Are there any examples how to monitor a windows server?

[lausser]

Hi,
did i not look carefully enough or aren't there any examples of typical windows scripts? Like cpu, memory, disk. If this agent is supposed to replace NSClient++, did you create a set of (ideally compatible regarding output and performance data) scripts for your internal use? Would it be possible to show them publicly?

[infraweavers]

Hiya,

It is primarily replacing the check_nrpe component of NSClient++; so any scripts that are being used with NSClient (i.e. powershell etc) will work with Monitoring-Agent. We are looking at bringing in performance counters as well (this would replace the check_nt element) if we can get a solid way of implementing it.

We have example client scripts here: https://github.com/infraweavers/monitoring-agent-scripts

I've also just pushed a few remote-script examples that we use to that repository (i.e. these are the plugins that would traditionally be executed with NRPE) -https://github.com/infraweavers/monitoring-agent-scripts/tree/main/remote-scripts

We have a go implementation (for performance reasons) of the client here: https://github.com/infraweavers/monitoring-agent-client (this is effectively the re-implemented check_nrpe)

[infraweavers]

Something that just came to mind that informs this conversation is that we currently have a branch that supports windows performance counters natively (as we still use NSClient++ in production for this at current, branch is:https://github.com/infraweavers/monitoring-agent/tree/os_specific_extension).
This would facilitate the monitoring of windows servers far easier with something like:

curl --include -k -u test:secret --request POST --data "{ ""CounterPath"": ""\\Memory\\Available MBytes"" }" https://127.0.0.1:9000/v1/os_specific

We would create another plugin that is similar in spirit to check_nt however it would have different params etc for that.

We're planning on switching out to use this in the next few months so we can remove NSClient++ entirely from our estate

[lausser]

I tried to setup a check with check_disks.ps1
Here, i guess i switched off everything relevant to security:

    "Security": {
        "DisableHTTPs": false,
        "SignedStdInOnly": false,
        "PublicKey": "RWTV8L06+shYI7Xw1H+NBGmsUYlbEkbrdYxr4c0ImLCAr8NGx75VhxGQ",
        "AllowedAddresses": ["::1/128","127.0.0.0/8","0.0.0.0/0"],
        "UseClientCertificates": false,
        "ClientCertificateCAFile": "PathToClientCertificateCAFile",
        "ApprovedExecutablesOnly": false,

But when i run a command, i get:

~/git/monitoring-agent-client$ ./monitoring-agent-client -host 192.168.1.233 -port 19001 -username test -password secret --executable='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' --script ../monitoring-agent-scripts/remote-scripts/windows/check_disks.ps1 -- -command -
got httpClient error Post "https://192.168.1.233:19001/v1/runscriptstdin": x509: cannot validate certificate for 192.168.1.233 because it doesn't contain any IP SANs:~/git/monitoring-agent-client$ 

The script (ps1 in this case) has to reside on the monitoring server's side, right? Because if i provide it as the path where i installed it on the windows server, i get:

:~/git/monitoring-agent-client$ ./monitoring-agent-client -host 192.168.1.233 -port 19001 -username test -password secret --executable='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' --script 'D:\TEMP\scripts\check_disks.ps1' -- -command -
error, could not load script file: open D:\TEMP\scripts\check_disks.ps1: no such file or directory

I tried this:

:~/git/monitoring-agent-client$ ./monitoring-agent-client -host 192.168.1.233 -port 19001 -username test -password secret --executable='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' --executableArg 'D:\TEMP\scripts\check_disks.ps1' -- -command -
script is not set:~/git/monitoring-agent-client$ 

So it looks like --script is mandatory and the script to run always has to reside on the monitoring server's side.

Could you please show an example how one would run a powershell script which is installed on the windows server?

[infraweavers]

Hiya,

    "Security": {
        "DisableHTTPs": false,
        "SignedStdInOnly": false,
        "PublicKey": "RWTV8L06+shYI7Xw1H+NBGmsUYlbEkbrdYxr4c0ImLCAr8NGx75VhxGQ",
        "AllowedAddresses": ["::1/128","127.0.0.0/8","0.0.0.0/0"],
        "UseClientCertificates": false,
        "ClientCertificateCAFile": "PathToClientCertificateCAFile",
        "ApprovedExecutablesOnly": false,

If you set "DisableHTTPs": false, to true then you'll get plaintext HTTP and the certificate errors will go away (as there is no handshake involved). However the perl script is still going to do https it looks like.

The script (ps1 in this case) has to reside on the monitoring server's side, right? Because if i provide it as the path where i installed it on the windows server, i get:

Correct, we've built this so that we have a central repository of plugins and scripts etc which are all on the monitoring box so we can deploy them in one place without doing infrastructure-wide deployments to update them etc. That said, it does support executing the script on the remote server however the plugins might not be built in a way that makes it obvious.

Apologies this is quite messy from a blank user perspective as we've always used curl to test the agent in an insecure configuration and then used the plugins once we've got TLS and code signing configured. I'll push a version of the client that uses this endpoint: https://github.com/infraweavers/monitoring-agent/wiki/endpoints#runexecutable and has optional HTTPS which should essentially clarify how to do what you're trying to do.

[infraweavers]

Actually, it already exists (https://github.com/infraweavers/monitoring-agent-scripts/blob/main/check_via_monitoring-agent.pl).

Just to clarify the differences:

• check_via_monitoring-agent.pl will run an executable that exists on the remote host on the remote host with arguments and return the result back to the OMD box.
• check_script_via_monitoring-agent.pl will run a script that exists on the OMD box on the remote host by feeding the script to the stdin of powershell, perl, python etc on the remote host depending on what you want to use; this is the way we monitor basically everything.

The annoying caveat of windows is that scripts aren't themselves executable, you "want" to do something like:

./check_via_monitoring-agent.pl --insecure --hostname=xxxxx --port=9000 --username=test --password=secret --executable=D:\\Scripts\\check_disks.ps1

however that will just return. You have to run powershell as an executable with the file passed in, so something like:

./check_via_monitoring-agent.pl --insecure --hostname=io --port=9000 --username=test --password=secret --executable='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -- -file "D:\Scripts\check_disks.ps1"

So those commands worked for me with monitoring-agent running on my desktop using the configuration file out of the repo (https://github.com/infraweavers/monitoring-agent/blob/master/configuration.json) which has all the security excluding some form of TLS off by default.

[lausser]

Hi Infraweavers? Something different...in the past there was an annual "Monitoring Workshop" of the german speaking community, last time it took place was 2019. We (Consol) are planning to reinstate this tradition and want to organize it in Q2/2024. The location will probably be in Heilbronn. If there are germans in your infraweavers team interested in joining us, then contact me at gerhard.lausser@consol.de :-)