2 posts tagged with "Monitoring"

Sometimes I get a script idea put in my head that's so irritatingly pervasive that the only fix is to write the damned script. David Szpunar from the NinjaOne Users Discord made a somewhat passing comment about time drift causing issues with a remote support tool and that let to me thinking... You could probably monitor for that with a PowerShell one-liner right?

Wrong! Turns out that it's more than one line!

The Script​

### Inline Comments

'<MARKED STRINGS>'

loading...

Using The Script​

We tested this as a "Script Result Condition" in NinjaOne set to trigger the monitor if a machine's time drifts by more than 10 seconds from uk.pool.ntp.org (the UK's NTP pool) and it worked like a charm. The script is pretty self-explanatory but here's a quick rundown of what it does:

1. It uses a configurable NTP or SNTP server to get the "reference" time. (Parameter -ReferenceServer)
2. It uses the w32tm executable to conduct a number of skew checks against that reference server (Parameter -NumberOfSamples)
3. It averages the samples and compares the result to the threshold (Parameter -AllowedTimeDrift)
4. Optionally you can force a resync if the time drift is greater than the threshold (Parameter -ForceResync)

If the average time drift is greater than the threshold, the script returns a non-zero exit code and the monitor triggers. If the w32tm command errors (non existent server, network down etc) the script returns a non-zero exit code and the monitor triggers.

Credits​

This script borrows ideas and the approach and a little code from the excellent blog of Kevin Holman.

The formidable Chris Taylor helped with a cool suggestion to suppress empty lines in the output and his site is well worth a visit.

About this script​

So firstly, if you haven't already, hit the giant orange button above to read the original blog post on CyberDrain.com to understand what this script is doing!

The problem with NinjaOne​

Many, if not most RMM platforms can run a script to monitor system state. NinjaOne is no different here - but there's a subtle irregularity in their approach that makes this complicated.

Most RMM platforms let you extract the contents of a variable from the script you run as a monitor - Ninja doesn't. It can read from the output of the script but that's all.

The fix​

Kelvin's script doesn't output much by default - the default success method generated by creating the directory with New-Item but that's it. To make this work with NinjaOne we need to modify Kelvin's script a little bit, it's quite simple really.

We need to silence that New-Item call by adding | Out-Null to the end and we need to "dump" the contents of the $ODErrors variable to the output.

We should end up with this:

loading...

You're going to want to add this as a script in NinjaOne by going to Administration -> Library -> Scripting. This script needs to run as System :-)

Monitoring output in NinjaOne​

The next step is deciding what to do with the output of the script in NinjaOne - so a brief digression to talk about script result monitors in NinjaOne.

In NinjaOne we go into Administration -> Policies -> Policy to add monitor to -> Conditions then we're going to Add a condition this gives us the new condition screen:

We want to hit Select a condition and then choose Script Result Condition which should give us the following screen:

So, let's get this setup and running:

• Evaluation Script: Select the script we uploaded above.
• Run Every: Select a value appropriate to your needs - we used 10 minutes.
• Timeout: We left this at the default.
• Result Code: Not used.
• With Output: This is where the magic happens, we want this to trigger when the output does not contain "Healthy" or "No User Logged In" - the regex for this (for easy copying) is (NotInstalled|ReadOnly|Error|OndemandOrUnknown|ScriptError) (basically a list of all the other statuses).

That's it - basic OneDrive monitoring. You can catch different cases using the Output filter e.g:

• To detect "ReadOnly" sync instances set it to trigger when the output contains "ReadOnly".
• To detect OneDrive not installed set it to trigger when the output contains "NotInstalled".
• To detect OneDrive in an error state set it to trigger when the output contains "Error".
• To detect Files on Demand or Unknown sync status set it to trigger when the output contains "OndemandorUnknown".

That's it - feel free to leave a comment if anything is unclear. Thanks to Kelvin for the inspiration on this!