Core Dump File Monitoring

This script will log into a device via ssh (sftp) and echo the contents of a file called “example.txt” in the current directory. For my use case, it converted the contents of the file to an integer because the file only contained a 0 or a 1. The return value is the integer from the file (or -1 if there was an error).

import com.jcraft.jsch.*

// Set the SFTP server connection details
def host = hostProps.get("system.hostname")
def port = hostProps.get("ssh.port") ?: 22
def username = hostProps.get("ssh.user")
def password = hostProps.get("ssh.pass")

// Set the file name to be read
def fileName = "example.txt"

// Create a JSch session
JSch jsch = new JSch()
Session session = jsch.getSession(username, host, port)
session.setPassword(password)
session.setConfig("StrictHostKeyChecking", "no")
session.connect()

// Create an SFTP channel and connect it to the session
ChannelSftp sftpChannel = (ChannelSftp) session.openChannel("sftp")
sftpChannel.connect()

result = -1
// Print the contents of the file with the given file name
try {
    InputStream inputStream = sftpChannel.get(fileName)
    result = inputStream.text.toInteger()
} catch (SftpException e) {
    println("File $fileName not found")
}

// Disconnect the SFTP channel and session
sftpChannel.disconnect()
session.disconnect()

return result

You could probably modify this to get the file size or something else. You could also use something like this to log in and issue commands, then do something with the result. 

You could modify the script to output instances (as a discovery script) by listing all the files in a certain directory. This script does something like that:

import com.jcraft.jsch.JSch

def host = hostProps.get("system.hostname")
def user = hostProps.get("ssh.user")
def pass = hostProps.get("ssh.pass")
def port = hostProps.get("ssh.port") ?: 22
def cert = hostProps.get("ssh.cert") ?: '~/.ssh/id_rsa' // cert path may be passed in, otherwise will reference default path.

def session = null;

try {
    def jsch = new JSch()
    if (user && !pass) {jsch.addIdentity(cert)}
    session = jsch.getSession(user, host, port)
    session.setConfig("StrictHostKeyChecking", "no")
    if (pass) {session.setPassword(pass)}
    session.connect()
    def cmd = "cd /home/lmadmin/connectwise_manage && ls *_la | sort"
    def command_lines = getCommandOutput(session, cmd)
    command_lines.eachLine{
        wildvalue = it.replaceAll(" ","")
        wildalias = it.replaceAll(".la","")
        println("${wildvalue}##${wildalias}")
    }

    return 0
}
finally {
    if (session) {session.disconnect()}
}

/**
 * Helper method for executing commands.
 */
def getCommandOutput(session, input_command) {
    // execute command.
    def channel = session.openChannel("exec")
    channel.setCommand(input_command)

    // collect command output.
    def commandOutput = channel.getInputStream()
    channel.connect()

    def output = commandOutput.text;

    // disconnect
    channel.disconnect()

    return output
}

It issues the command "cd /home/lmadmin/connectwise_manage && ls *_la | sort" that lists all the files in the /home/lmadmin/connectwise_manage directory that end in “_la”. 

If you did something like this, you could make your collection script just “return 0” and set a value of =0 on the return. That way, whenever the file showed up in the directory, it would get created (within 15 minutes, the soonest discovery can run), and immediately generate an alert as long as the file existed.