Windows Powershell - Check Proccess is Running

Hi All,

I’m just getting started with Icinga2, Director and Agents and I’m trying to monitor if a Java Application is running on the system using powershell

I’m almost there however Icinga returns a different result expected vs the running the script locally.

Here’s the command as defined in the Director.

object CheckCommand "Poweshell Check" {
import "plugin-check-command"
command = [
    "C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe"
]
arguments += {
    "-command" = {
        description = "Powershell Script to Run"
        order = -1
        value = "$ps_command$"
    }
    ";exit" = {
        description = "Exit"
        value = "$$LastExitCode"
    }
}
}

Heres the service template as defined in the Director

template Service "Application - ORPOS" {
  check_command = "Poweshell Check"
  max_check_attempts = "5"
  check_interval = 1m
  retry_interval = 30s
  check_timeout = 1m
  enable_notifications = true
  enable_active_checks = true
  enable_passive_checks = true
  enable_event_handler = true
  enable_perfdata = true
  icon_image = "/services/orpos.png"
  command_endpoint = host_name
  vars.ps_command = "& 'C:\\Company\\Icinga\\check-orpos.ps1'"
}

Finally here’s the Poweshell script “check-orpos.ps1”

# Count Processes
$Processes = @(Get-WmiObject Win32_Process -Filter {CommandLine LIKE '%oracle%' and name = 'java.exe'}).Count
  
if ($Processes -eq 1) {
            echo "OK: Oracle Retail Point-of-Service is running"
            $exitCode = 0
        }

if (-not $Processes) {
            echo "WARNING: Oracle Retail Point-of-Service IS NOT running"
             $exitCode = 1
        }
  
Exit ($exitCode)

If I run this locally in powershell I always get the correct result based on if the application is running or not, however Icinga always displays the result “WARNING: Oracle Retail Point-of-Service IS NOT running” regardless of the applications status.

Does anyone have any idea where I’m going wrong?

Running a script locally is typically done under different user context then the agent is running. Very common is to login as administrator and run a script. The agent is installed by default to run under NT AUTHORITY\Network Service.

Hi Roland,

Icinga Agent is running under “Network Service” on my device. Are you saying I should change this or change the command line to execute the script as an admin?

No, no, I just want to inform about a typical root cause. For a test you could change it to admin or LocalSystem. But in my opinion best option is to create a dedicated user and grant him as minimal as possible access that is needed.

Ahhh got you! Sorry my coffee clearly hasn’t kicked in yet.

Changed the service to Run as domain admin account and the scripts ran with no issues pulling back whats expected.

Thanks agian!