Windows_updates.vbs plugin makes the agent crash

Hi there,

I’m trying to figure out how to make the windows_updates.vbs work properly.

I’m currently running :
Server Version : Checkmk Raw 1.6.0p11
Agent Version: 1.6.0p11
BuildDate: Apr 2 2020
OS : Windows Server 2016 Std

I’ve tried the settings from this topic but doesn’t seem to help.

The command check_mk_agent.exe showconfig plugins returned the correct customized configuration of the plugin.

If you got any idea, it would be very helpful.

PS : I’m also wondering if there is another plugin or way to pull up info. about windows updates.

Regards,

Jonathan

The question is what is not working in your environment?
“plugin makes the agent crash” i cannot believe that this happens.

Hello Andreas,

Thanks for your reply.

If I use this plugin then the scan / all other checks become heavyly delayed, then after a while the CheckMK service doesn’t respond on the host. As a result, nothing is pulled up anymore on the server.

Maybe i did something wrong :

  1. I placed the windows_updates.vbs in C:\ProgramData\checkmk\agent\plugins
  2. Checked on the server interface, the full scan became really slow
  3. Tried to add the settings you described here
  4. Reloaded the agent configuration with the command :
    C:\Program Files (x86)\checkmk\service> .\check_mk_agent.exe reload_config
  5. Checked on the server interface, the full scan became even slower then agent crashed after a while

In task manager the agent was on a constant 24% CPU usage.

I had to remove the plugin and restart the service. It hanged up for a while before the service manager returned an error and finally stopped it. I had to start it again manually.

The server is actually waiting for 4 updates to be installed. So it was a good opportunity for me to test the plugin.

This is all I know that happened. If i did something wrong, please let me know.

Hi @jbr,
the vbs Script shouldn’t die. Thats true - 24% looks like you have a system with 4 CPU and the vbs Script was fully using one of your processors.
Windows is sometimes really slow to execute, have you tried to play around with the agent configuration?
In referrence to “https://forum.checkmk.com/t/mk-inventory-doesnt-work-at-windows-10-hosts” - you might want to set async in the agent configuration for the inventory script.

Without seeing the complete agent config i cannot say what is wrong.
I would say that your WSUS environment has a problem if the update check takes too long.
But the timeout inside the config is set to 1 hour and this was enough also bad configured environments.

The agent has also a log file where you can inspect the execution and also see error messages.
This log file would also be interesting for troubleshooting.

1 Like

The script is working correctly and took around 2 minutes to return the results :

I had the taskmanager opened during those 2 minutes and only 3% CPU usage in general (mostly used by Oracle databases).

This is a preprod vm with 4 vCPU (2 cores on 2 CPU) for now :

The agent config file is default, I’ve only added those lines u described in that other post after my first attempt. Running the command check_mk_agent.exe showconfig plugins returns those added values.

Let me give it a new try and provide you some logs :slight_smile:

@kribbit Thanks for your reply but I’m not using the Mk_inventory.vbs script for now. I’ll keep your reference. It’s much appreciated.

This is my check_mk.yml which is said should be untouched :

plugins:
enabled: yes

player: ''   # internal value, do not change this

max_wait: 60 # max timeout for every sync plugin. Agen will gather plugins data no more than max_wait time.
             # this is useful to terminate badly written or hanging plugins   


async_start: yes # start plugins asynchronous, this is default

# folders are scanned left -> right, order is important
# duplicated files will be removed
folders: ['$CUSTOM_PLUGINS_PATH$', '$BUILTIN_PLUGINS_PATH$' ]       # ProgramData/checkmk/agent/plugins & Program Files x86/check/service/plugins

# what to execute    
execution:

    # Default behavior as in 1.5
    - pattern     : '$CUSTOM_PLUGINS_PATH$\*.*'         # Look for executable files in the ProgramData folder. 
      timeout     : 60                  # in seconds, after expiring timeout, process will be killed.
      run         : yes                 # ALL FOUND files ARE ENABLED

    - pattern     : '$BUILTIN_PLUGINS_PATH$\*.*'         # Look for files in the ProgramFiles folder.
      timeout     : 60                  # in seconds, after expiring timeout, process will be killed.
      run         : no                  # ALL FOUND files ARE DISABLED

    - pattern     : '*'                 # This is safety entry. 
      run         : no                  # ALL other FOUND files ARE DISABLED TOO.

And this is my check_mk_user.yml :

plugins:
# enabled: true

# max_wait: 60 # max timeout for every sync plugin. Agen will gather plugins data no more than max_wait time.
             # this is useful to terminate badly written or hanging plugins   


# async_start: yes # start plugins asynchronous, this is default

# folders are scanned left -> right, order is important
# all files from folders are gathered and verified, duplicated files will be removed
# folders: ['$CUSTOM_PLUGINS_PATH$', '$BUILTIN_PLUGINS_PATH$' ]       # ProgramData/checkmk/agent/plugins & Program Files x86/checkmk/service/plugins

_execution:
    # *********************************************************************************************
    # PATTERNS:
    # patterns 1. Absolute path: 'c:\Windows\*.exe' or '$CUSTOM_PLUGINS_PATH$\win_license.bat'
    #          2. Only Filename: 'mk_*.exe' or win_license.bat
    #             IMPORTANT: if you use relative path, then Agent takes only filename
    #                        'win_license.bat' and 'include\win_license.bat' are the same    
    #
    # PRIORITY:
    # Most important is top-most pattern:
    # Most important is check_mk.user.yml, next check_mk.bakery.yml amd least important is check_mk.yml
    #
    # DUPLICATED Plugins:
    # Plugins with Duplicated names will not be executed:
    # if you have '$CUSTOM_PLUGINS_PATH$\winstat_an.bat' and '$BUILTIN_PLUGINS_PATH$\winstat_an.bat'
    # to execute only first one will run ^^^^^^^^^^^^^^                              xxxxxxxxxxxxxx 
    #
    # *********************************************************************************************
    # execution pattern for  windows-updates.vbs:
    # all parameters below are DEFAULT set for every entry
    #- pattern     : '$CUSTOM_PLUGINS_PATH$\mk_inventory.vbs'  # Plugin name or absolute path . * and ? are allowed
    #  run         : yes                 # execute this plugin if plugin found
    #  async       : yes                 # agent will not wait for async plugins. Normally you will get data later.
    #  timeout     : 120                 # after 120 seconds process will be killed.
    #  cache_age   : 3600                # only combined with async, upto 3600 seconds we may reuse plugin output
#                                        # default value is 0. Minimum positive value is 120.
    #  retry_count : 3                   # failure on start plugin, before stopping, default 0 which means never stop attempts 
    #  cmd_line    : ''                  # reserved for future use
    #  pattern     : '$CUSTOM_PLUGINS_PATH$\win_license.bat'   # Plugin name. * and ? are allowed
    #  run         : no                  # do not execute this plugin even if plugin found

    - pattern     : '$CUSTOM_PLUGINS_PATH$\windows_updates.vbs'
      timeout     : 3600
      async       : yes
      cache_age   : 3600

    - pattern     : '$CUSTOM_PLUGINS_PATH$\*.*'         # in the ProgramData folder. DO NOT REMOVE THIS ENTRY
      timeout     : 30                  # after 30 seconds process will be killed. 60 sec is default in check_mk.yml
      run         : yes                 # ALL FOUND files will be started. This is default value

    - pattern     : '$BUILTIN_PLUGINS_PATH$\*.*'         # in the ProgramFiles folder. DO NOT REMOVE THIS ENTRY
      timeout     : 30                  # after 30 seconds process will be killed. 60 sec is default in check_mk.yml
      run         : no                  # No run, i.e disabled.

    - pattern     : '*'                 # This is safety entry. Try not use plugins outside your predefined folder
      run         : no                  # No run, i.e. disabled.

I probably misunderstood how to use this file…

This is the problem :slight_smile:

This section should look like

plugins:
    enabled: yes
    execution:
        - pattern     : '$CUSTOM_PLUGINS_PATH$\windows_updates.vbs'
          timeout     : 3600
          async       : yes
          cache_age   : 90000

        - pattern     : '$CUSTOM_PLUGINS_PATH$\*.*'
          timeout     : 30
          run         : yes

        - pattern     : '$BUILTIN_PLUGINS_PATH$\*.*'
          timeout     : 30
          run         : no

        - pattern     : '*'
          run         : no

Every option with an “_” at the beginning is not recognized.
The second important thing is the indentation.

I knew about the “_” but i reversed it back since i had a problem.

But thanks about the indentation because i was trying to understand why first times it didn’t work then when i copied an exemple it started to work. I had a feeling about that but wasn’t sure.

So if i understood everything :

  • timeout : number of seconds before the check is killed if something wrong happened (1 hour in this case)
  • async : plugin runs asynchronously or not
  • cache_age : number of seconds before the plugin is relaunched

For now everything seems to run fine ! Thank you so much :slight_smile:

I guess my first attempts with the config file before i succeed to make it work made the agent crash but i didn’t notice it.

My bad !

If you have a real agent crash it would be important to take a look at C:\ProgramData\checkmk\agent\log\check_mk.log. There you find most times the cause of your crash.

Noted the logs. For now its running fine :slight_smile:

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.