cancel
Showing results for 
Search instead for 
Did you mean: 

Script for monitoring Host Check in times

The attached scripts will log each unique device that sends a message to Kiwi into a dictionary and then alert you when a device has not sent a message within a specified number of seconds.

- It won't begin checking each device until the device has sent at least one message in.

- Threshold value is configurable by device IP, as well as allowing a default value.

- Interval value to keep nagging to a minimum when a device is out of commission.

- Script is divided in two to provide multiple monitoring options:

     - Monitor via scheduled Run-Script Action.

     - Monitor via Keep-Alive messages Run-Script Action.

     - All-in-One option to monitor status every time a message is received.

There are two scripts in the attached zip, the first script can be used as an all-in-one script if the bottom section is uncommented.

Version 3 fixes another bug in the all-in-one script option. The script was not pulling the last report age out of the dictionary to compare against interval causing an overflow so if you un-commented that section, the script would just error out and never successfully run.

In version 1.1 I've corrected the e-mail blast when using the all-in-one script option. There is now an interval setting, so if you have a threshold of 600 seconds and an interval setting of 300 seconds, the delinquent device would send an alert after 10 minutes of no activity and then alert every 5 minutes thereafter until the device responds again.

Also, be sure to read the comments in the script, as some basic editing for the alerts is necessary. You'll need to specify your alert settings, it defaults to 10 minutes. You also need to specify the e-mail settings within the script or it will not be able to alert you.

Don't forget to rate/like/share, etc... if you find the scripts useful.


Thanks,

Acy

Labels (1)
Attachments
Comments

Well, apparently the site doesn't allow minor versioning, so 1.1 is officially 2.0 or vice versa.

Let me know if you have any suggestions on improving the script. I thought about allowing interval settings per device, but I want to keep script editing to a minimum for those unfamiliar with scripting.

Great script Acy!  For those who do not want to email IP addresses, you can use the Fields.VarPeerName as long as the IP resolves to a hostname in DNS. If not, you can change the CASE statement and add your own HostName variable and then add it to the PIPE delimited set of values in the Dictionary Item.  For example...

With Dictionaries

  .StoreItem "CheckIn", Fields.VarPeerAddress, Cstr(ChkIn) & "|" & Now() & "|" & Now() & "|" & HName

End With

Then you can get it using the split command in the Reporting Script.

Cheers!

Rickey

Hi guys,

I was in littel bit , I have attached what's the setup i made. Now will i get the email alert any of one rules got failure or logs are not getting?

I was in littlesys3.jpgsys4.jpgsys5.jpg bit in confuse what are you guys said, here with I attached the setup what i made,kindly suggestSys1.jpgsys2.jpg

I think I might be misunderstanding what you are looking for. That script does essentially what mine does only it's not as configurable.

These scripts alert you when a device is not sending messages and need to be run in a rule that doesn't filter any messages out. Not scheduled.

If you want to know when a specific rule is or isn't getting triggered, that's a different story and a little more complicated. But let me know if that's what you want and I can try to come up with something. How often do you want to check and how often do you want to alert on each rule?

Actually... If that's what you want, let's take this conversation to your other post and not here.

Hi Acy,

Thanks for  your concerns!!!

I have some of the rules in the rules I already created some filter which was helping me to get the syslog(IP address base Filter) & log was storing in some disk where I mentioned in the action(log it).Now My point is when the logs are getting stop that time I want to get alarm through mailsys.jpgsys1.jpg.


Ok, so I think we are talking about the same thing. You want to know when 182.48.249.34 - 182.48.249.35 stop sending logs to kiwi right?

How often do they send logs? Do they send logs every second? At least every minute? Once or twice an hour? This answer will be your minimum poll rate.

How quickly do you want to know? This has to be higher than your minum poll rate.

Hi,

Log setting in the device it's 2 minutes interval. It means every 2 min the device will send the logs to this server.  Now My concerns is when it's getting stop or not receiving from the devices I should get the alarm from the kiwi log. The alarm should be designed for every one hour. It means every one hour it has to check it's not getting log it should give an alarm.

System Report Log Interval (minutes)

Ok, then this script will work for what you want but you'll need both scripts in my download. You'll need to put the Script_HostCheckIn.txt either in the rules you want to check, or if you want to check every device put the script in a rule for all logs.

You'll want to either specify each device by IP address (or hostname if make the change Rick suggested) or use the default CASE ELSE checkin value.

So instead of "3.3.3.3" put your IP address. And instead of 600, put 120. That's the number of seconds we're expecting between logs. So after an hour, it will let you know if the device has responded in the last 2 minutes and if not, it will let you know how many seconds it's been silent.

Next, put your e-mail information in the Script_CheckIn_Reporting.txt file and schedule this script to run every hour. I think that should do it for you.

rule 1.jpgrule.jpgSchedule.jpgHi,

Here with i attached what made the setting? could you please confirm whether it's right or not?

I tested that also As per the attachment 1.186.33.197 - sending logs, I have stopped for more than one hour. but it didn't give any alarm.

Script_HostCheckInv1_1 - i made it in the action

Script_CheckIn_Reporting - I made it in the schedule.

By default without script editing, this should set a 10 minute polling rate for each device...

1 - Make sure you put your e-mail information in the script.

2 - Make sure you have Kiwi setup to send e-mails and that that is working properly.

3 - Make sure the device you are monitoring sends at least one message after you have this setup. Each device has to register itself in the table in order to begin polling.

If you are still having problems and you are not getting any script errors, please post your changes to the scripts here so I can test. It looks like your rules are fine.

Thanks!

Hi,

I am scheduling the default script by Syslog which is Script_AlertOnMissingMessages to send email alerts when the hosts are not communicating to the Syslog server every hour. This does not seems to be working as I get alerts for all the server IPs listed in the script as not communicating. Please help me understand what I am missing. Thank you.

I believe that default script, much like mine needs to be run inside of a

rule that all of your hosts send their messages through like the default

rule. I created my script because I needed to measure host check ins all

the time and not just once an hour. So you can edit my script and specify

individual check in requirements per host, and the comments should explain

most everything.

That's why I created the 2nd script that can be scheduled, or you can also

setup keep alive messages in Kiwi and have the script run at a specific

interval that way.

Regardless, either way, you need to create that initial rule that doesn't

filter out any of your hosts and run this script or the default script as

an action in that rule. When one of your hosts hits the rule, the script

grabs the host info and checks it off as having communicated. When it gets

a message that's on the hour, it looks back at it's list of check ins,

compares against the list of hosts and tells you which ones haven't checked

in this hour.

Side note on that default script, the comment tells you to set up keep

alive messages, but doesn't tell you why. You need messages coming in once

per hour for the check in script to trigger that it needs to send the

alert. If I'm not mistaken, it only sends the alert every hour on the hour,

so the time needs to be xx:00 when a message triggers the script to run.

Let me know if you need any further assistance with this and I'll try to

help.

Aforsythe​, I have configured the default script - Script_AlertOnMissingMessages and it is sending Silent Hosts Alert without any issues every hour. But it is sending a mail alert, even if there no hosts in the list. The list will be blank as shown below:

There were no messages from the following hosts in the last 60 minutes:


Is there a way to generate email alerts only when the list has the IPs of the Servers not communicating?. Please let me know. Thank you.

In the default script you could check the value of MySilentHost and skip the email if it is empty.

In the host check in script, you'll get an individual email of any host that hasn't communicated, along with the number of seconds since the last communication and the interval that you set for that host. If you want to monitor all hosts at the same threshold level, you can simply use the "CASE ELSE" values rather than specifying each host individually. And you can set up the rules for this script the same as how you have the default script.

Aforsythe​, Thank you for your reply, please see the comment where I added If statement to check if MySilentHost is not empty to send emails. Currently this setup is not working for me. Any input is appreciated. Thanks again.

Dim MySplit
Dim MyLineSplit
ReDim MySilentHost(1)
Dim X
Dim C
Dim MySendTo, MySendFrom, MySubject, MyMsg

Main = "OK"

If Fields.VarInputSource = 3 then
   With Fields  
        ' Check to see if the minutes are "00" (on the hour)
        If Mid(.VarTime,4,2) = "00" then
       MySplit = Split(.VarGlobal01, "|")
           ' Loop through store and find any addresses that have not been active (contain :0)
           For X = 0 to Ubound(MySplit)
        MyLineSplit = Split(MySplit(X), ":")
               ' Add the IP address to the notification list
               If MyLineSplit(1) = "0" then
                  C = C + 1
                  If C > Ubound(MySilentHost) then ReDim Preserve MySilentHost(C+1)
           MySilentHost(C) = MyLineSplit(0)
               End if
           Next
           ' Notify by e-mail
           if Ubound(MySilentHost) > 0 then      ------------ Added this in default script to send mails only when the MySilentHost is not empty.
           MySendTo = "name@email.com"
           MySendFrom = "name@email.com"
           MySubject = "Silent Hosts Alert"
           MyMsg = "There were no messages from the following hosts in the last 60 minutes:" & vbCRLF & vbCRLF & Join(MySilentHost,vbCRLF)
           Call .ActionSendEmail(MySendTo, MySendFrom, MySubject, MyMsg)
           End if
        End if
        ' Now reset the store for the next hour
        Call InitializeStore
   End with
   Exit Function
End if

With Fields
    ' Initialize host string if not defined
    If Len(.VarGlobal01) < 2 Then
       InitializeStore
    End If
   
    ' Update entry
    S = InStr(.VarGlobal01, .VarPeerAddress & ":")
    If S > 0 Then
       L = Len(.VarPeerAddress)
       ' Mark the entry with a "1" to replace the "0"
       .VarGlobal01 = Mid(.VarGlobal01, 1, S + L) & "1" & Mid(.VarGlobal01, S + L + 2)
    End If
End With

End Function

Sub InitializeStore

        Fields.VarGlobal01 = "192.168.1.0:0"

End Sub

That should work, but just quick glance at the code makes me think that the array is being dimmed by one element larger than it needs to be so your Ubound(MySilentHost)  might always be returning zero.

Try

if MySilentHost(1) > 0 then

That should work, but can't remember whether the first element in an array in VB is 0 or 1, so if that generates an error, try MySilentHost(0) > 0.

Aforsythe​, thank you. Did not try this yet.

But I have configured your scripts - Host Check_In as action with all the IPs added with the required check in interval and schedule Reporting script to run hourly. It works perfectly fine, but is there a way to exclude to few IPs in Check In script?. I don't want the script to check on few IPs. Please let me know. Thank you and appreciate your help as always.

rajidass​,

You can either exclude the IPs from the rule, or set them specifically in the script for an extremely long check in. Either way, if they have already checked in and added themselves to the check in log, you may need to clear the log.

To clear the log, you can either restart the service, or you can run a script to either remove the entries you want out of the dictionary or delete the entire dictionary.

Aforsythe​, I am in a position that my organization wants to have just the default script which is Script_AlertOnMissingMessages to be configured to send alerts when the hosts are not communicating.

I have enabled Keep-Alive with 600 seconds. Added the script as Action in the same rule where the log file action is created.

Nothing seems to be working and not getting any email alerts when hosts are not communicating.

Tried restarting the service and also restarted the server. The script used to work fine before and not any more. Not sure what is causing the issue. Anyway to reset the settings or the dictionary?.

Any help is appreciated. Thank you as all ways for your help.

Aforsythe

Rule:

pastedImage_0.png

Schedule:

pastedImage_1.png

pastedImage_2.png

Input:

pastedImage_3.png

pastedImage_4.png

I'll try to set the script in my own environment and see what I can figure out.2 more questions though just to make sure we cover all the bases...You edited the script to add your email address? And listed your IPs in that variable in the script?I'll try to get this setup next week, we've got corporate inbound this week so no time for extra curricular activities.Sent from my Verizon, Samsung Galaxy smartphone

Aforsythe​, The script is working now. All I did was removed actions, schedules related to the script. Added it back again. It is working fine now without any issues sending alerts every hour.

But it sends alerts every hour even when the hosts list is empty. I tried adding the below to check if there is any IP address to send alerts:

1. If MySilentHost(1) > 0

2. If MySilentHost(0) > 0

3. If UBound(MySilentHost) > 0

None of the above worked. Any input on this will be very useful. No rush take your time. Thanks as always.

rajidass

Can you send me the modified script you are using? You can remove your IPs and just paste it here. I'll take a look at when I get a chance.

Also, has the script moved to a different rule? Or still in the top default rule?

Hi Aforsythe

The script is still in the top default rule and below is the script that is configured.

Function Main()

' This script will watch a list of sending hosts for incoming messages
' If the host has been silent during the hour, an e-mail will be sent.
' The notification is sent on the hour
' Enable the KeepAlive input and have it send a message every 60 seconds.

Dim MySplit
Dim MyLineSplit
ReDim MySilentHost(1)
Dim X
Dim C
Dim MySendTo, MySendFrom, MySubject, MyMsg

Main = "OK"

If Fields.VarInputSource = 3 then
   With Fields  
        ' Check to see if the minutes are "00" (on the hour)
        If Mid(.VarTime,4,2) = "00" then
       MySplit = Split(.VarGlobal01, "|")
           ' Loop through store and find any addresses that have not been active (contain :0)
           For X = 0 to Ubound(MySplit)
        MyLineSplit = Split(MySplit(X), ":")
               ' Add the IP address to the notification list
               If MyLineSplit(1) = "0" then
                  C = C + 1
                  If C > Ubound(MySilentHost) then ReDim Preserve MySilentHost(C+1)
           MySilentHost(C) = MyLineSplit(0)
               End if
           Next
           ' Notify by e-mail
           MySendTo = "name@email.com"
           MySendFrom = "name@email.com"
           MySubject = "Silent Hosts Alert"
           MyMsg = "There were no messages from the following hosts in the last 60 minutes:" & vbCRLF & vbCRLF & Join(MySilentHost,vbCRLF)
           Call .ActionSendEmail(MySendTo, MySendFrom, MySubject, MyMsg)
           End if
        ' Now reset the store for the next hour
        Call InitializeStore
   End with
   Exit Function
End if

With Fields
    ' Initialize host string if not defined
    If Len(.VarGlobal01) < 2 Then
       InitializeStore
    End If
   
    ' Update entry
    S = InStr(.VarGlobal01, .VarPeerAddress & ":")
    If S > 0 Then
       L = Len(.VarPeerAddress)
       ' Mark the entry with a "1" to replace the "0"
       .VarGlobal01 = Mid(.VarGlobal01, 1, S + L) & "1" & Mid(.VarGlobal01, S + L + 2)
    End If
End With

End Function

Sub InitializeStore

        Fields.VarGlobal01 = "192.168.1.0:0"

End Sub

Thank you for your help as always.

Hi guys,

Im sorry, I am new to Kiwi Syslog.

Does it has a tuto to install the script ?

Thanks,

boubou​,

Everyone is new at some point. The Kiwi documentation does explain how to setup and configure rules and even goes into some detail about writing your own scripts. The installation comes with some example scripts as well. I think there is enough information in this thread to help you get it the script here installed, but if you have any specific questions, I'll do my best to answer, but it has been a while since I was writing kiwi scripts.

Version history
Revision #:
1 of 1
Last update:
‎03-11-2013 03:44 PM
Updated by: