I was recently on a call with a few guys going over Network Monitoring. What started off as a quick call with one person... turned into a bit more of a formal training session with 4 or 5 people.

So, with their permission, I recorded it and after watching it back and I think it turned out quite well. I also asked the attendees if I could share it... and they gave their consent!! - Thanks guys!

This content has been requested from me for quite some time now, from both people in the community and my colleagues.. so, here it is!!

This video is about 1hr 20 min long and covers the following topics:

• Device Discovery
• Probe Registry items
• Creating Detection Templates
• Device Searches
• SNMP based remote monitors

Now, in the video... you will notice that some things worked just fine and maybe 1 or 2 things didn't. I even got a little confused as to what happened to a ticket... I decided to leave that in there and roll with it as I think it adds to the content, more than it does take away. I have been using this product for 8 years now... and even I still get things mixed up from time to time!! #EverythingIsFine 🔥 👀 😉

Video link: [DataDump] - Episode 3 - Network Monitoring in CW Automate - YouTube

Enjoy 👍

://mk

Enjoy!

HTML Files Attached for the code.  Feel free to edit the template to your hearts extent, and don't forget plenty of testing.

New_Template.html Template.html

I'll break it down here for people who want  a quick review without watching the entire show.

The goal: Determine which Virtual Machines are supposed to be running on the Host that are not actually running right now, and start them or make a ticket if they fail to start.

To identify these virtual machines I have to make sure I find machines that are either A) Not a replica B) If it is a replica, its the PRIMARY Replica. Additionally I have to confirm that the machine is supposed to be running. I use two methods to do this 1) I confirm that the VHD(x) was recently written to, and also confirm that the VM Settings itself is configured to start automatically.

I use the following Powershell Modules to determine what I listed above..

Get-VM

Get-VMReplication

Get-VMHardDiskDrive

Get-ChildItem

I use the following PowerShell parsing methods and logical processing to properly handle the data received from the above modules.

where

For-Each

If () { } else {}

My first step is to get a list of all Virtual Machines that are NOT in a running state. Specifically because there are other states (Starting, Shutting down) I limit my search to those that are either Saved or Off.

Get-VM | where {$_.State -in "Off","Saved"}

I'm using the "-in" logical comparison to match the value of the VM State retrieved from the Get-VM command to either Off or Saved. This will return any VM that isn't running. This is the base check.

Next we want to check for machines that are meant to be on. This is just an additional condition of looking for Virtual Machines that are configured to start automatically.

Get-VM | where {$_.State -in "Off","Saved" -and  $_.AutomaticStartAction -ne "Nothing"}

Using "-and" and "-ne" (not equals) I'm able to string a second check on the same VM object to exclude anything that is configured to DO NOTHING on reboot. 

My next  step is to get the VM Replication status, using the powershell module Get-VMReplication I will be returned with a list of all Virtual Machines that are replicas.This is similar to the Get-VM module except that I'm specifically getting ONLY Replicas. Using similar logic to above I know that I only want to get Virtual Machine replicas where the Primary Server is the same as the server that the name itself is running under.

Get-VMReplication -Mode Primary|?{$_.PrimaryServer -eq ([System.Net.Dns]::GetHostByName($env:computerName).HostName)}

If you look at Get-VMReplication you'll see a property "PrimaryServer" that has the full FQDN of the servername. The only way to get the FQDN in Powershell without using WMI is by tapping into .NET (which is faster) and that is the second part of the command. Combining addressing the DNS Namespace in .NET to retrieve the FQDN we combine it with the environment variable computername to generate the same string that would match within the PrimaryServer attribute. We now have a full list of VMs that exist on the VM as the primary replica copy.

Combining the first two modules together so we can get a single list of Virtual Machines the command will look like this.

Get-VM | where {($_.State -in "Off","Saved" -and  $_.AutomaticStartAction -ne "Nothing") -and ($_.Name -in (Get-VMReplication -Mode Primary|?{$_.PrimaryServer -eq ([System.Net.Dns]::GetHostByName($env:computerName).HostName)}).VMName)}

Note how we created separate groups in the logic, because two statements are AND but the second statement (the replica primary server) is going to be an OR against a final check -if Replica is even enabled at all. The final piece to point out is how I'm specifically selecting a specific property from the output by doing ".VMName" which is the value I want to compare against the $_.Name from Get-VM.

Adding in the final and last condition check to confirm that we're getting NON REPLICA Vm's as well as Replica VMs where the primary server is itself I'm going to adjust the code as follows.

Get-VM | where {($_.State -in "Off","Saved" -and  $_.AutomaticStartAction -ne "Nothing") -and ($_.Name -in (Get-VMReplication|?{$_.PrimaryServer -eq ([System.Net.Dns]::GetHostByName($env:computerName).HostName)}).VMName -or $_.ReplicationState -eq "Disabled")}

We now have  a list of VM's that are Off/Not Running, Configured to turn on automatically, will run on this host if it was on however we still don't know if the VM was recently used. Using Get-ChildItem and Get-VMHardDiskDrive I can pull out the path to the first VHD on the VM (which will always be the boot disk) and check the last write time. However note, that this can take some time and I only want to do this for the Virtual Machines that we know are supposed to be on. This means we need to create an If statement to see IF results are returned then we'll check for the Last Write TIme.

#Create variable containing all the Virtual Machines.
$VirtualMachines = Get-VM | where {($_.State -in "Off","Saved" -and  $_.AutomaticStartAction -ne "Nothing") -and ($_.Name -in (Get-VMReplication -Mode Primary|?{$_.PrimaryServer -eq ([System.Net.Dns]::GetHostByName($env:computerName).HostName)}).VMName)}

#Create If Statement and check if the variable is NULL
if ($null -ne $VirtualMachines) {
	#Loop through the virtual machines and check last write time
		$VirtualMachines|foreach {
			#create the actual check for the last write time, follow along as we nest additional modules within the IF Check
			if ( (Get-ChildItem (Get-VMHardDiskDrive -VMName $_.Name -ControllerLocation 0).Path).LastWriteTime -gt (Get-Date).AddDays(-2) ) {
				#Start VM
				Start-VM $_
				#Output Hostnames or VM Object
				$_
			} #end If statement for last write time
		} #end Loop statement
} # End If statement for Null variable, create else statement that no issues found.

else {Write-Host "No issues detected."}

The above script has been written in long hand with lots of comments to indicate what the script is doing. As you can see we're still sticking to the basics explained in previous examples of pulling information as we just overlay commands over with themselves to do more complex comparisons and matching.

The above script will do everything we need, you can remove the Start-VM line and just have it echo out the results or you can remove the $_ line by itself to remove the output from occurring in the event the machines start successfully.

Keep in mind about the Escape Characters, when using the above script in Automate Remote Monitor you will need it to be one line, and will need to call it in by executing the poewrshell interpreter directly. The full command to use in the remote monitor is as follows.

%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -command " & {$a = get-vm|? {($_.State -in \"Saved\",\"Off\" -and $_.AutomaticStartAction -ne \"Nothing\") -and ($_.ReplicationState -eq \"Disabled\" -or ($_.Name -in (Get-VMReplication -Mode Primary|?{$_.PrimaryServer -eq ([System.Net.Dns]::GetHostByName($env:computerName).HostName)}).VMName))}; if ($a){$a|% {if ((gci (Get-VMHardDiskDrive -VMName $_.Name -ControllerLocation 0).Path).LastWriteTime -gt (Get-Date).AddDays(-2)){Start-VM $_} }}else {Write-Host \"No issues detected.\"} }"

Using ";" to indicate line breaks to allow multi line scripts to be executed on a single line.

Regarding the remote monitor itself you can set it to be State Based by following the below screenshot.

The details of the state based conditions are covered more inside the video, and will not be covered in detail here. This post was just to cover the areas that I "rushed" through so that I could focus on Automate.

Please hit me up if you have any questions.

Automate 12 - Patch 7

After a rocky start with Patch 6, Patch 7 has been relatively stable with no known major issues. Be aware of potential issues with IIS though during the install - not a fault with the patch, but an issue with IIS and Microsoft's July patches. See here for more details: https://bit.ly/2Akrgoz

With that in mind, this is a good stable base to upgrade to if you’ve been waiting for a while to upgrade. I continue to be impressed with the speed of development for the new Automate Web App, and I’m sure we’ll see some good additions to it over the next few patches. Hopefully we will see the addition of a Current User/Last Logged on User column soon, it’s the only thing really stopping heavy usage for a lot of the engineers at my MSP.

Slack

We are now over 3000 users in our Slack, and growth doesn’t seem to be slowing down. Thanks to all Admins and members who contribute. If you’re not already in our Slack, you can join here - https://slack.labtechgeek.com/

We need your Feedback!

Thank you to everyone who has already filled in the Feedback form that has been posted in Slack for a few weeks, if you haven’t then we’d really appreciate getting your feedback on our GeekCast and LabTechGeek content in general: https://goo.gl/forms/FAC0m1Gua9fToit13

Agent response slow? Tired of waiting to interact with agents? Offline server alerts flaky? Your heartbeat may be broken

Following a conversation in the Slack just over a month ago, I asked a number of members in Slack to check whether their heartbeat was working or not – and a good 40% of the people that checked found this wasn’t working properly. When heartbeat isn’t working it can significantly impact on the day to day running of Automate. If you can answer yes to any of the questions in this sections title, I would advise you have a read of my article on how to identify, and fix problems with heartbeat: https://bit.ly/2OhOONr

LabTechGeek Downloads

Are you aware of this section of the LabTechGeek Forums? https://www.labtechgeek.com/files/ This is where we have started posting Scripts, SQL Definitions, Role Definitions and more. Over the upcoming months, we are going to start adding more content in here – and you can help. We are going to start giving trusted community members the ability to post files in here. If you want to contribute, please message me on Slack (@gavsto).

Some of my favourite ones in there so far:

https://www.labtechgeek.com/files/file/17-script-backup/ - Backup your LabTech Scripts into a folder hierarchy that matches the Automate script folders. Each time a script is exported, the last updated time and user information is included, providing multiple script revisions as it is changed over time.
https://www.labtechgeek.com/files/file/16-powershell-deployment-scripts/ - Powershell deployment scripts for Powershell 2,3,4,5? Yes please!
https://www.labtechgeek.com/files/file/8-bitlocker-enabled/ - Role definition to detect Bitlocker is enabled on a machine.

See you next month (ish)!

Gavsto and the LabTechGeek Admin Team

https://goo.gl/forms/EC2sPfxABaOZ8tfJ3