Server Monitor Vs.3.6

Updated: 20 August 2020

This version works on the concept of plugins. There are three types of plugins:

1. Providers that provide or collect information about issues from various sources.
2. Aggregators that try to summarize the information
3. Loggers that do report the information in some form.

All three plugin types are implemented as 'support files' and have to be in the same directory as the main script.

The script first executes all providers. Any errors or warnings are stored in an internal data structure.

Then the aggregators try to eliminate redundant data.

Finally every logger is executed, each logger has access to the data and can use it however it wants.

• Usage
• Loggers
• Providers
• Aggregators
• Write your own provider
• Tips and Tricks
• Software Requirements
• Required User Permissions
• Download

Copy all the files into an empty directory. Copy 'example.xml' to 'ServerMonitor.xml' and open it in a text editor and adjust the settings.
Open a PowerShell console and navigate into your ServerMonitor directory:

.\ServerMonitor.ps1

If scripts are not enabled on your server, enable them:

set-executionpolicy remotesigned

You would usually schedule the execution of ServerMonitor with Windows Task Scheduler. I run it every 2 hours.

For more help use:

help .\ServerMonitor.ps1 -full

To show a bit more what it going on during the execution use:

help .\ServerMonitor.ps1 -verbose

After checking issues, ServerMonitor can log these issues using various Loggers. Each logger has to be implemented in a file sml*.ps1 in the same directory as ServerMonitor.ps1. It has to have one function named LogTo* where the variable part must be the same as the variable part in the file name. So a file smlEmail.ps1 must have a function LogToEmail

If the logger file is present, that function gets called. So if you don't want to use the logger just remove the file.

Your config file should always have a 'loggers' node. Each logger has a sub-node and on that an 'enabled' attribute. If the sub-node is missing or enabled is not 'true' the logger is not used.

<loggers>
  <console enabled="true" />
</loggers> 

<loggers>
  <file enabled="true" base="C:\mylogs\servermonitor_" />
</loggers> 

<loggers>
  <database enabled="true" connectionstring="Server=.;Database=master;Integrated Security=True;" />
</loggers> 

<loggers>
  <email enabled="true" 
    recipient="me@gmail.com" 
    recipientcc="webmaster@foo.net" 
    host="mail.myserver.com" 
    sender="servermonitor@mydomain.com" 
    subject="Server Monitor Issues on %computername%" 
    user="ausername" 
    password="apassword" 
    html="true" />
</loggers> 

Out of the box we have the following providers:

• DiskSpace
• WinEvents
• HyperV
• Services
• WinUpdate
• SQLCount
• FileCount
• IIS
• FileVersion
• UserCount
• EventLog
• Process Working Set Size
• Windows Feature Count
• Folder Size
• File Age
• Certificates

The usage of providers is configured in the XML configuration file.
Each provider has its own node with its name. Inside the node multiple 'check' nodes describe what the provider should do.
If you never want to use a certain provider, just delete the file for it from the directory.

  <diskspace>
    <check drive="*" min="30" />
  </diskspace>

  <diskspace>
    <check drive="C" min="50" />
    <check drive="F" min="20" />
  </diskspace>

  <foldersize>
    <check path="C:\temp" max="100MB" />
    <check path="C:\MyApps" max="2GB" />
  </foldersize>

Check the Windows event logs. Both the traditional logs 'System, Application and Security' and the newer 'Applicatios and Services' logs can be checked.
Every time the script runs, it stores the 'LastCheck' time in a file, and the next time it only looks for events after that time. You can override the LastCheck with the '-LastCheck' parameter.
You can filter the events because usually some of them are not that interesting, and some other ones you have decided to ignore.

<winevents>
  <check log="Application" types="error" sources="!Microsoft-Windows-LoadPerf" ids="" />
  <check log="Microsoft-Windows-TaskScheduler/Operational" types="error,warning" sources="" ids="!322,1024" />
</winevents>

<winevents>
  <check log="System" types="error" sources="Schannel,NetBT" ids="436" />
</winevents>

<winevents>
   <check log="Security" types="AuditFailure" sources="" ids="" />
</winevents>

<winevents>
   <check log="*" types="error"   sources="" ids="" />
   <check log="!WMI" types="warning" sources="!NTFS,disk," ids="" />
</winevents>

<winevents>
  <check log="Security" types="AuditFailure" sources=""/>
  <filters>
    <ignore enabled="true" id="5555" source="Security-Auditing" text="johndow">
      this happens because old Joe always gets his password wrong!
    </ignore>
    <ignore enabled="true" id="5551|5558" source="." text=".">
      ignore all these events, regardless
    </ignore>
  </filters>
</winevents>

• enabled = has to be 'true' to use this filter
• id = a regular expression to match the EventId to exclude
• source = a regular expression to match the source to exclude
• text = a regular expression to match the content of the event to exclude

<hyperv>
  <check name="web04"></check>
  <check name="sql01"></check>
</hyperv>

<services>
  <check name="w3svc" />
  <check name="workstation" />
  <check name="msssqlserver" />
</services>

<winupdate frequency="0" />

<sqlcount connectionstring="Server=.;Database=master;Integrated Security=True;">
  <check name="SimpleRecoveryModel" count="3" comparer="eq" >
    SELECT COUNT(*) FROM master.sys.databases WHERE recovery_model = 3
  </check>
  <check name="Logins" count="10" comparer="lt" >
    SELECT COUNT(*) FROM master.sys.server_principals
  </check>
</sqlcount> 

<filecount>
  <check name="AppHost" count="1" comparer="eq" filter="applicationHost\.config" folder="%windir%\System32\inetsrv\config\" />
  <check name="Several log files" count="3" comparer="gt" filter="log$" folder="E:\logs\" />
  <check name="Not too many temp files" count="200" comparer="lt" filter=".+" folder="Q:\temp\" />
</filecount>

<iis>
  <check type="apppool" uri="Live"></check>
  
  <check type="site" uri="mySite"></check>
  <check type="site" uri="yourSite"></check>
  
  <check type="http" uri="http://www.mySite.com"   pattern="My cool site"></check>
  <check type="http" uri="http://www.yourSite.net/welcome.php" pattern="Welcome to this site"></check>
</iis>

Compares the versions of Windows executables and DLLs in two directories. This is help if you have you files in various location and want to make sure there are up to date.

<fileversion>
  <check reference="C:\bin\myfiles\" target="C:\bin\otherfiles\" pattern=".+(dll|exe)$" reportmissing="0" compare="version" />
</fileversion>

Counts the active user accounts on the local machine.

<usercount>
  <check name="all Users"  count="7" comparer="lt" group="*" />
  <check name="Admins"     count="1" comparer="eq" group="S-1-5-32-544" />
  <check name="Users"      count="6" comparer="lt" group="users" />
</usercount>

As usual the name is just for the logs, the count and compare attributes work the same way as for other provider.
The group defines the Windows group to count the members for. '*' is a special value for all active users on the machine
Then name of the group has to be in the language of your system. For well known groups you can use the sid instead: 'S-1-5-32-544' for administrators or 'S-1-5-32-545' for users.

The WinEvents provider above only works on Windows Vista or newer. To run on XP and Server 2003 you can use the older EventLog provider. It only searches this older Windows NT event logs.

<eventlog 
  EventLogNameExpression="application|system" 
  EventSourceExpression="." 
  EventTypesToIncludeExpression="warning|error" 
  EventIdsToExcludeExpression="xxx" 
/>

There are no 'check' nodes, just a few attributes which are all regular expressions.
Here we look into the Application and System logs, for any sources or type warning or error. The 'xxx' is just a dummy for not excluding any IDs, you could specify the numeric IDs like '256|296|65932'.

<processworkingset>
  <check name="w3wp"     threshold="200MB" />
  <check name="sqlservr" threshold="2GB" />
</processworkingset>

  <winfeatures>
    <check name="countInstalled" type="count" count="62" comparer="eq" />
  </winfeatures>

  <foldersize>
    <check path="C:\temp" max="100MB" />
  </foldersize>

  <fileage>
    <check maxage="1440" folder="%USERPROFILE%\Documents\logs" recurse="false" filespec="mylog\.txt" />
  </fileage>

<certificates helper="C:\tools\sigcheck64.exe" store="machine" >
  <allow thumbprint="C6C2...ABCDE55381" remark="MyCA" /> 
</certificates>

Read more about this provider on my blog.

Aggregators are stored in sma*.ps1 files, one aggregator per file. They run between the providers and the loggers to summarize the information collected by the providers.
Often providers collect information about the same underlaying problem. The same problem listed in the Windows eventlog occurrs every 30 seconds. If you run ServerMonitor once an hour, you would get 1800 warnings for the same problem.
An aggregator allows you to specify the properties of the problem to aggregate all 1800 warnings into a single one.

There is currently only one aggregator, called Default, it groups all items with the same Logname,EventId,Source and EventType together and removes any duplicates.
It uses the info and DateTime from the first item, so any different information the removed items is not reported.

Multiple aggregators would be executed in order of their name, alphabetically sorted, each later aggregator can only work the the already aggregated data from it predecessors.

The following XML must be present in your config file to enable aggregators. You also need to enabled=true. The threshold for the default aggregator defines when to summarize items. In this case if we have 4 warnings from the same Logname,EventId,Source and EventType, they are treated as individual items in the report, but if we had 5, then they would be summarized into a single item.
The infoprefix text will be added in front of the text information led by the number of occurrances.

<aggregators>
  <default enabled="true" threshold="5" infoprefix="similar alerts to this:" />
</aggregators>

Create a new file. The name has to start with 'smp' and end in '.ps1'. Put it into the ServerMonitor folder.
Say you've created 'smpTapeDrive.ps1', then you need to add a function 'CheckTapeDrive' in your file.
This function is called by the ServerMonitor script:

function CheckTapeDrive()
{
  ...
}

  AddItem -info 'my text' `
  -Source 'my source' `
  -EventId 500 `
  -EventType 'Error' `
  -TheTime (Get-Date) `
  -LogName "TapeDrive Checker" `
  -MachineName $env:ComputerName 

  AddItem -info 'my text' -Source 'my source' 

If an error occurred in your provider, you should log it using the same AddItem function.
As the Id use one of the following:

$smIdUserNotAdmin
$smIdError
$smIdUnexpectedResult
$smIdItemNotRunning
$smIdConfigFileNotFound
$smIdConfigInvalid
$smIdAttentionRequired

ShowInfo([string]$info)

DPApiDecrypt([string]$data)

CheckForElevatedAdmin([string]$providerName)

ExpandEnvironmentVariables([string]$data)

By default the script is looking for a config file in the same directory as itself with the same name as itself but with an '.xml' extension.
If not found, it looks for a file computername.xml in its own directory.
You can also specify a different config file as the first parameter or using the -configfile option.

ServerMonitor.ps1 ... -LastCheck "2012-10-15 06:00" 

ServerMonitor.ps1 ... -LastCheck ((Get-Date).AddDays(-3))

ServerMonitor.ps1 -EncryptText "mySuperPa55w0rd"

• The text for some events comes from DLLs, it would be nice to figure out how to get to it.
• Enable execution on a remote server
• More error handling and testing

• Windows with PowerShell 4.0 or newer

• In the WinEvents provider, access to the security log wont work, if you don't need that you're fine.
• Enumerating the status of services does not work for normal users when running in task scheduler. You can fix this by changing permissions on the service. See this blog post for how to do this.
• The IIS Provider will not work