banshee/active-directory-collection/active-directory/ssh/dhcp-scopes

DHCP scopes, by SSH

Returns, for each IPv4 scope of the DHCP Server of a Windows, the share of its addresses in use, and the addresses free and leased. Two watches are proposed, both checked: a scope nearly full, and a scope that is no longer there.

How it works

The collector runs one PowerShell command that reads the statistics of every IPv4 scope of the local DHCP Server:

powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -Depth 4 -InputObject @{scopes = @(Get-DhcpServerv4ScopeStatistics | ForEach-Object { @{scope = [string]$_.ScopeId; used = $_.PercentageInUse; free = $_.AddressesFree; inuse = $_.AddressesInUse} })}"

Get-DhcpServerv4ScopeStatistics, without a scope, returns the statistics of every IPv4 scope (Microsoft, DhcpServer module). Its objects are those of the WMI class DhcpServerv4ScopeStatistics (namespace root\Microsoft\Windows\DHCP), whose properties Microsoft documents: ScopeId, the identifier of the scope; PercentageInUse, the share of its addresses in use; AddressesFree; AddressesInUse.
A scope is named by its identifier, the address of its network: 192.0.2.0. used is rounded to a tenth.
The state of a failover relationship between two DHCP Servers is the dhcp-failover collector.
No IPv4 scope stops the collector as misconfigured, as does an answer that is not the expected JSON: a DHCP Server that is stopped, or a module that is missing, among them.

Nothing is written to the Windows: the command only reads.

Prerequisites

A Windows Server 2012 or later with the DHCP Server role and its PowerShell module (DhcpServer, installed with the management tools of the role), with Windows PowerShell 3.0 or later.
The OpenSSH server of Windows, installed and started, its default shell left at cmd.exe, the Windows firewall open to the poller on TCP 22, and the fingerprint of its host key set in protocol:ssh:fingerprint unless the Security settings trust the first SSH fingerprint presented: the steps are those of the windows/ssh/services collector of banshee/windows-collection.
An account for monitoring, without administrator rights, set in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key, member of the group "DHCP Users", which the role creates (of the domain on a domain controller, local elsewhere): Microsoft documents it as read-only access to the DHCP Server, its configuration and its leases. Never "DHCP Administrators".

Outputs

Name	Label	Unit	Per instance
`used`	Addresses in use	%	yes, per scope
`free`	Addresses free	—	yes, per scope
`in-use`	Addresses leased	—	yes, per scope

Watches

Name	Title	Kind	Defaults	Checked by default
`full`	Scope nearly full	high threshold, on `used`	warning above 85 %, critical above 95 %	yes
`missing`	Scope missing	expected instances, on `used`	no scope named: it raises nothing until names are set on the probe	yes

Limits

IPv6 scopes are not read.
Not yet checked on a real DHCP Server: the execution; that "DHCP Users" is enough for the cmdlet, as it is for the DHCP console.