Empower your workflow with script-based monitors

A few weeks ago we released an incredible new feature called “Script-Based Monitors”. With Level we already have performance monitors for CPU, memory, and disk utilization. We also already have monitors that give insight into application health, like service monitors and process monitors. These “canned” monitors are great, but our clients are asking for more monitor types! With the introduction of Script-Based Monitors, it’s now possible to monitor ANYTHING about a device!

The idea behind a Script-Based Monitor is simple. A script (PowerShell, Bash, Zsh, or osquery) can be used to pull a value from the device. The scripts could be looking for anything. For example, the contents of a file, a registry setting, the disk SMART status, the users in the administrators group, an event log item, etc.

Let’s say that I want to trigger an alert if a device’s uptime is over 60 days. Here’s a PowerShell line that will pull the system uptime:

copy
PS C:\> (Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime | Select-Object -ExpandProperty TotalDays26.73075977536

In this case the uptime of the device returns 26.7 days.

If we create a script in Level with this command, then we can use it to create a monitor. In this case the “Script Output” section is set to watch for output that is greater than “60”. Once a device is found that exceeds that value, then an alert is generated!

This is just a simple example, but scripts can be much more sophisticated when necessary. We've put some ideas in our community Github repo. Here are some of our favorites:

1. check-temporary-accounts.ps1 will alert if there are any enabled user accounts that were obviously used for testing purposes. (User accounts containing "test", "temp", etc.)
2. check-disk-performance.ps1 will download and run Microsoft's diskspd.exe to benchmark the disk and alert if the latency or IOPS are poor.
3. event-log-monitor.ps1 will monitor the Windows event logs for an event ID specified.
4. software-installed.ps1 will alert if an application (and optionally a specific version of the application) is not installed.

We encourage you to contribute to the repo with your own ideas. Or if you have a really good idea but not sure where to start, send us a suggestion and we'll do our best to create a script that will meet your needs.

Start monitoring anything and everything today, and elevate your monitoring strategy to new heights with Level!