate>h_agents.LastWarningDate,1,IF (h_agents.LastFailDate>h_agents.LastWarningDate,2,3)), 'Success','Fail','Warning') AS LastState, ELT(IF(h_agents.LastSuccessDate>h_agents.LastFailDate AND h_agents.LastSuccessDate>h_agents.LastWarningDate,1,IF (h_agents.LastFailDate>h_agents.LastWarningDate,2,3)), h_agents.LastSuccessData,h_agents.LastFailData,h_agents.LastWarningData) AS LastData, ELT(IF(h_agents.LastSuccessDate>h_agents.LastFailDate AND h_agents.LastSuccessDate>h_agents.LastWarningDate,1,IF (h_agents.LastFailDate>h_agents.LastWarningDate,2,3)), h_agents.LastSuccessDate,h_agents.LastFailDate,h_agents.LastWarningDate) AS LastDate FROM computers JOIN agents ON computers.computerid=agents.computerid JOIN h_agents ON h_agents.agentid=agents.agentid LEFT JOIN groupagentscontrol ON groupagentscontrol.agentid=agents.agentid AND groupagentscontrol.computerid=agents.computerid LEFT JOIN groupagents ON groupagents.agentid=groupagentscontrol.groupagentid; This query will return all remote monitors (Remote and Network Monitors, associated to a computer). I included joins for the computers table so that you can match records from there, and for the tables that hold the configuration for group monitors so that you could also search for a monitor by the group agentid. A simpler query that ignores the group agent and computer relationships: SELECT agents.computerid, agents.AgentID, agents.Name, ELT(IF(h_agents.LastSuccessDate>h_agents.LastFailDate AND h_agents.LastSuccessDate>h_agents.LastWarningDate,1,IF (h_agents.LastFailDate>h_agents.LastWarningDate,2,3)), 'Success','Fail','Warning') AS LastState, ELT(IF(h_agents.LastSuccessDate>h_agents.LastFailDate AND h_agents.LastSuccessDate>h_agents.LastWarningDate,1,IF (h_agents.LastFailDate>h_agents.LastWarningDate,2,3)), h_agents.LastSuccessData,h_agents.LastFailData,h_agents.LastWarningData) AS LastData, ELT(IF(h_agents.LastSuccessDate>h_agents.LastFailDate AND h_agents.LastSuccessDate>h_agents.LastWarningDate,1,IF (h_agents.LastFailDate>h_agents.LastWarningDate,2,3)), h_agents.LastSuccessDate,h_agents.LastFailDate,h_agents.LastWarningDate) AS LastDate FROM h_agents JOIN agents ON agents.agentid=h_agents.agentid AND agents.computerid>0; For either query - To limit to a single computer id, include: WHERE agents.computerid='XXXX' To limit to a single monitor (agentid), include: WHERE agents.agentid='YYYY'