[hobbit] Monitoring AD

Hi Graeme,

try to ask to Galen to have support for adding your scripts. Thanks for your work.

Regards.

Massimo Morsiani Information Technology Dept.

Gilbarco S.p.a. via de' Cattani, 220/G 50145 Firenze, Italy tel: +39-055-30941 fax: +39-055-318603 email: massimo.morsiani at gilbarco.com web: http://www.gilbarco.it

-----Original Message----- From: Shea, Graeme A [mailto:Shea.Graeme.A at edumail.vic.gov.au] Sent: giovedì 7 agosto 2008 10.16 To: hobbit at hswn.dk Subject: RE: [hobbit] Monitoring AD

I'm happy to submit this one and the other windows scripts I have. I did try once but couldn't get it in for some reason. The shire has changed quite a bit since then so I just need to have another try.

Regards Graeme

-----Original Message----- From: Morsiani, Massimo [mailto:massimo.morsiani at gilbarco.com] Sent: Thursday, 7 August 2008 6:08 PM To: hobbit at hswn.dk Subject: RE: [hobbit] Monitoring AD

Hi Graeme,

how about adding it to The Shire?

Regards.

Massimo Morsiani Information Technology Dept.

Gilbarco S.p.a. via de' Cattani, 220/G 50145 Firenze, Italy tel: +39-055-30941 fax: +39-055-318603 email: massimo.morsiani at gilbarco.com web: http://www.gilbarco.it

-----Original Message----- From: Shea, Graeme A [mailto:Shea.Graeme.A at edumail.vic.gov.au] Sent: giovedì 7 agosto 2008 8.52 To: hobbit at hswn.dk Subject: RE: [hobbit] Monitoring AD

DCDiags and NetDiags are the basic tests to run. I run them both every morning using the VBscript below. I have hard coded in the ignore of some error messages that may not suit your application. I run the script as a scheduled task and it saves the flag(log) file to the path specified in the registry by BBWin (the big brother log path).

You need to make sure that BBWin (or the Big Brother client) is looking in the same directory. The original code at the being that gets this has been commented out and replace by the GetBigBrotherPath function. I would clean up the code but wouldn't be game to post it with out testing it first.

Hope this is the sort of thing you are after.

Regards Graeme

'-----------------------------------Start Code------------------------------------- Option Explicit '***********************************************************************

' Run DcDiag and NetDiag. Report result of tests to Big Brother. ' save copy of output to current folder to help diagnose any errors. ' 17/08/06 Graeme Shea ' Added ignor of dc link test. 05/09/06 Graeme Shea ' Fixed capialisation problem with ignore of dc link test. 07/09/06 Graeme Shea ' V1.3 Added ignore of concerrent error msg with error of dc link test. 14/09/06 Graeme Shea ' V1.4 Added ignore of WAN test. 1/10/06 Graeme Shea ' V1.4.1 Added ignore of FRS events from previous 24hrs. 3/12/06 Graeme Shea ' V1.4.2 Added ignore of a syslog event from previous 24hrs. 20/02 Graeme Shea ' V1.5.0 BBWin compatable. 20/02 Graeme Shea '***********************************************************************

Dim oShell,oFile,FSO,ExtPath, szResult, szOutPut, szDelay Const Version = "1.4.2"

Set FSO= CreateObject("Scripting.FileSystemObject")

szDelay = "+27h" 'Sets the PURPLEDELAY for this service check - change to match frequency of defrag

szOutput = ""

' Retrieve path to big brother log files ExtPath = GetBigBrotherPath Set oShell = WScript.CreateObject("WScript.Shell") 'On Error Resume Next 'ExtPath = oShell.RegRead("HKLM\SOFTWARE\Quest Software\BigBrother\bbnt\ExternalPath\") 'IF 64 bit system then reg file has moved and will raise an error. 'If Err then ' ExtPath = oShell.RegRead("HKLM\SOFTWARE\Wow6432node\Quest Software\BigBrother\bbnt\ExternalPath\") ' err.clear ' End if on Error GoTo 0

szResult = runoutput("cmd /C dcdiag.exe",1, "DcDiag.txt") szResult = lCase(szResult)

if instr(szResult, "failed test frsevent")>0 Then 'If the FRS is not working now will still raise error. I'm not very concerned ' if there was an error of some sort in the last 24hrs. szResult = Replace (szResult, "failed test frsevent", " ") szResult = Replace (szResult, "failing sysvol replication", " ") szOutPut = szOutPut & vbcrlf & "&yellow FRS Event Ignored. " 'MsgBox "in fail system log"

end If

if instr(szResult, "failed test systemlog")>0 Then 'If there are errors in the system log you have allready been advised ' no need to have a red dot for the whole day. szResult = Replace (szResult, "failed test systemlog", " ") szOutPut = szOutPut & vbcrlf & "&yellow System Log Error Ignored. " 'MsgBox "in fail system log" if instr(szResult, "browser service has failed to retrieve the")>0 Then 'MsgBox "The browser service has failed to retrieve the" szResult = replace (szResult, " failed to retrieve the", " ") szOutPut = szOutPut & vbcrlf & "&yellow Browser Error Ignored. " end If if instr(szResult, "service failed to see a directory server")>0 Then 'MsgBox "The browser service has failed to retrieve the" szResult = replace (szResult, "service failed to see a directory server", " ") szResult = replace (szResult, "service failed to see a directory server", " ") 'Error often in pairs szOutPut = szOutPut & vbcrlf & "&yellow Syslog reported a service couldnt see the directory server. " end If

end If

' msgbox "szOutput = " & szOutPut if instr(szResult, "fail") > 0 Then szOutPut = szOutPut & VbCrLf & "&red DcDiag test failed. " & VbCrLf & VbCrLf else szOutPut = szOutPut & VbCrLf & "&green DcDiag test passed. " & VbCrLf & VbCrLf end If

szResult = runoutput("cmd /C netdiag.exe",1, "NetDiag.txt") szResult = lCase(szResult)

if instr(szResult, "default gateway test . . . : failed")>0 then 'VicSmart Routers allways seem to fail gateway test so ignore szResult = replace (szResult, "default gateway test . . . : failed", " ") szResult = replace (szResult, "default gateway test . . . . . . . : failed", " ") szOutPut = szOutPut & vbcrlf & "&yellow NetDiag Default Gateway Test Failure Ignored. " & VbCrLf end If

if instr(szResult, "domain membership test . . . . . . : failed")>0 Then 'When the Big Brother client is running under the system account it cannot access ' the network to check domain membership. If you run under another account you ' can comment this section out (I think) szResult = replace (szResult, "domain membership test . . . . . . : failed", " ") szOutPut = szOutPut & vbcrlf & "&yellow NetDiag Domain Membership Test Failure Ignored. " & vbcrlf end If

if instr(szResult, "dc list test . . . . . . . . . . . : failed")>0 Then 'When the Big Brother client is running under the system account it cannot access ' the network to check domain membership. If you run under another account you ' can comment this section out (I think) szResult = replace (szResult, "dc list test . . . . . . . . . . . : failed", " ") ' This is an error message that occurs concurrntly and causes false detection of error szResult = replace (szResult, "failed to enumerate dcs by using the browser.", " ") szOutPut = szOutPut & VbCrLf & "&yellow NetDiag DC list test Test Failure Ignored. " & VbCrLf

end If

if instr(szResult, "wan configuration test . . . . . . : failed")>0 Then szResult = replace (szResult, "wan configuration test . . . . . . : failed", " ") szOutPut = szOutPut & VbCrLf & "&yellow NetDiag WAN configuration Test Failure Ignored. " & VbCrLf

end If

if instr(szResult, "fail")> 0 Then szOutPut = szOutPut & "&red NetDiag test failed. " & VbCrLf else szOutPut = szOutPut & "&green NetDiag test passed. " & vbcrlf end If

if instr(szOutPut, "fail")>0 then szOutPut = "red" & szDelay & " " & now & vbcrlf & vbcrlf & szOutPut else szOutPut = "green" & szDelay & " " &Now & vbcrlf & vbcrlf & szOutPut end if

Set oFile = FSO.OpenTextFile(ExtPath &"\dcdiags", 2, True) oFile.write(szOutput) oFile.WriteBlankLines(2) oFile.WriteLine "DCDiags Check, BBDCDiags.vbs Version " & Version oFile.close

Function RunOutput( cProgram, nWindowType, szTempFileName ) ' Run a program and save results to szTempFileName ' Got this routing of the net somewhere. Dim oFS Set oFS = CreateObject("Scripting.FileSystemObject") Dim oShell Set oShell = CreateObject( "WScript.Shell" ) oShell.Run cProgram & " > " & szTempFileName, nWindowType, True Dim oFile Set oFile = oFS.OpenTextFile(szTempFileName, 1, True) RunOutput = oFile.ReadAll() oFile.Close Set oShell = Nothing End Function

function Convert2Text(sTemp) ' Converts non printable characters to " " , so that Textfile is working dim loopcount, tempwert, inttest tempwert="" for loopcount = 1 to len(sTemp) ' replace all unprintable characters maybe easier and faster with RegEx inttest = ascw(mid(sTemp,loopcount,1)) 'if ((inttest>=32) and (inttest<127)) or (inttest=10) or (inttest=13) or (inttest=9) then if ((inttest>=32) and (inttest<127)) then tempwert = tempwert & chr(inttest) ' printable Character or CR LF TAB else tempwert = tempwert & " " end if 'tempwert = tempwert & chr(ascb(mid(sTemp,loopcount,1))) next Convert2Text = tempwert end function

' Get path to external log files (for BB 1.08d) Function GetBigBrotherPath() Dim ExtPath On Error Resume Next ExtPath = wshShell.RegRead("HKLM\SOFTWARE\Quest Software\BigBrother\bbnt\ExternalPath\") If IsEmpty(ExtPath) Then ExtPath = wshShell.RegRead("HKLM\SOFTWARE\BBWin\tmppath") End If If Not IsEmpty (ExtPath) Then 'If not empty then we have 32bit machine b64Bit = False End If If IsEmpty(ExtPath) Then ExtPath = wshShell.RegRead("HKLM\SOFTWARE\Wow6432node\Quest Software\BigBrother\bbnt\ExternalPath\") End If If IsEmpty(ExtPath) Then ExtPath = wshShell.RegRead("HKLM\SOFTWARE\Wow6432node\BBWin\tmppath") End If

If Not IsEmpty(ExtPath) And isEmpty(b64Bit) Then b64Bit = True err.clear End If

If IsEmpty(ExtPath) Then 'Put exit stuff here End If on Error GoTo 0 GetBigBrotherPath = ExtPath End Function

'-----------------------------------------End Code---------------------------------------------------------------

-----Original Message----- From: Everett, Vernon [mailto:Vernon.Everett at woodside.com.au] Sent: Thursday, 7 August 2008 3:20 PM To: hobbit at hswn.dk Subject: [hobbit] Monitoring AD

Hi all

Anybody got anything that keeps an eye on AD?

While I am asking, what about M$-Exchange?

Cheers Vernon

P.S. Guess who just a bunch of Windoze servers added to Hobbit. :-(

NOTICE: This email and any attachments are confidential. They may contain legally privileged information or copyright material. You must not read, copy, use or disclose them without authorisation. If you are not an intended recipient, please contact us at once by return email and then delete both messages and all attachments.

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

Important - This email and any attachments may be confidential. If received in error, please contact us and delete all copies. Before opening or using attachments check them for viruses and defects. Regardless of any loss, damage or consequence, whether caused by the negligence of the sender or not, resulting directly or indirectly from the use of any attached files our liability is limited to resupplying any affected attachments. Any representations or opinions expressed are those of the individual sender, and not necessarily those of the Department of Education and Early Childhood Development.

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee.
Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

Important - This email and any attachments may be confidential. If received in error, please contact us and delete all copies. Before opening or using attachments check them for viruses and defects. Regardless of any loss, damage or consequence, whether caused by the negligence of the sender or not, resulting directly or indirectly from the use of any attached files our liability is limited to resupplying any affected attachments. Any representations or opinions expressed are those of the individual sender, and not necessarily those of the Department of Education and Early Childhood Development.

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee.
Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.