• 0

method to expunge categories no longer applicable?


mnagel
 Share

Question

I have been trying to figure out a way to auto-remove categories added by PropertySources when they are no longer applicable (e.g., when something stops being an IIS server, SQL server, DHCP server, etc.). I have found recently this is an annoying problem as PropertySources-added categories live forever until manually removed and the modules cannot subtract AFAIK. OTOH, the method of adding a category is undocumented -- I only know about it from review of modules provided by LM, so perhaps there is a method that interprets a negation operator (like !) to remove the listed category?

I can think of other options, but they would require replicating what a PropertySource does and use the debugger (via API) to change system.categories.  Would prefer to avoid that as it would be pretty complex and using the debugger that way always makes me cringe when I consider the security implications :(.

  • Upvote 1
Link to comment
Share on other sites

2 answers to this question

Recommended Posts

  • 0

I am incorporating this into my resource check script.  For now, the first item I am testing is Windows_DHCP, which requires that the DHCP Server role is installed (we have an auto.winfeatures property that is populated by a PropertySource. I don't recall where we got it, somewhere in these forums IIRC :).  The PS code is simple:

hostname=hostProps.get("system.hostname")
my_query="Select NAME from Win32_serverfeature"
def session = WMI.open(hostname);
import com.santaba.agent.groovyapi.win32.WMI
def result = session.queryAll("CIMv2", my_query, 15);
println "WinFeatures=" + result.NAME

 

If this list does not include DHCP Server and we have Windows_DHCP assigned, it will trigger a warning.  I plan to extend this to catch more stale categories.

My check script tests a bunch of things, including lack of any FQDN or expected FQDNs, lack of NetFlow data (the new heartbeat datasource is not helpful there as it does not care if valid data arrives), and other stuff that can go wooorng.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share