Windows Powershell — monitor a process

I learned Powershell over the past few days. It was pretty easy to learn and some of the scripting is very similar to Perl. I still had some issues with my script, I was expecting to parse everything as a text file, but some inputs were objects. I guess that is one of the differences between Windows and UNIX.

My script monitors to see if a particular PID, owned by a particular account is running longer than 10 mins, if yes, write to the event log (or email). Then I created an alert in Sitescope to monitor the event log. One item I noticed was if I typed get-process EXCEL and Excel was not running, then I got a nice pretty error message is red text. I guess Windows doesn’t follow the Silence is Golden mindset.

PS C:\vbs> .\4.ps1
Get-Process : Cannot find a process with the name ‘EXCEL’. Verify the process name and call the cmdlet again.
At C:\vbs\4.ps1:4 char:25
+ $processID = get-process <<<< EXCEL | select id

Here is the UNIX philosophy
1. Small is beautiful.
2. Make each program do one thing well.
3. Build a prototype as soon as possible.
4. Choose portability over efficiency.
5. Store data in flat text files.
6. Use software leverage to your advantage.
7. Use shell scripts to increase leverage and portability.
8. Avoid captive user interfaces.
9. Make every program a filter.

10 lesser tenets
1. Allow the user to tailor the environment.
2. Make operating system kernels small and lightweight.
3. Use lowercase and keep it short.
4. Save trees.
5. Silence is golden.
6. Think parallel.
7. The sum of the parts is greater than the whole.
8. Look for the 90-percent solution.
9. Worse is better.
10. Think hierarchically.

Here is the script:
http://www.movement3.com/docs/powershell-monitor-pid

To get Powershell to run from a script:
get-help about_signing
set-executionPolicy remoteSigned

*** Updated 1/2 ***
I had problems with scheduling the Powershell script to run:

C:\Documents and Settings\username>C:\WINDOWS\system32\windowspowershell\v1.0\powe
rshell.exe c:\powershell_scripts\check\script.ps1

Get-Content : Cannot find path ‘C:\Documents and Settings\username\status.txt’ be
cause it does not exist.

At C:\powershell_scripts\RPGSQL_check\script.ps1:6 char:14
+ $status = cat <<<< status.txt

I included the full path: cat C:\powershell_scripts\check\status.txt and it worked.

Perl – replace tab with comma

perl -pi.bak -e ‘s/\t/,/g’ filename

Delimiter, Comparing two lists

cat 9 | awk ‘ { print $2 } ‘

–

#!/usr/bin/perl

###
#
# To use this script: ./script.pl [file]
# This script uses “.” as a delimiter
# You can replace “.” with any other character
#
###

my $file = $ARGV[0];
my @each=”";

open(FILE, “$file”) or die “Can’t open file”;

while () {
@each=split(/\./, $_);
print “$each[0]\n”;
}

–

#!/usr/bin/perl

###
#
# To use this script: ./script.pl [option] [List 1] [List 2]
# Switches:
# -h help menu
# -i prints items that are found in both lists
# -u items in List 1 that are not found in List 2
#
# Currently there is no error checking.
#
###

$action = $ARGV[0];
$list_a = $ARGV[1];
$list_b = $ARGV[2];
(@a, @b, @union, @isect, @diff) = “”;
($x, $i) = 0;
(%union, %isect) = “”;

###
# Opens the text files and creates arrays
###
open(LIST_A, “$list_a”) or die “Can’t open file”;
open(LIST_B, “$list_b”) or die “Can’t open file”;

while () {
@a[$x]=split(“\n”, $_);
$x++;
}

while () {
@b[$i]=split(“\n”, $_);
$i++;
}

###
# What action to take?
###

#if ($action =~ /^-h/) { printhelp(); }
if ($action =~ /^-u/) { unique(); }
if ($action =~ /^-i/) { intersection(); }

###
# Subroutines
###
sub intersection {
foreach $e (@a) { $union{$e} = 1 }
foreach $e (@b) {
if ( $union{$e} ) { $isect{$e} = 1 }
$union{$e} = 1;
}

@union = keys %union;
@isect = keys %isect;

foreach (@isect) {
print “$_\n”; }
}

sub unique {
#build lookup table
@seen{@b} = ();

foreach $item (@a) {
push(@aonly, $item) unless exists $seen{$item};
}

foreach (@aonly) {
print “$_\n”; }
}

Color grep

#!/usr/bin/perl -w
use strict;
use Term::ANSIColor qw(:constants);

my %target = ();

while (my $arg = shift) {
my $clr = shift;
if (($arg =~ /^-/) | (!$clr)) {
print “Useage rcg [regex] [color] [regex] [color]…\n”;
exit;
}
$target{$arg} = eval($clr);
}

my $rst = RESET;

while () {
foreach my $x (keys(%target)) {
s/($x)/$target{$x}$1$rst/g;
}
print;
}

./rcg.pl sshd GREEN < /var/log/messages | less -r

Net::Telnet

#!/usr/bin/perl
use strict;
use Net::Telnet;

my $host = “128.223.60.103″;
my $username = “rviews”;
my $prompt_banner = “route-views.oregon-ix.net>”;
my ($output, $t);

$t = new Net::Telnet;
$t->open(“$host”);

$t->waitfor(‘/Username:/’);
$t->print(“$username”);

$t->waitfor(“/$prompt_banner/”);
$t->print(“terminal length 0″); #removes Cisco’s prompt to show output

$t->waitfor(“/$prompt_banner/”);
$t->print(“sh ip bgp IP-Address”);

($output) = $t->waitfor(“/$prompt_banner/”);
print $output;

exit;

Hash ref

From devshed.com:
http://forums.devshed.com/t160698/s.html&highlight=hash

Another problem, in this hash i have a reference of a array, i try to use @$hash{key}, but this code dont work, any ideas.

As for your second question, you have to type @{ $hash{key} }.

CPAN shell

http://sial.org/howto/perl/life-with-cpan/

Install CPAN shell: perl -MCPAN -e ‘$ENV{FTP_PASSIVE} = 1; install CPAN’

perl -MCPAN -e shell
cpan

install Acme::Bleac
perl -MCPAN -e install Acme::Bleach
cpan -i Acme::Bleach

Perl stuff

Rename ext, perl one liner:
perl -e ‘foreach (`ls`) { chomp($curr = $_); $_ =~ s/mp3/mb4/i; `mv $curr $_`; }’

Special Vaiables
$_ (the default variable)
$/ (the input record separator)
$\ (the output record separator)
$, (the output field separator)
@ARGV (the command-line argument array)
@_ (the subroutine argument array)
@INC (the include path array)
%ENV (the environment variable array)
$? and $! (the last error code)
$@ (the last error in an eval() block)
$, $) and $( (the real and effective UID/GIDs)
$. (the line number of an input file)
$ARGV (the name of an input file)
$0 (the name of the current script)
$$ (the process ID of the current script)
$[ (the Perl version number)

http://www.devshed.com/c/a/Perl/Understanding-Perls-Special-Variables/10/