## Server monitoring examples

The following snippets illustrate basic server monitoring. They are written in Windows PowerShell, but can be converted to VisualBasic or any other language that you prefer.

License state

Summary license information

Licensing events on the management server provide summary license information. The event message text also provides details to help with license reporting and remediation.

    #Get events in the category that we need to monitor
    #then get eventID from first event in array

    (Get-EventLog "Symantec Endpoint Protection Manager" -newest 50 '
    | Where-Object {$_.Category -eq "Licensing"} | Select-Object -index 0).EventID

    #Returns 7100 == License status is up to date and in compliance with licensing requirements
    #Returns 7101 == License is about to expire
    #Returns 7102 == License is expired
    #Returns 7103 == Trial license is installed
    #Returns 7104 == Upgrade license is installed

License status details

If your remote management solution requires more details about the status of individual licenses, you can parse the message text of the license status eventID.

    #takes a name:value pair
    #returns the value
    Function getValue ($line)
    {
        $words = $line -split ":"
        return $words[1]
    }

    #takes an array of lines, made up of name:value pairs.
    #returns an array of 'value'
    Function getValues ($lines)
    {
        $retval = @()
        foreach ($line in $lines)
        {
            $retval += getValue($line)
        }
        return $retval
    }

    #takes a licenseBlock (an array of values)
    #returns a dictionary of the attributes
    Function parseLicenseBlock ($lines)
    {
        $licenseType =    $lines[1]
        $seatsInLicense = $lines[2]
        $expires =        $lines[3]
        return ,@{"type"=$licenseType; "seats"=$seatsInLicense;  "expires"=$expires}
    }

    #takes an expiration date
    #returns a well formatted string for expiration
    #if license already expired, return "(30 days ago)"
    #if license expires in the future, return "(30 days remaining)"
    #if license expires today, returns "(today)"
    Function expirationStr ($expDate)
    {
        $expInDays = ([DateTime]$expDate - [DateTime]::Now.Date).Days
        $expirationStr = " ("
        if ($expInDays -eq 0) {$expirationStr += "today"}
        else
        {
            $expirationStr += [string]([Math]::abs($expInDays)) + " days "
            if ($expInDays -lt 0) {$expirationStr += "ago"}
            if ($expInDays -gt 0) {$expirationStr += "remaining"}
        }
        $expirationStr += ")"
        return $expDate + $expirationStr
    }

    $evt = Get-WinEvent -logName "Symantec Endpoint Protection Manager" | where {$_.id -ge "7100" -and $_.id -lt "7200"} | select -first 1

    $lines = $evt.Message -split "'n"
    $licenses = @() #array of licenses

    $description =   $lines[0]
    $totalseats =    getValue($lines[1])
    $usedseats =     getValue($lines[2])

    # get a license block and process it
    for ($i=3;$i -lt $lines.count-1;$i+=4)
    {
        $licenseBlock = $lines[$i..($i+3)]
        $licenses += ,(parseLicenseBlock(getValues($licenseBlock)))
    }

    #create description
    switch ($evt.id)
    {
        "7100" {$descr  = "In compliance"}
        "7101" {$descr  = "About to expire"}
        "7103" {$descr  = "Over-deployed"}
        "7104" {$descr  = "Trial license installed"}
        "7105" {$descr  = "Upgrade license installed"}
        default {$descr = $license.type}
    }

    #create output
    Write-Host "License Status: " $descr
    Write-Host "Seats currently licensed: " $totalseats
    Write-Host "Seats currently used:" $usedseats
    foreach ($license in $licenses)
    {
        Write-Host " "
        Write-Host "License type: " $license.type
        Write-Host "      License size: " $license.seats
        $expStr = expirationStr($license.expires)
        Write-Host "      Expires:" $expStr
    }

See Licensing events.

See Monitoring license state on the management server.

Content status

    #Get events in the range that we need to monitor
    #(Content Category includes session start and stop, which don't tell us about content status)
    #then get eventID from first event in array

    (Get-EventLog "Symantec Endpoint Protection Manager" -newest 50 '
    | Where-Object {($_.EventID -ge 7201) -and ($_.EventID -le 7203)} | Select-Object -index 0).EventID

    #Returns 7202 == Content on the server is up to date
    #Returns 7201 or 7203 == Content on the server is out of date

    #You can also monitor the status of LiveUpdate sessions on the management server.

See Content revision state events on the management server.

See Monitoring the management server.