banshee/windows-collection/windows/ssh/eventlog

System log of a Windows, by SSH

Returns the number of errors and of critical events written to the System log of a Windows since the previous run. Two watches are proposed. The errors are not checked: on most servers a few errors a day are routine, and only the administrator knows which level is not. The critical events are: they are rare and grave (Kernel-Power 41, a restart without a clean shutdown).

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the OpenSSH server is built in from Windows Server 2019 and Windows 10 1809, installed from Win32-OpenSSH before. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

Each event of the log has a record number, EventRecordID, which only grows. The collector keeps in the cache of the probe the highest number it has counted, and counts at the next run the errors (level 2) and the critical events (level 1) above it.

The first run only notes the number of the latest event, and is skipped:

`` powershell -NoProfile -NonInteractive -Command "(Get-WinEvent -LogName System -MaxEvents 1).RecordId" ``

The following runs count the events above the number kept (here 12345), and read the number of the latest event of the log:

`` powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Stop'; $events = @(Get-WinEvent -LogName System -ErrorAction SilentlyContinue -FilterXPath '*[System[(Level=1 or Level=2) and EventRecordID>12345]]'); ConvertTo-Json -Compress -InputObject @{newest = [long](Get-WinEvent -LogName System -MaxEvents 1).RecordId; last = [long]($events | Measure-Object RecordId -Maximum).Maximum; critical = @($events | Where-Object Level -eq 1).Count; errors = @($events | Where-Object Level -eq 2).Count}" ``

The number kept becomes the highest of the errors counted. An event written during the reading has a higher number and is counted at the next run: none is counted twice, none is lost.
Get-WinEvent reports "no event found" as an error, silenced on the reading of the errors. Any other failure, an access to the log refused among them, stops the command on the reading of the latest event, with no answer: the collector then stops as misconfigured, rather than return zero errors.
A log that was cleared numbers its events from 1 again: the collector sees it, skips the run, and counts again from the start of the log at the next run.
The number kept lasts a week in the cache: a probe stopped longer starts again as at its first run.

Nothing is written to the Windows: the commands only read.

Prerequisites

The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

Name	Label	Unit	Per instance
`errors`	Errors since the previous run	—	no
`critical`	Critical events since the previous run	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`errors`	Errors in the System log	above a threshold, on `errors`	warning above 0; no critical	no
`critical`	Critical events in the System log	above a threshold, on `critical`	critical above 0; no warning	yes

A watch raised by the errors of one run clears at the next run without errors: the count is that of one interval.

Limits

Only the System log is read; neither the Application log nor the others.
The events are counted, not described: their source and their message are read in the Event Viewer.
A run where thousands of errors arrive reads them all, to count them.
Not yet checked on a real Windows: that the record numbers start again from 1 after the log is cleared.