|
os.windows.check-event-log
|
Measures the Windows event log against parameter thresholds and returns a **CRITICAL\\WARNING\\OK** event.
|
Usage:
- -w warning - Triggers a WARNING event if the event log count matching the pattern is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the event log count matching the pattern is above the CRITICAL parameter value specified in the check parameter.
- -e event level - Specifies the severity level of the event. Possible values: Information, Verbose, Critical, Warning, Error.
- -i - Unique event ID
- -d - The duration of time, in hours, in which you want to retrieve events from the Windows event log.
Usage example: `winchecks check-windows-event-log -w 5 -c 10 -e "Information" -l "Application" -d 24`
|
Check Event Log OK: The Event Log that matches the pattern is <matched count>
|
|
os.windows.check-event-log-count
|
Measures the Windows event log against parameter thresholds and returns a CRITICAL\\WARNING\\OK event.Provides information on the number of events that have occurred within a specified duration for a single log file and a single ID. Also indicates the filters to be applied to retrieve events for a specific single-valued windows event level and provider name.
Retrieving events from multiple log files is not supported. The number of events is provided, without details of each and every event.
|
Usage:
- -w warning - Triggers a WARNING event if the event log count matching the pattern is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the event log count matching the pattern is above the CRITICAL parameter value specified in the check parameter.
- -l log\_file - The log file to be monitored. Name of the file is written in double quotation marks.
- -r regex\_pattern - The regex pattern which filters out the description in the event log. Written in double quotation marks.
- -e event level - Specifies the severity level of the event. Possible values: Information, Verbose, Critical, Warning, Error.
- -i id - Unique event ID
- -d duration\_hour - The duration of time, in hours, in which you want to retrieve events from the Windows event log. Decimal points can be used; for example, 30 minutes - 0.5.
- -p provider\_name - Source of the event, written in double quotation marks.
Usage example: `winchecks check-windows-event-log -w 5 -c 10 -e "Information" -l "Application" -d 24`
|
Check Event Log OK: The Event Log that matches the pattern is <matched count>
|
|
os.windows.check-event-log-details
|
Collects and filters Windows Event logs based on the `duration_hour`, `event_log_level` and `log_file` values.
Retrieves and filters Windows event logs according to the provided parameters. It returns details about the events with CRITICAL, WARNING, or OK status, based on the specified severity level.
|
Usage:
- -d duration\_hour - Duration \(in hours\) from the current time to filter events \(Default: 24\).
- -e event\_log\_level - Filter the events based on the event level. Possible values are: Information, Verbose, Critical, Warning, Error. Multiple values are comma-separated \(Default: Information\). For example: Information, Warning
- -i id - Filters events based on the specified event IDs. For multiple IDs, values are comma-separated and enclosed in double quotation marks. For example: "1257, 1001"
- -l log\_file - Specifies the log file name to filter events. The name of the file is written in double quotation marks. Supports creating custom files and multiple values are comma-separated. \(Default: Application\). For example: "Application, System"
- -p provider\_name - The name of the event provider, enclosed in double quotation marks.
- -r regex\_pattern - Filters events by matching the event message with the specified pattern. Value must be enclosed in double quotation marks.
- -s servicenow\_event\_severity - Creates a servicenow event with the value given in this parameter. Possible values are: Critical, Warning and OK.
Usage example: `winchecks check-windows-event-log-details -d 24 -l Application -e Warning -r "*" -s Warning`
|
Check Event Log Details WARNING:
Type: Information, Category: Application, Machine: ws19-inc0061393.LOCAL.LAB, Event\_ID: 1704, Message: Security policy in the Group policy objects has been applied successfully., TimeCreated: 10/14/2024 12:09:35 AM.
Type: Information, Category: Application, Machine: ws19-inc0061393.LOCAL.LAB, Event\_ID: 16384, Message: Successfully scheduled Software Protection service for restart at 2124-09-20T06:25:44Z. Reason: Rules Engine, TimeCreated: 10/13/2024 11:25:44 PM.
Type: Information, Category: Application, Machine: ws19-inc0061393.LOCAL.LAB, Event\_ID: 16394, Message: Offline downlevel migration succeeded., TimeCreated: 10/13/2024 11:24:19 PM.
Type: Information, Category: Application, Machine: ws19-inc0061393.LOCAL.LAB, Event\_ID: 8224, Message: The VSS service is shutting down due to idle timeout., TimeCreated: 10/13/2024 11:51:36 AM.
|
|
os.windows.check-disk-name
|
Takes the storage drive name as input and verifies if the drive is present. Returns a **CRITICAL\\WARNING\\OK** value based on the parameter provided.
|
winchecks check-windows-disk-name <options>
-d : Disk name \(Default = C\)
Usage example:`winchecks check-windows-disk-name -d C`
|
Windows Checks OK: Disk storage C is present.
|
|
os.windows.check-processor-queue-length
|
Measures the process queue length against thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -w warning - Triggers a WARNING event if the processor queue length count matching the pattern is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the processor queue length count matching the pattern is above the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-processor-queue-length -w 5 -c 10`
|
Processor Queue Length OK: The Processor Queue length is 0.00
|
|
os.windows.check-system-cpu-load
|
Checks CPU Load by using typeperf. Measures the CPU load against configured thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -w warning - Triggers a WARNING event if the CPU load count matching the pattern is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the CPU load count matching the pattern is above the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-cpu-load -w 85 -c 95`
|
CPU Load OK: The total CPU utilization is 26.92%
|
|
os.windows.check-system-disk
|
Measures the free physical memory against thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -w warning - Triggers a WARNING event if the event log percentage matching the pattern is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the event log percentage matching the pattern is above the CRITICAL parameter value specified in the check parameter.
- -t fs\_type - Checks only volumes with the specified filesystem types.
- -m mount\_points - Checks only the specified mount points.
- -x ignore\_type - Skip volumes with the specified filesystem types.
- -i ignore\_mnt - Skip the specified mount points when collecting disk usage. Returns an error if a specified mount point does not exist in the system.
- -r ignore\_mnt\_regex - Skip volumes whose names match the given regular expression.
- -l ignore\_label - Skip volumes whose labels match the given regular expression.
Usage example: `winchecks check-windows-disk -w 85 -c 95`
|
Disk Usage Check OK: The disk usage is %
|
|
os.windows.check-system-memory-percent
|
Collects the RAM usage. Measures the memory usage against configured thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:- -w warning - Triggers a WARNING event if the memory use percentage matching the pattern is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the memory use percentage matching the pattern is above the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-ram -w 85 -c 95`
|
RAM Usage OK: The total memory utilization is 84%
|
|
os.windows.check-system-process
|
Query running processes to find running processes that match the given arguments \(pattern, name, both pattern and name. At least one must be given\). Measures the running processes against configured thresholds and filters, returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -n name - Process executable name to check the process execution.
- -p pattern - Pattern \(sub string\) to search for in the command that invoked the process. Produces valid results only if the user running the Agent owns the queried process has view permissions for the queried process.
- -w warnover - Triggers a WARNING status if the query returns more processes than those specified by the argument.
- -W warnunder - Triggers a WARNING status if the query returns fewer processes than those specified by the argument.
- -c critover - Triggers a CRITICAL event if the query returns more processes than those specified by the argument.
- -C critunder - Triggers a CRITICAL event if the query returns fewer processes than those specified by the argument.
Usage example: `winchecks check-windows-processes -n explorer`
|
Check Process OK:
OK Found 1 matching running processes named explorer
|
|
os.windows.check-directory
|
Verifies whether a Windows directory exists.
|
Usage: -d --directory Path to the relevant directory; use '\\' for separation.
Usage example: `winchecks check-windows-directory -d dir_path`
|
Check Directory OK: The directory 'C:/Users/Public' exists
|
|
os.windows.check-pagefile
|
Collects the **Pagefile** usage and compares it against the WARNING and CRITICAL thresholds.
|
Usage:
- -w warning - Triggers a WARNING event if the **Pagefile** usage is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the **Pagefile** usage is above the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-pagefile -w 75 -c 85`
|
Check Windows Page File OK: Page file usage at 31.63%
|
|
os.windows.check-free-physical-memory
|
Measures the free physical memory against configured thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -w warning - Triggers a WARNING event if the free physical memory is under the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the free physical memory is under the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-free-physical-memory -w 10 -c 5`
|
Free Physical Memory OK: The Free Physical Memory is 20.25%
|
|
os.windows.check-free-virtual-memory
|
Measures the free virtual memory against configured thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -w warning - Triggers a WARNING event if the free virtual memory is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the free virtual memory is above the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-free-virtual-memory -w 10 -c 5`
|
Free Virtual Memory OK: The Free Virtual Memory is 25.66%
|
|
os.windows.check-process-cpu
|
Processes CPU usage against configured thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -p processname - Process name to collect CPU usage.
- -w warning - Triggers a WARNING event if the CPU usage is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the CPU usage is above the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-process-cpu-p acc -c 95 -w 85`
|
Check Process CPU OK: Process CPU usage is 0.0000%
|
|
os.windows.check-process-memory
|
Processes memory usage against thresholds and returns a CRITICAL\\WARNING\\OK event according to the thresholds given in the accompanying parameters.
|
Usage:
- -p processname - Process name to collect memory usage.
- -w warning - Triggers a WARNING event if the process memory usage is above the WARNING parameter value specified in the check parameter.
- -c critical - Triggers a CRITICAL event if the process memory usage is above the CRITICAL parameter value specified in the check parameter.
Usage example: `winchecks check-windows-process-memory-p acc -c 95 -w 85`
|
Check Process Memory OK: Process Memory usage is 0.0149%
|
|
os.windows.check-user-account
|
Takes the list of user names as an input and verifies whether the user account is active. Returns a CRITICAL\\WARNING\\OK value.
|
winchecks check-windows-user-disabled \(options\)
-u : Comma separated List of User Name
Usage example: `winchecks check-windows-user-disabled- u Administrator,Guest`
|
User Name and Status
|
|
util.windows.check-windows-service
|
Verifes whether a Windows Service is present and returns the actual service state and service type reported by the Windows Service Control Manager \(`sc query`\), for example: `Service: 'X', Status: 'RUNNING', Startup Type: 'WIN32_OWN_PROCESS'`
Possible values:
- RUNNING
- STOPPED
- START\_PENDING
- STOP\_PENDING
- CONTINUE\_PENDING
- PAUSE\_PENDING
- PAUSED
|
Usage:
- -s, service - The service to check if running \(triggers an event with default severity of WARNING if the service is not running\).
- -e, non\_running\_services\_event\_severity - Sets the severity level for reporting events when the service is not running. The values can be either CRITICAL or WARNING \(Default: WARNING\).
- -G, skip\_events\_for\_nonexistent - Skips the event creation if the given service does not exist on the system when the parameter is active and value is true.
Usage example: `winchecks check-windows-service -s W3SVC -G false`
|
```
Service: '[ ]', Status: '[RUNNING/STOPPED/etc.]', Startup Type: '[WIN32_OWN_PROCESS/etc.]'
```
|