KnowDB
file

First seen , last seen .

watchdog-windows.ps1.mustache (b54c17bd6ce3b02a37fbf26ea49763e2627550fc3f9dfce7fea5e7110e8cefc3)

See also: watchdog-windows.ps1.mustache (filename)

The file watchdog-windows.ps1.mustache (1.8 kB), identified by its SHA-256 checksum. This file is found on 100 hosts in your infrastructure, at 3 different paths.

Policy sets
3.27.1 (b3b6ad10f5496f40)3.27.0 (1c477bc18a40a492)

1.8 kB, 22 lines:

$LOGFILE="{{{logfile}}}"

$long_running_cf_agent_threshold_min = 5
$long_running_cf_agent_count = @(Get-Process cf-agent -erroraction "silentlycontinue" | Where { $_.StartTime -lt (Get-Date).AddMinutes(-$long_running_cf_agent_threshold_min) }).count
$long_running_cf_agent_count_threshold = 1

If ($long_running_cf_agent_count -ge $long_running_cf_agent_count_threshold) {
    $DATESTAMP=Get-Date -Format "yyyy-MM-dd HH:mm"

    Write-Output "${DATESTAMP}: Count of long running cf-agent ($long_running_cf_agent_count) has met the threshold ($long_running_cf_agent_count_threshold) of long running agents, remediation triggered." | Tee-Object -FilePath "$LOGFILE" -Append
    Write-Output "${DATESTAMP}: Before remediation" | Tee-Object -FilePath "$LOGFILE" -Append
    Get-Process cf-agent -erroraction "silentlycontinue" | ft -erroraction "silentlycontinue" Name,CommandLine,StartTime,@{label="Elapsed Minutes";expression={[System.Math]::Round(((Get-Date)-$_.StartTime).totalminutes)}} | Tee-Object -FilePath "$LOGFILE" -Append

    Get-Process cf-agent -erroraction "silentlycontinue" | Where { $_.StartTime -lt (Get-Date).AddMinutes(-$long_running_cf_agent_threshold_min) } | Stop-Process -Force
    # Give the system a bit of time to kill all the processes
    sleep 1

    $DATESTAMP=Get-Date -Format "yyyy-MM-dd HH:mm"
    $running_cf_agent_count = @(Get-Process cf-agent -erroraction "silentlycontinue").count
    Write-Output "${DATESTAMP}: Observed $running_cf_agent_count cf-agent processes after remediation" | Tee-Object -FilePath "$LOGFILE" -Append
    Get-Process cf-agent -erroraction "silentlycontinue" | ft -erroraction "silentlycontinue" Name,CommandLine,StartTime,@{label="Elapsed Minutes";expression={[System.Math]::Round(((Get-Date)-$_.StartTime).totalminutes)}} | Tee-Object -FilePath "$LOGFILE" -Append
}