{ "checks": [ { "name": "CPU", "auto_add": true, "check_mode": "agent", "check_type": "agent_cpu", "parameters": {}, "sort_order": 0, "value_type": "gauge", "description": "", "check_config": {}, "is_telemetry": false, "interpretation": null, "threshold_crit": 95, "threshold_warn": 80, "interval_seconds": 60, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Memory", "auto_add": true, "check_mode": "agent", "check_type": "agent_memory", "parameters": {}, "sort_order": 1, "value_type": "gauge", "description": "", "check_config": {}, "is_telemetry": false, "interpretation": null, "threshold_crit": 95, "threshold_warn": 85, "interval_seconds": 60, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Disk", "auto_add": true, "check_mode": "agent", "check_type": "agent_disk", "parameters": { "crit": 90, "warn": 80 }, "sort_order": 2, "value_type": "gauge", "description": "", "check_config": { "crit": 90, "warn": 80 }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Uptime (h)", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "8114aeef-d413-5630-aa64-90173e3f8799" }, "sort_order": 3, "value_type": "gauge", "description": "", "check_config": { "script_id": "8114aeef-d413-5630-aa64-90173e3f8799" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Automatic Services", "auto_add": true, "check_mode": "agent", "check_type": "agent_services_auto", "parameters": { "exclude": [ "gupdate", "gupdatem", "sppsvc", "RemoteRegistry", "MapsBroker", "TrustedInstaller", "BITS" ] }, "sort_order": 4, "value_type": "status", "description": "", "check_config": { "exclude": [ "gupdate", "gupdatem", "sppsvc", "RemoteRegistry", "MapsBroker", "TrustedInstaller", "BITS", "edgeupdate*", "GoogleUpdater*", "MicrosoftEdgeElevationService" ] }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 120, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Overview", "auto_add": true, "check_mode": "agent", "check_type": "agent_overview", "parameters": {}, "sort_order": 5, "value_type": "info", "description": "Live-Telemetrie (CPU, RAM, Disks, Netzwerk, Top-Prozesse, Eventlog, Benutzer) für das Command Center Dashboard.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 30, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "System Event Errors", "auto_add": true, "check_mode": "agent", "check_type": "agent_eventlog", "parameters": { "log": "System", "level": "error", "minutes": "60" }, "sort_order": 5, "value_type": "status", "description": "", "check_config": { "log": "System", "level": "error", "minutes": "60" }, "is_telemetry": false, "interpretation": null, "threshold_crit": 5, "threshold_warn": 1, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Application Event Errors", "auto_add": true, "check_mode": "agent", "check_type": "agent_eventlog", "parameters": { "log": "Application", "level": "error", "minutes": "60" }, "sort_order": 6, "value_type": "status", "description": "", "check_config": { "log": "Application", "level": "error", "minutes": "60" }, "is_telemetry": false, "interpretation": null, "threshold_crit": 5, "threshold_warn": 1, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Netzwerk-Status", "auto_add": true, "check_mode": "agent", "check_type": "agent_network_state", "parameters": {}, "sort_order": 6, "value_type": "info", "description": "Interfaces, Listener, Verbindungen, Routing.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Failed Logons", "auto_add": true, "check_mode": "agent", "check_type": "agent_eventlog", "parameters": { "log": "Security", "level": "any", "minutes": "30", "event_ids": "4625" }, "sort_order": 7, "value_type": "status", "description": "", "check_config": { "log": "Security", "level": "any", "minutes": "30", "event_ids": "4625" }, "is_telemetry": false, "interpretation": null, "threshold_crit": 10, "threshold_warn": 3, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Sicherheit", "auto_add": true, "check_mode": "agent", "check_type": "agent_security", "parameters": {}, "sort_order": 7, "value_type": "info", "description": "Defender, Firewall, TPM, BitLocker, offene Ports, Zertifikate.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 3600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Unexpected Shutdown", "auto_add": true, "check_mode": "agent", "check_type": "agent_eventlog", "parameters": { "log": "System", "level": "any", "minutes": "1440", "event_ids": "41", "providers": "Microsoft-Windows-Kernel-Power" }, "sort_order": 8, "value_type": "status", "description": "", "check_config": { "log": "System", "level": "any", "minutes": "1440", "event_ids": "41", "providers": "Microsoft-Windows-Kernel-Power" }, "is_telemetry": false, "interpretation": null, "threshold_crit": 1, "threshold_warn": 1, "interval_seconds": 600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Lebenszyklus", "auto_add": true, "check_mode": "agent", "check_type": "agent_lifecycle", "parameters": {}, "sort_order": 8, "value_type": "info", "description": "Aktivierung, Domain, Update-Historie, BSODs, Backup.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 43200, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Inventar", "auto_add": true, "check_mode": "agent", "check_type": "agent_inventory", "parameters": {}, "sort_order": 9, "value_type": "info", "description": "Installierte Programme, geplante Tasks, Autostart, Dienste.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 21600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Service Crashes", "auto_add": true, "check_mode": "agent", "check_type": "agent_eventlog", "parameters": { "log": "System", "level": "any", "minutes": "60", "event_ids": "7031,7034" }, "sort_order": 9, "value_type": "status", "description": "", "check_config": { "log": "System", "level": "any", "minutes": "60", "event_ids": "7031,7034" }, "is_telemetry": false, "interpretation": null, "threshold_crit": 3, "threshold_warn": 1, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Hardware", "auto_add": true, "check_mode": "agent", "check_type": "agent_hardware", "parameters": {}, "sort_order": 10, "value_type": "info", "description": "CPU, Speicher, Mainboard, BIOS, Disks, GPUs, Akku.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 86400, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Zeitsynchronisation", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "89fe0f93-f62f-5dc8-8e6e-1a32105c3325" }, "sort_order": 11, "value_type": "gauge", "description": "Zeit-Offset zur Zeitquelle; warnt bevor Kerberos/AD bei ~300s Skew bricht.", "check_config": { "script_id": "89fe0f93-f62f-5dc8-8e6e-1a32105c3325" }, "is_telemetry": false, "interpretation": null, "threshold_crit": 120, "threshold_warn": 30, "interval_seconds": 60, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 } ], "profile": { "icon": "server", "name": "Windows Server Base Checks", "tags": [ "windows", "agent" ], "vendor": "generic", "category": "server", "os_family": "windows", "description": "Comprehensive Windows monitoring via Agent: CPU, RAM, Disk, Uptime, Services, Event Logs.", "ip_required": false, "port_layout": null, "visual_type": null, "snmp_enabled": false, "agent_capable": true, "requires_snmp": false, "description_md": "Comprehensive Windows monitoring via Agent: CPU, RAM, Disk, Uptime, Services, Event Logs.", "requires_agent": true, "sysoid_patterns": null, "sysdescr_patterns": null, "requires_collector": false }, "scripts": [ { "name": "Windows Uptime (Hours)", "script_id": "8114aeef-d413-5630-aa64-90173e3f8799", "is_builtin": true, "description": "Returns system uptime in hours", "interpreter": "powershell", "script_body": "try {\n $os = Get-CimInstance Win32_OperatingSystem -ErrorAction Stop\n $uptimeSpan = (Get-Date) - $os.LastBootUpTime\n} catch {\n Write-Output \"UNKNOWN - Uptime nicht ermittelbar: $($_.Exception.Message)\"\n exit 3\n}\n$totalH = [math]::Round($uptimeSpan.TotalHours, 1)\n$d = [int]$uptimeSpan.Days\n$h = [int]$uptimeSpan.Hours\n$m = [int]$uptimeSpan.Minutes\nif ($d -gt 0) { $human = \"${d}d ${h}h ${m}m\" }\nelseif ($h -gt 0) { $human = \"${h}h ${m}m\" }\nelse { $human = \"${m}m\" }\nWrite-Output \"OK - Uptime: $human | uptime=${totalH}h\"\nexit 0", "expected_output": "nagios" }, { "name": "Windows Time Sync Offset", "script_id": "89fe0f93-f62f-5dc8-8e6e-1a32105c3325", "is_builtin": true, "description": "Misst den Zeit-Offset (Sekunden) zur konfigurierten Zeitquelle via w32tm.", "interpreter": "powershell", "script_body": "$ErrorActionPreference = 'SilentlyContinue'\n\n# 1) Zeitdienst laeuft?\n$svc = Get-Service w32time -ErrorAction SilentlyContinue\nif (-not $svc -or $svc.Status -ne 'Running') {\n Write-Output 'CRITICAL - Windows-Zeitdienst (w32time) laeuft nicht'\n exit 2\n}\n\n# 2) Zeitquelle (Wert ist nicht lokalisiert)\n$src = (w32tm /query /source 2>$null | Out-String).Trim()\nif (-not $src -or $src -match 'Local CMOS Clock|Free-running') {\n Write-Output \"WARNING - Keine externe Zeitquelle (Quelle: $src) | offset=0s\"\n exit 1\n}\n$srcHost = ($src -split ',')[0].Trim()\n\n$status = w32tm /query /status /verbose 2>$null | Out-String\n\n# 3) Offset PRIMAER aus dem von Windows gepflegten Sync-Zustand lesen\n# (kein NTP-Roundtrip noetig, funktioniert auch wenn ausgehendes NTP zum\n# Peer geblockt ist oder der Host ueber den DC synchronisiert). Die\n# Offset-Zeile traegt je nach Sprache \"Phase Offset\" / \"Phasenabweichung\"\n# -> ueber \"offset|abweichung\" + Sekundenwert sprachunabhaengig gematcht.\n$offR = $null\nforeach ($line in ($status -split \"`n\")) {\n if ($line -match '(?i)(offset|abweichung)') {\n $m = [regex]::Match($line, '([+-]?[0-9]+[.,][0-9]+)\\s*s')\n if ($m.Success) {\n $offR = [math]::Round([math]::Abs([double]($m.Groups[1].Value -replace ',', '.')), 3)\n break\n }\n }\n}\n\n# 4) Fallback: aktive Messung gegen die Quelle (5 Samples, Mittel).\nif ($null -eq $offR) {\n $chart = w32tm /stripchart /computer:$srcHost /samples:5 /dataonly 2>$null | Out-String\n $mm = [regex]::Matches($chart, '([+-]?[0-9]+[.,][0-9]+)\\s*s')\n if ($mm.Count -gt 0) {\n $vals = foreach ($x in $mm) { [double]($x.Groups[1].Value -replace ',', '.') }\n $avg = ($vals | Measure-Object -Average).Average\n $offR = [math]::Round([math]::Abs($avg), 3)\n }\n}\n\nif ($null -ne $offR) {\n Write-Output \"OK - Zeit-Offset ${offR}s zu $srcHost | offset=${offR}s\"\n exit 0\n}\n\n# 5) Weder gepflegter Offset noch aktive Messung verfuegbar. Ist der Dienst\n# laut Stratum synchronisiert (1-15), gilt die Zeit als in Ordnung — die\n# exakte Offset-Zahl ist gerade nur nicht ermittelbar. KEIN irrefuehrendes\n# UNKNOWN (der fruehere Bug: pool.ntp.org als Quelle, stripchart geblockt).\n$stratum = $null\n$sm = [regex]::Match($status, '(?im)^\\s*Stratum\\s*:\\s*([0-9]+)')\nif ($sm.Success) { $stratum = [int]$sm.Groups[1].Value }\nif ($null -ne $stratum -and $stratum -ge 1 -and $stratum -le 15) {\n Write-Output \"OK - Zeit synchronisiert (Stratum $stratum, Quelle $srcHost; exakter Offset gerade nicht messbar) | offset=0s\"\n exit 0\n}\n\nWrite-Output \"WARNING - Sync-Zustand unklar: Offset nicht messbar und kein gueltiges Stratum (Quelle: $src)\"\nexit 1\n", "expected_output": "nagios" } ], "schema_version": 1 }