SCM PowerShell Script with Alerting (Formatting Changes)

Question

I have a PowerShell script that I am running using SCM profiles against all of my servers. It is simply "Get-LocalUser" which gets the local users on the server. 
 
 I have alerting set to create a ticket in Solarwinds Service Desk and send an email when a change in this script output is detected. 
 
 For some reason, Solarwinds likes to change the formatting of the text and it then triggers my alert as a false positive. Sometimes it truncates the data with "..." and then 5 minutes later, it doesn't and triggers the alert. 
 
 Of course, I have opened a ticket about this and because Solarwinds tech support is absolutely trash, it has taken them a week to tell me to restart alerting services even though I informed that the entire server has been rebooted multiple times since the SCM profile and alert have been created. Any idea on why this would be working like this? I have the exact same issue on another profile that checks the local administrator accounts on the server as well.

JoshuaSeevers · Accepted Answer

I kid you not a after you submitted this post, Solarwinds came back with an answer. 
 From the diagnostics it looks like every once in few days the script returns somehow shortened output but I cannot see the outputs. Powershell sometimes decides to truncate the output. It might help to be explicit about the formatting in the script, like this: Get-LocalUser | Out-String -Width 160 
 or even format the output differently: Get-LocalUser | Format-List -Property Name, Enabled, Description Can you try these formats to see if these show the difference in the comparison? I ended up implementing the second option and sitting on it. So far, I haven't had any false alerting. Coincidence that you posted that and then I get this email???????? You cracked the case!

mesverrum · Answer

Surprised that you are getting so little traction but i think its because the people are looking at this as a SW behavior thing to fix rather than just looking at it as a simple powershell problem. 
 SCM is just going to scrape whatever powershell displays, in exactly the format that powershell presents it. Try tacking this to the end of your commands to force powershell to not truncate its output. I don't know if orion has a max character width that they can display or process, but this should get the output more consistent. 
 
 | Ft -autosize | out - string - width 4096

SCM PowerShell Script with Alerting (Formatting Changes)

Top Replies