Setup Telegraf+InfluxDB+Grafana to Monitor Windows

Monitoring Windows with Grafana is pretty easy, but there are multiple systems that have to be set up to work together.

Prerequisites:

  • Grafana
  • InfluxDB

Main Steps:

  1. Create an InfluxDB database and users for Telegraf and Grafana
  2. Install Telegraf on Windows and configure it
  3. Setup a data source and dashboards in Grafana

It really sounds more daunting than it is

InfluxDB setup

We want to create an InfluxDB database,  create a user for telegraf to write data into influx, and a user for Grafana to read data out of influx.  From an SSH terminal, the commands will be

influx
CREATE DATABASE telegraf
CREATE USER telegraf WITH PASSWORD 'telegraf123'
CREATE USER grafana WITH PASSWORD 'grafana123'
GRANT WRITE ON telegraf TO telegraf 
GRANT READ ON telegraf TO grafana

Install Telegraf

You can go to https://portal.influxdata.com/downloads to get links download the client for different OS’s. Grab the link for windows, which at this time is https://dl.influxdata.com/telegraf/releases/telegraf-1.5.3_windows_amd64.zip and download that file using whatever method suits you best.   Extra the contents to a location you like,  I use c:\Program Files\telegraf\.  now you will need to modify the contents of telegraf.conf, I like to use Notepad++ but any text editor should be fine.

I like to modify the section called [global_tags] and put machine identifiers in there.

[global_tags]
 environment = "production"

You can add as many different tags under there as you would like, it takes some time to figure out what will be useful here.

When you have that completed, update the section for InfluxDB with the needed info. Make sure to update the IP and the passwords to the correct ones for your install.  Also if needed on the destination machine add the port 8086

# Configuration for influxdb server to send metrics to
[[outputs.influxdb]]
 urls = ["http://192.168.86.167:8086"] # required
 database = "telegraf" # required
 precision = "s"
 timeout = "5s"
 username = "telegraf"
 password = "telegraf123"

Now run a command prompt as administrator. Change to the directory where you have telegraf and its config file and run the following command to test your config:

C:\Program Files\telegraf>telegraf.exe --config telegraf.conf --test

The output should include a bunch of lines like the following:

 >win_perf_counters,instance=Intel[R]\ Ethernet\ Connection\ [2]\ I219-V,objectname=Network\ Interface,host=DESKTOP-MAIN Packets_Received_Errors=0 1522202369000000000
 > win_perf_counters,instance=Qualcomm\ Atheros\ QCA61x4A\ Wireless\ Network\ Adapter,objectname=Network\ Interface,host=DESKTOP-MAIN Packets_Received_Errors=0 1522202369000000000
 > win_perf_counters,instance=Teredo\ Tunneling\ Pseudo-Interface,objectname=Network\ Interface,host=DESKTOP-MAIN Packets_Received_Errors=0 1522202369000000000
 > win_perf_counters,objectname=Network\ Interface,host=DESKTOP-MAIN,instance=Intel[R]\ Ethernet\ Connection\ [2]\ I219-V Packets_Outbound_Discarded=0 1522202369000000000
 > win_perf_counters,objectname=Network\ Interface,host=DESKTOP-MAIN,instance=Qualcomm\ Atheros\ QCA61x4A\ Wireless\ Network\ Adapter Packets_Outbound_Discarded=0 1522202369000000000
 > win_perf_counters,instance=Teredo\ Tunneling\ Pseudo-Interface,objectname=Network\ Interface,host=DESKTOP-MAIN Packets_Outbound_Discarded=0 1522202369000000000
 > win_perf_counters,instance=Intel[R]\ Ethernet\ Connection\ [2]\ I219-V,objectname=Network\ Interface,host=DESKTOP-MAIN Packets_Outbound_Errors=0 1522202369000000000
 > win_perf_counters,instance=Qualcomm\ Atheros\ QCA61x4A\ Wireless\ Network\ Adapter,objectname=Network\ Interface,host=DESKTOP-MAIN Packets_Outbound_Errors=0 1522202369000000000
 > win_perf_counters,instance=Teredo\ Tunneling\ Pseudo-Interface,objectname=Network\ Interface,host=DESKTOP-MAIN Packets_Outbound_Errors=2 1522202369000000000

If it doesn’t, it should include error information that will help you determine what the issue is.  Once that works, you can then install telegraf as a service by running the following:

C:\Program Files\telegraf>telegraf.exe --service install

The service will not start automatically the first time however,  so then to start it run

net start telegraf

Now you should have telegraf collecting data from windows on a regular basis and dumping that data into InfluxDB, the only thing remaining is to graph it

Grafana Setup

In Grafana, set up a new data source.  It should look like the following:

teelgraf source

Once that is set up, then you can go create a dashboard and add a graph.  I created the following graph:

Windows CPU Graph

The query is:

SELECT mean("Percent_Processor_Time") FROM "win_cpu" WHERE ("host" = 'DESKTOP-MAIN' AND "instance" != '_Total') AND time >= now() - 5m GROUP BY time(500ms), "instance" fill(linear)

This basically tells InfluxDB to go get all of the win_cpu values where the host tag is set as “DESKTOP-MAIN” and the counter instance is not _Total.  For CPU values this means it gets the individual totals so that I can graph each CPU. Make that an equals instead and you’ll get just the overall CPU usage instead of the breakdown.

Then I group by tag(instance) which is how you get one line (or series) per CPU (performance counter).  After that, I use an alias by to make the name “CPU ” followed by the instance value.  If you don’t do that, you end up with some funky named series that just aren’t pretty to look at.   If anyone finds this interesting (or even if they don’t probably) I will make a post about how to use template variables to generate a whole dashboard of graphs for a whole set of hosts automagically.

This is a lot the first time you do it, maybe even the second.  But it really pays off and gives you some amazing ways to monitor computers and servers and pays off big in the end.

Advertisements

Finding Recently Updated Files

So I needed to find what log files were getting updated.  The files where inC:\ProgramData\VMware\vCenterServer\logs and that folder has many many folders and I wasn’t sure which one would have the files I needed. I was sure that they would have been updated recently.  So a quick little PowerShell to the rescue

Get-ChildItem -Recurse | Where {$_.LastWriteTime -gt (Get-Date).AddMinutes(-15)}

This returns all the files in the current folder and below that have been modified in the last 15 minutes.  It is easy enough to change up to look for other criteria, like *.log files int he last 5 minutes

Get-ChildItem -Recurse -Filter *.log | Where {$_.LastWriteTime -gt (Get-Date).AddMinutes(-5)}

Or all files with pid in their name

Get-ChildItem -Recurse -Filter *pid*

Powershell can be very very handy in a pinch! Hope this helps

 

Finding a VM by MAC address

Sometimes you only have a MAC address.   Whether you are starting from a DHCP log, or DNS entry, or some other source, occasionally you have less info than you would like.  If you find yourself with only a MAC address and a bunch of VMs to dig through then PowerCLI can help you find the machine you want.  It might also give you some tools to audit your environment and make sure everything is actually exactly as you expect it to be.

Once in PowerCLI and connected to VCenter a simple command will list all Network Adapters in our vCenter

Get-NetworkAdapter -VM *

It is then just a matter of filtering this output to match the MAC address we have:

Get-NetworkAdapter -VM * | Where {$_.MacAddress -eq "00:50:56:B2:2E:D9"}

Now that you have the adapter for the Virtual machine you want you can get the VM you want by expanding the parent attribute:

Get-NetworkAdapter -VM * | Where {$_.MacAddress -eq "00:50:56:B2:2E:D9"} | SELECT -expand parent | FT *

You now have all the attributes of the parent machine you could want, maybe just select Name, Host, and notes to narrow it down so you can get right to your target machine.

Get-NetworkAdapter -VM * | Where {$_.MacAddress -eq "00:50:56:B2:2E:D9"} | SELECT -expand parent | SELECT name, vmhost, notes

As a bonus, when using this method we can switch the where clause out and hunt for partial MAC addresses:

Get-NetworkAdapter -VM * | Where {$_.MacAddress -like "00:50:56:B2:*:D9"} | SELECT -expand parent | SELECT name, vmhost, notes

or if you want to find the IP address of the host you can use Get-VMGuest

Get-NetworkAdapter -VM * | Where {$_.MacAddress -like "00:50:56:B2:*:D9"} | SELECT -expand parent | Get-VMGuest

I hope this helps someone else in their time of night hunting down a rouge machine(s) 🙂

References:

http://terenceluk.blogspot.com/2013/11/finding-virtual-machine-in-vmware.html
https://www.vmguru.com/2016/04/powershell-friday-getting-vm-network-information/

 

Query Microsoft DHCP Scopes

Sometimes you just have a ton of DHCP scopes and you just need to make sure they all have some specific options set the way you want. Scanning through them by hand can be a pain, so here is a quick script to scan over them rapidly.

Param(
 [Parameter(Mandatory=$True)]
 [string]$dnsServer,
 [string]$match,
 [string]$option
)
 $scopes = Get-DhcpServerv4Scope -ComputerName $dnsServer -ErrorAction:SilentlyContinue | Where {$_.Name -like "*$match*"}
 $Report = @()

ForEach ($scope In $scopes) {
 $row = "" | Select ScopeID, Name, Option
 $OptionData = (Get-DhcpServerv4OptionValue -OptionID $option -ScopeID $scope.ScopeID -ComputerName $dnsServer -ErrorAction:SilentlyContinue).Value
 $OptionData = (Get-DhcpServerv4OptionValue -OptionID $option -ScopeID $scope.ScopeID -ComputerName $dnsServer -ErrorAction:SilentlyContinue).Value
 $row.ScopeID = $scope.ScopeID
 $row.Name = $scope.Name
 $row.Option = $OptionData -Join ","
 $Report += $row
 }
$Report

 

This script takes a couple of parameters.  Match lets you specify the name of the scope so that you can filter it down by the specific scopes, and option lets you specify the attribute number you would like to report on and dnsServer lets you specify the server.  Some usage examples:

#report on each scopes gateway where the scope name has "vlan110"
.\dhcp_query.ps1 -dnsServer dhcpServer1 -match vlan110 -option 3

#report on each scopes DNS where the scope name has "vlan110"
.\dhcp_query.ps1 -dnsServer dhcpServer1 -match vlan110 -option 6

#report and then export into a CSV
.\dhcp_query.ps1 -dnsServer dhcpServer1 -match vlan110 -option 6 | Export-CSV -Path dns_voip_options.csv -NoTypeInformation

Finding AD Users that break inheritance

In Active Directory, certain users permissions can break inheritance. Their security settings can be changed so that they do not follow the OU (organizational unit) that they are a part of.  In cases like these permissions issues can become confusing and difficult to track down.

 In order to find them across all of your Active Directory, you can run a simple PowerShell command can be run:

 

Get-ADUser -Filter 'enabled -eq $true' -Properties ntSecurityDescriptor |  Where-Object { $_.ntSecurityDescriptor.AreAccessRulesProtected }

Export Excel file to PDF

If you want to automate the conversion from XLS to PDF, then PowerShell provides a very straight forward way to do it.  Create an Excel object, load the XLS file, write to PDF.

param(
    [Parameter(Mandatory=$true)]
    [string]$InputFileName,
    [Parameter(Mandatory=$true)]
    [string]$OutputFileName
    )

$xlFixedFormat = “Microsoft.Office.Interop.Excel.xlFixedFormatType” -as [type] 

$excel = New-Object -ComObject excel.application
$workbook = $excel.workbooks.open($InputFileName, 3)
$workbook.Saved = $true
$workbook.ExportAsFixedFormat($xlFixedFormat::xlTypePDF, $OutputFileName)
$excel.Workbooks.close()
$excel.Quit()

You then run the code with two parameters, source file, and destination file.

Source: https://blogs.technet.microsoft.com/heyscriptingguy/2010/09/06/save-a-microsoft-excel-workbook-as-a-pdf-file-by-using-powershell/ 

Forcing Users to Reset their Password

Sometimes you have a list of users that have had their accounts compromised.  In a recent incident we received a list of users from Google, that were suspected of having followed links to a phishing scam.  As a precaution we advised the users to reset their passwords, but being users many ignored this.  Since our google accounts are tied to AD it was easy to find out which ones had reset their passwords, remove them from the report and then use the remaining list of email addresses to force those accounts to reset their passwords.

The following script accepts a CSV file with a column labeled “email” and then loops over it. For each email address it finds the AD account with that email address and sets the ChangePasswordAtLogon to true, forcing the users to set a new password on their next login. This script will not match aliases but that would be a relatively easy addition.

param(
[Parameter(Mandatory=$true)]
[string]$FileName
)

$addresses = Import-CSV $FileName 

ForEach ($address in $addresses) {
  #couldn't get address.email to work in the filter, so had to work around it
  $email = $address.email
  $aduser = Get-aduser -Filter "emailaddress -eq '$email'"
  try {
    Set-ADUser $aduser -ChangePasswordAtLogon $true
  } catch {
    Write-Host "Failed to update $email : $_"
  }
}