Nagios Check for Windows Updates

My colleagues have been getting a little frustrated by the “Plugin Timeout” messages in Nagios resulting from the length of time it takes to check for Windows Updates. I had been using Jules Check for Windows Updates  that essentially boils down to calling:

$updateSession = new-object -com "Microsoft.Update.Session"
$updates=$updateSession.CreateupdateSearcher().Search(("IsInstalled=0 and Type='Software'")).Updates

So I took Jules’ work and divided the powershell script into two. One script is called on a scheduled basis (say every 30mins) and writes the result to a text file. When Nagios runs the check for windows updates it calls the other script that parses the output of the text file rather than running a new update session object (the time-consuming bit).

So create the two files. I created them in C:\scripts:

• check_windows_updates_scheduled.ps1
• check_windows_updates.ps1

Use the following code:

check_win_updates_scheduled.ps1

# ###########################################################
# check_win_updates_scheduled.ps1 by Jonny McCullagh 20140109
# This powershell script should be called as a scheduled task
# Output is sent to a text file. The text file is then read by
# check_win_updates.ps1
# to answer the nagios call. This saves waiting for the slow
# windows update check.
# Only required change is the path to the temp file below
# ###########################################################
$strPathToTempFile="c:\scripts\check_win_updates.txt"
$countHidden=0
$countCritical=0
$countOptional=0
# ###########################################################
# Check if installed updates require a reboot first
# ###########################################################
if (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"){
$strOutput = "Updates installed, Reboot required"
Out-File -filepath $strPathToTempFile -inputobject $strOutput
exit 0
}
# ###########################################################
# Perform the actual update lookup
# ###########################################################
$updateSession = new-object -com "Microsoft.Update.Session"
$updates=$updateSession.CreateupdateSearcher().Search(("IsInstalled=0 and Type='Software'")).Updates
# ###########################################################
# Loop through each update to count each type of update
# ###########################################################
foreach($update in $updates) {
if ($update.IsHidden) {
$countHidden++
}elseif($update.AutoSelectOnWebSites) {
$criticalTitles += $update.Title + " "
$countCritical++
}else{
$countOptional++
}
}
# ###########################################################
# Create some strings ready to write out to the output file
# ###########################################################
$strHiddenText="$countHidden Hidden";
$strCriticalText="$countCritical Critical";
$strOptionalText="$countOptional Optional";
# ###########################################################
# Write a string to the output file to be read by check_win_updates.ps1
# ###########################################################
$strOutput = "$strCriticalText $strOptionalText $strHiddenText"
Out-File -filepath $strPathToTempFile -inputobject $strOutput

check_windows_updates.ps1

# ###########################################################
# check_win_updates.ps1 by Jonny McCullagh 20140109
# This powershell script should be called by Nagios and will
# warn if windows updates are available but based on the 
# text output from another powershell script 
# (check_win_updates_available.ps1)
# that runs as a scheduled task
# Only required change is the path to the temp file below
# ###########################################################
$strPathToTempFile="c:\scripts\check_win_updates.txt"
$countHidden=0
$countCritical=0
$countOptional=0
# ###########################################################
# Get the output from the scheduled task and see if any 
# updates are available
# ###########################################################
if (!(Test-Path $strPathToTempFile)) {
	Write-Host "Input file not available. Has scheduled task run check_win_updates_scheduled.ps1"
	exit 2
}
$strInput = Get-Content $strPathToTempFile 
$arrInput = $strInput.split(" ")
$numCritical=$arrInput[0]
$numOptional=$arrInput[2]
$numHidden=$arrInput[4]
# ###########################################################
# Write out the results based on the number of updates
# ###########################################################
if($numOptional -eq "Reboot"){
	write-host "WARNING "$strInput
	exit 1
}elseif($numCritical -gt 0){
	write-host "CRITICAL Updates Available"$strInput
	exit 2
}elseif($numOptional -gt 0){
	write-host "WARNING Updates Available"$strInput
	exit 1
}elseif($numHidden -gt 0){
	write-host "OK Only Hidden Updates Available "$strInput
	exit 0
}else{
	write-host "OK  No Windows Updates "$strInput
	exit 0
}

Add the following to your nsclient.ini

[/settings/external scripts/scripts]
windows_updates=cmd /c echo C:\scripts\check_win_updates.ps1; exit $LastExitCode | powershell.exe -command -

And that can be called with the following in the Nagios commands.cfg :

define command {
command_name    check_windows_updates
command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -c windows_updates -t 120
}

Create the Scheduled Task for check_windows_updates_scheduled.ps1

Choose ‘Create Task’

Give your Task a name and description and ensure it runs as a user with sufficient privileges:

Under the Trigger tab choose a schedule of say 30 minutes:

For the Action tab choose ‘Start a Program’  and enter the following text in the script field:

C:\WINDOWS\system32\windowspowershell\v1.0\powershell.exe “& ‘c:\scripts\check_windows_updates_scheduled.ps1′”

After saving you should have a Scheduled Task similar to the one below.

Hopefully you’ll end up with something similar to this: