Agentless Windows monitoring over WinRM

Prepare the Windows server

1. In an administrator PowerShell on the Windows machine, run Enable-PSRemoting -Force once.
2. Choose the account TarleyNode will use. A standard account in the Remote Management Users group is enough. It can be a local account such as monitor, or a domain account such as DOMAIN\monitor.
3. TarleyNode connects with WinRM on port 5985, using NTLM message encryption, so the server must be reachable on that port from TarleyNode.

Save the Windows login

1. Open Discovery › Credential profiles and choose Add.
2. Give it a Profile name, choose the Credential type Windows · WinRM, and enter the User name and Password.
3. Save. Logins are stored encrypted, and a login is only used on devices you assign it to.
4. Administrators can also create a login from a device’s page: under Logins, choose Assign (or Change), choose Create a new login if saved logins are listed, fill in the form and choose Create and assign.

Add the server and assign the login

1. Add the server with Discovery › Scan now, or with Devices › Add device.
2. On its page, under Logins, assign the Windows login. To use it for every Windows server a site finds, set it as the site’s Windows (WinRM) login.
3. Assigning the login adds Windows health (WinRM), which reports CPU, memory, disks and uptime.

Add the checks you need

Open the server’s page and choose Add check. These Windows checks use the same login, and each runs every minute unless you change its interval:

• Windows service (WinRM) watches a named service.
• Windows event log (WinRM) goes down while new matching events arrive, such as errors in System or failed sign-ins (event 4625 in Security), and recovers once no new matches arrive.
• Windows performance counters (WinRM) reads any Performance Monitor counter, such as \Processor(_Total)\% Processor Time, or common ones for CPU, memory, disks, TCP, IIS, ASP.NET, SQL Server and Exchange.
• Custom script (PowerShell, Windows) runs a PowerShell script as the Windows login. End it with exit 0 (OK), 1 (warning), 2 (critical) or 3 (unknown). Output in the Nagios plugin format works unchanged.

Hyper-V hosts

On a Hyper-V host, Hyper-V host (WinRM) counts virtual machines by state and flags failed replication, and Hyper-V virtual machine (WinRM) goes down when a virtual machine stops or its heartbeat is lost. For these two checks, the login must be in the host’s Hyper-V Administrators group.

Monitored from Linux

The TarleyNode server runs on Ubuntu or Debian and reaches Windows over WinRM, so nothing is installed on the Windows machines beyond turning on remoting. Windows servers at another location can be monitored from a connected site, which can itself run on Linux or Windows.

Under Rules, add thresholds on any value these checks report, such as disk space or a counter, and under Notifications choose who hears about it.

Databases and backups on the same server

• SQL Server: create a Database login with read access only. The check reports connection and query time and connections, and can graph a query that returns one number.
• Redstor backups (beta) use the Windows login: Redstor backup fails when a Redstor service stops, or when Redstor logged an error in the Application event log in the last 26 hours.

If it does not work

• If the check reports WinRM could not connect., confirm Enable-PSRemoting -Force was run, port 5985 is reachable from TarleyNode, and the account is in the Remote Management Users group.
• Windows performance counters (WinRM) names any counter the computer does not have, so a mistyped counter path is easy to spot.

Related

• Moving from PRTG to TarleyNode
• VMware monitoring
• All features
• Security

TarleyNode is offered by invitation while it is new. Request a demo to try it on your own network.