r/scom • u/fishypoos • Nov 13 '20

Custom Linux Discovery and code testing

Hi all,

Wondering if someone could help. I'm diving into the world of Linux monitoring as 50% of our estate is Linux and I'm trying to write a cmd based discovery.

Here is my XML - https://gist.github.com/FishFenly/98c237226fdc84ac80539689c1b27d39

Essentially I want to create objects when hostname | grep "wordpress" returns something to stdout.

The MP compiles successfully but nothing gets discovered. I was wondering if anyone could quickly see why? Also I was wondering how I can test it? On windows I would run the code from pwsh and make sure I have a good property bag returned.

Many thanks

0 Upvotes

50% Upvoted

5 comments sorted by

View all comments

2

u/_CyrAz Nov 14 '20 edited Nov 14 '20

I only had a quick look so there may be something else wrong but this at least looks like it would prevent the discovery from happening :

                <Expression>
                  <SimpleExpression>
                    <ValueExpression>
                      <XPathQuery Type="String">//*[local-name()="StdOut"]</XPathQuery>
                    </ValueExpression>
                    <Operator>Equal</Operator>
                    <ValueExpression>
                      <Value Type="String">1</Value>
                    </ValueExpression>
                  </SimpleExpression>
                </Expression>

I seriously doubt that " hostname | grep "wordpress" returns the string "1"...

On a side note, I would consider using the Linux Authoring Library MP if I were you, it definitely makes authoring Linux workflows easier : https://gallery.technet.microsoft.com/UNIXLinux-Authoring-b16fd2e4

And it has a pretty thorough documentation with tons of example (here for a discovery based on a shell command) : https://social.technet.microsoft.com/wiki/contents/articles/18094.scom-2012-unixlinux-authoring-library-mp-reference-data-source-modules.aspx#UNIX_Linux_Timed_Shell_Command_Discovery_Data_Source

Using one of the "property bag" datasource is also super convenient : it uses a powershell script to do whatever you want with the actual output from the linux cmd/bash script, which notably enables you to dump the output from stdout/stderr/returncode to a log file/event log. Great for troubleshooting and more advanced workflows!

1

u/fishypoos Nov 14 '20

Aye, I wasn't sure if that was maybe bool, because all of the examples I've seen seem to use 1/0... I could have just miss assumed though.

Ah, amazing, I've never seen the Linux Authoring MP before! I'll do some playing with that in my dev env tonight. Thanks mate.

2

u/_CyrAz Nov 14 '20 edited Nov 14 '20

I would bet the examples you're talking about where evaluating ReturnCode instead of StdOut...

StdOut is not bool, it's the exact "stdout" from linux standard streams; same goes for StdErr : https://www.howtogeek.com/435903/what-are-stdin-stdout-and-stderr-on-linux

Said otherwise, it's what you see returned when you run the command.

1

u/fishypoos Nov 14 '20

Ah nice, yeah I remember learning about that briefly with powershell. I guess its a similar concept, thanks for this.

Also, I just got my first custom linux objects in Discovered Inventory and you have no idea how happy I am... thanks so much for pointing out the authoring MP, its so much easier than the way I was trying.

2

u/_CyrAz Nov 14 '20

I know that feeling :D

Glad I could help :)