Monitoring like the NSA

In Connectwise Automate monitors are the system that monitors agents and the database for specific states. It will automatically trigger based on the criteria provided, and can preform any number of tasks based on the assigned action.

There are two types of monitors. Internal and Remote monitors. Internal monitors are internal to CWA itself. They check the database and respond accordingly. Remote monitors are remote to the CWA server. They run on the targeted agent, rather than looking at CWA’s database.

Lets start by talking about remote monitors. Remote monitors are useful for checking the target machine, or checking something from the point of view of the target machine. For example, you may want to attach a monitor to a machine to check to see if a service is running. You may also want to attach a monitor to a machine to ping a network device that cannot have an agent on it. I have used remote monitors to ensure VPNs are working, to check the contents of a website for errors, to run a simple powershell script to ensure a complex set of things are right, and to ensure a remote firewall is online with a ping.

An internal monitor will keep an eye on the CWA database for a state you are looking for. This is normally used for less time sensitive activities, or checks that might require mixing multiple pieces. One example that is built in is the offline server monitor. It checks the CWA database for servers that haven’t checked in nor had a heartbeat in over a certain amount of time. Obviously a server can’t report that it is offline, so it must be reported on by an outside source. Of course another computer at that location could do it, but what if the Internet is totally out at the location? This makes internal monitors very powerful. They also don’t take any resources from the client device, so if you used it to, say, detect a stopped service, it would take until the next time CWA inventoried the services before it would notice the change, but it couldn’t possibly hurt the target computer.

A Basic Remote Monitor

Remote monitors can be created in a couple of ways, but the easiest is to simply open a computer screen and switch to the monitors screen, then click the Add button.

This will bring to to the monitor creation wizard. As you step through, you see several options for types of monitors. These are great because they are simple checks that you can easily understand. Check for the presence of a file, ping a target, or check a registry key. As you create it you can control things like the frequency it goes at, and what alert actions it takes in response to finding a problem. Remember though, these monitors are from the point of view of the machine they are applied to. So if you setup a ping alert, and pings done by that system will come from the machine it is on, so pinging its own IP address will always result in a success. It’s also important to remember that since it is the machine doing the testing, it can’t report back in if it is offline or otherwise unable to contact the CWA server.

A More Advanced Remote Monitor

Remote monitors can be very powerful if you want to go that far with them. Specifically they have the ability to run any executable. It’s important to remember that the role of a monitor is to monitor, not to make changes, but with the EXE monitor you can run powershell, VB Scripts, BAT files, and any other executable. This means you can check for very complex setup that all of the other Remote Monitor types can’t handle. If you had a command line program that checked several places and gave feedback on settings, an EXE monitor is the perfect place for it.