Nagios Conference 2011 - Michael Medin - Workshop: Scripting On The Windows Side

Scripting...…on the Windows side

These slides represent the work and opinions of the author and do not constitute official positions of any organization sponsoring the author’s work This material has not been peer reviewed and is presented here as-is with the permission of the author.The author assumes no liability for any content or opinion expressed in this presentation and or use of content herein.Disclaimer!It is not their fault!It is not my fault!It is your fault!

External ScriptsInternal ScriptsArgumentsScripting: Batch filesWrapped scriptsScripting: VBAInternal ScriptsAgenda

Windows monitoringNSClient++ (from a scripters perspecitve)

External ScriptsThe normal kind of scriptsCan be written in:BatchVBA/VBScript (pretty popular on Windows)Powershell (a rather strange language)But also:Perl, python, bash, etc etc…Internal ScriptsCan interact with (other) internal commandsCan access settingsCan hold stateCan be written in:LuaPython (requires python on the machine)Two kinds of scripts

Enable the check module[/modules]CheckExternalScripts= # Runs the scriptNRPEServer= # NRPE serverEach script requires a definition[/settings/External Scripts]check_es_test=scripts\test.batOptions disabled by default (for a reason)allow arguments = falseallow nasty characters = falseConfiguring External Scripts

Enable the check module[/modules]LUAScript=PythonScript=Each script requires a definition[/settings/LUA/Scripts]<alias>=test.lua[/settings/python/Scripts]<alias>=test.pyScripts requires NRPE/NSCA (or NSCP)[/modules]NRPEServer=Configuring Internal Scripts

Can be configured in many placesIs probably more confusing then it is worthThe server moduleMeans NO commands can have argumentsThe script moduleMeans NO external script can have argumentsAllow arguments

Writing our first ScriptsThe first batch script

Output:Use: echo <text>Don’t forget @echo off (or all commands will be echoed)Exit statuses:Use: exit <code>0 = OK1 = Warning2 = Critical3 = UnknownNSC.ini syntax:[/settings/External Scripts/scripts]my_script=scripts\script.batReference:http://www.ss64.com/nt/Don’t let preconceptions fool you: batch can actually do a lot!Writing a Script (Batch)

@echo offecho CRITICAL: Everything is not going to be fineexit 2A basic script (batch)

…\NSClient++\scripts>cmd /ctest.batCRITICAL: Everything is not going to be fine…\NSClient++\scripts>echo %ERRORLEVEL%2Running from Command Line

D:\demo>nscp --testNSClient++ 0,4,0,98 2011-09-06 x64 booting...Boot.ini found in: D:/demo//boot.iniBoot order: ini://${shared-path}/nsclient.ini, old://${exe-path}/nsc.iniActivating: ini://${shared-path}/nsclient.iniCreating instance for: ini://${shared-path}:80/nsclient.iniReading INI settings from: D:/demo//nsclient.iniLoading: D:/demo//nsclient.ini from ini://${shared-path}/nsclient.iniBooted settings subsystem...On crash: restart: NSClientppArchiving crash dumps in: D:/demo//crash-dumpsbooting::loading pluginsFound: CheckExternalScripts asProcessing plugin: CheckExternalScripts.dll asaddPlugin(D:/demo//modules/CheckExternalScripts.dll as )Loading plugin: Check External Scripts asNSClient++ - 0,4,0,98 2011-09-06 Started!Enter command to inject or exit to terminate...Running from NSClient

Enter command to inject or exit to terminate...my_scriptsInjecting: my_script...Arguments:Result my_script: WARNINGWARNING:Hello WorldRunning from NSClientCommandReturn StatusReturn Message

Writing our first ScriptsKilling notepad once and or all!

TASKKILL [/S dator [/U användarnamn [/P lösenord]]]] { [/FI filter] [/PID process-ID | /IM avbildning] } [/T][/F]Beskrivning: Det här verktyget används för att avsluta en eller flera aktiviteter utifrån process-ID (PID) eller avbildningsnamn.Parameterlista:… /FI filter Använder ett filter för att välja aktiviteter. Jokertecknet * kan användas, t.ex:imagenameeq note* /PID process-ID Anger process-ID för den process som ska avbrytas. Använd kommandot Tasklist för att hämta process-ID /IM avbildning Anger avbildning för den process som för den process som ska avslutas. Jokertecknet * användas för att ange alla aktiviteter eller avbildningar.Killing notepad once and for all!

@echo offtaskkill /im notepad.exe 1>NUL 2>NULIF ERRORLEVEL 128 GOTO errIF ERRORLEVEL 0 GOTO okGOTO unknown:unknownecho UNKNOWN: unknown problem killing notepad...exit /B 3:errecho CRITICAL: Notepad was not killed...exit /B 1:okecho OK: Notepad was killed!exit /B 0KILL!!!

NSC.ini syntax:[External Scripts]check_bat=scripts\check_test.batOr[Wrapped Scripts]check_test=check_test.batAdding a Script (.bat)

NSC.ini syntax:[External Scripts]check_test=cscript.exe /T:30 /NoLogo scripts\check_test.vbsOr[Wrapped Scripts]check_test=check_test.vbsAdding a Script (.VBS)

NSC.ini syntax:[External Scripts]check_test=cscript.exe /T:30 /NoLogo scripts\lib\wrapper.vbs scripts\check_test.vbsOr[Wrapped Scripts]check_test=check_test.vbsAdding a Script (.VBS) w/ libs

NSC.ini syntax:[External Scripts]check_test=cmd /c echo scripts\check_test.ps1; exit($lastexitcode) | powershell.exe -command -Or[Wrapped Scripts]check_test=check_test.ps1Adding a Script (.PS1)

[…/wrappings]bat=scripts\%SCRIPT% %ARGS%vbs=cscript.exe //T:30 //NoLogo scripts\lib\wrapper.vbs %SCRIPT% %ARGS%ps1=cmd /c echo scripts\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -[…/wrapped scripts]check_test_vbs=check_test.vbs /arg1:1 /variable:1check_test_ps1=check_test.ps1 arg1 arg2check_test_bat=check_test.bat $ARG1$ arg2check_battery=check_battery.vbscheck_printer=check_printer.vbs; So essentially it is a macro! (but a nice one)What is wrapped scripts?

Writing your first ScriptsWriting a simple VB script

Output:Use: Wscript.StdOut.WriteLine <text>Exit statuses:Use: Wscript.Quit(<code>)0 = OK1 = Warning2 = Critical3 = UnknownNSC.ini syntax:[External Scripts]check_vbs=cscript.exe //T:30 //NoLogo scripts\check_vbs.vbs //T:30 Is the timeout and might need to be changed.Reference:http://msdn.microsoft.com/en-us/library/t0aew7h6(VS.85).aspxWriting a Script (VBS)

wscript.echo ”Hello World"wscript.quit(0)Hello_World.vbs

Set <variable name>=CreateObject(“<COM Object>")There is A LOT of objects you can createA nice way to interact with other applicationsFor instance:Set objWord = CreateObject("Word.Application")objWord.Visible = TrueSet objDoc = objWord.Documents.Add()Set objSelection = objWord.SelectionobjSelection.Font.Name = “Comic Sans MS"objSelection.Font.Size = “28"objSelection.TypeText“Hello World"objSelection.TypeParagraph()objSelection.Font.Size = "14"objSelection.TypeText "" & Date()objSelection.TypeParagraph()Object oriented programming (ish)

strFile=”c:\windows”Dim oFSOSet oFSO=CreateObject("Scripting.FileSystemObject")If oFSO.FileExists(strFile) Thenwscript.echo”Yaay!"wscript.quit(0)elsewscript.echo“Whhh… what the f***!"wscript.quit(2)end ifAre we running windows?

Using the libraryDissecting a VBScript

Can be used to extend NSClient++Are very powerfulA good way to:Alter things you do not likeCreate advanced thingsAre written in Lua or PythonPossibly unsafeRuns inside NSClient++Internal Scripts

Internal scripts are fundamentally differentOne script is NOT equals to one functionA script (at startup) can:Register query (commands) handlersRegister submission (passive checks) handlersRegister exec handlersRegister configurationAccess configurationHandlers can:Execute queries (commands)Submit submissions (passive checks)Etc etc…Anatomy of an internal script

definit(plugin_id, plugin_alias, script_alias):conf = Settings.get()reg = Registry.get(plugin_id)reg.simple_cmdline('help', get_help)reg.simple_function(‘command', cmd, ‘A command…')conf.set_int('hello', 'python', 42) log(Answer: %d'%conf.get_int('hello','python',-1))def shutdown(): log(“Shutting down…”)A basic script

defget_help(arguments): return (status.OK, ‘Im not helpful ')def test(arguments): core = Core.get()count = len(arguments)(retcode, retmessage, retperf) =core.simple_query(‘CHECK_NSCP’, [])return (status.OK, ‘Life is good… %d'%count)A basic script

Michael Medinmichael@medin.namehttp://www.linkedin.com/in/mickemInformation about NSClient++http://nsclient.orgFacebook: facebook.com/nsclientSlides, and exampleshttp://nsclient.org/nscp/conferances/2011/nwcna/Thank You!

Nagios Conference 2011 - Michael Medin - Workshop: Scripting On The Windows Side

Recommended

More Related Content

What's hot (19)

Viewers also liked (6)

Similar to Nagios Conference 2011 - Michael Medin - Workshop: Scripting On The Windows Side (20)

More from Nagios (20)

Recently uploaded (20)

Nagios Conference 2011 - Michael Medin - Workshop: Scripting On The Windows Side

Editor's Notes