Forum Discussion

mnagel's avatar
mnagel
Icon for Professor rankProfessor
4 years ago

method to expunge categories no longer applicable?

I have been trying to figure out a way to auto-remove categories added by PropertySources when they are no longer applicable (e.g., when something stops being an IIS server, SQL server, DHCP server, etc.). I have found recently this is an annoying problem as PropertySources-added categories live forever until manually removed and the modules cannot subtract AFAIK. OTOH, the method of adding a category is undocumented -- I only know about it from review of modules provided by LM, so perhaps there is a method that interprets a negation operator (like !) to remove the listed category?

I can think of other options, but they would require replicating what a PropertySource does and use the debugger (via API) to change system.categories.  Would prefer to avoid that as it would be pretty complex and using the debugger that way always makes me cringe when I consider the security implications :(.

2 Replies

Sort By
  • Vitor_Santos's avatar
    Vitor_Santos
    Icon for Advisor rankAdvisor
    4 years ago

    This would be really nice to have. We struggle on this, specially on Dynamic Groups that might contain devices (due to the previous category) that no longer should be there.

  • mnagel's avatar
    mnagel
    Icon for Professor rankProfessor
    4 years ago

    I am incorporating this into my resource check script.  For now, the first item I am testing is Windows_DHCP, which requires that the DHCP Server role is installed (we have an auto.winfeatures property that is populated by a PropertySource. I don't recall where we got it, somewhere in these forums IIRC :).  The PS code is simple: 

    hostname=hostProps.get("system.hostname")
my_query="Select NAME from Win32_serverfeature"
def session = WMI.open(hostname);
import com.santaba.agent.groovyapi.win32.WMI
def result = session.queryAll("CIMv2", my_query, 15);
println "WinFeatures=" + result.NAME

     

    If this list does not include DHCP Server and we have Windows_DHCP assigned, it will trigger a warning.  I plan to extend this to catch more stale categories.

    My check script tests a bunch of things, including lack of any FQDN or expected FQDNs, lack of NetFlow data (the new heartbeat datasource is not helpful there as it does not care if valid data arrives), and other stuff that can go wooorng.