Script for monitoring Host Check in times

Well, apparently the site doesn't allow minor versioning, so 1.1 is officially 2.0 or vice versa.

Let me know if you have any suggestions on improving the script. I thought about allowing interval settings per device, but I want to keep script editing to a minimum for those unfamiliar with scripting.

Great script Acy!  For those who do not want to email IP addresses, you can use the Fields.VarPeerName as long as the IP resolves to a hostname in DNS. If not, you can change the CASE statement and add your own HostName variable and then add it to the PIPE delimited set of values in the Dictionary Item.  For example...

With Dictionaries

  .StoreItem "CheckIn", Fields.VarPeerAddress, Cstr(ChkIn) & "|" & Now() & "|" & Now() & "|" & HName

End With

Then you can get it using the split command in the Reporting Script.

Cheers!

Rickey

Hi guys,

I was in littel bit , I have attached what's the setup i made. Now will i get the email alert any of one rules got failure or logs are not getting?

I was in little bit in confuse what are you guys said, here with I attached the setup what i made,kindly suggest

I think I might be misunderstanding what you are looking for. That script does essentially what mine does only it's not as configurable.

These scripts alert you when a device is not sending messages and need to be run in a rule that doesn't filter any messages out. Not scheduled.

If you want to know when a specific rule is or isn't getting triggered, that's a different story and a little more complicated. But let me know if that's what you want and I can try to come up with something. How often do you want to check and how often do you want to alert on each rule?

Actually... If that's what you want, let's take this conversation to your other post and not here.

Hi Acy,

Thanks for  your concerns!!!

I have some of the rules in the rules I already created some filter which was helping me to get the syslog(IP address base Filter) & log was storing in some disk where I mentioned in the action(log it).Now My point is when the logs are getting stop that time I want to get alarm through mail.

Ok, so I think we are talking about the same thing. You want to know when 182.48.249.34 - 182.48.249.35 stop sending logs to kiwi right?

How often do they send logs? Do they send logs every second? At least every minute? Once or twice an hour? This answer will be your minimum poll rate.

How quickly do you want to know? This has to be higher than your minum poll rate.

Hi,

Log setting in the device it's 2 minutes interval. It means every 2 min the device will send the logs to this server.  Now My concerns is when it's getting stop or not receiving from the devices I should get the alarm from the kiwi log. The alarm should be designed for every one hour. It means every one hour it has to check it's not getting log it should give an alarm.

Ok, then this script will work for what you want but you'll need both scripts in my download. You'll need to put the Script_HostCheckIn.txt either in the rules you want to check, or if you want to check every device put the script in a rule for all logs.

You'll want to either specify each device by IP address (or hostname if make the change Rick suggested) or use the default CASE ELSE checkin value.

So instead of "3.3.3.3" put your IP address. And instead of 600, put 120. That's the number of seconds we're expecting between logs. So after an hour, it will let you know if the device has responded in the last 2 minutes and if not, it will let you know how many seconds it's been silent.

Next, put your e-mail information in the Script_CheckIn_Reporting.txt file and schedule this script to run every hour. I think that should do it for you.

Hi,

Here with i attached what made the setting? could you please confirm whether it's right or not?

I tested that also As per the attachment 1.186.33.197 - sending logs, I have stopped for more than one hour. but it didn't give any alarm.

Script_HostCheckInv1_1 - i made it in the action

Script_CheckIn_Reporting - I made it in the schedule.

By default without script editing, this should set a 10 minute polling rate for each device...

1 - Make sure you put your e-mail information in the script.

2 - Make sure you have Kiwi setup to send e-mails and that that is working properly.

3 - Make sure the device you are monitoring sends at least one message after you have this setup. Each device has to register itself in the table in order to begin polling.

If you are still having problems and you are not getting any script errors, please post your changes to the scripts here so I can test. It looks like your rules are fine.