Uncategorized

PowerShell Script to Check Symantec Endpoint Protection Definition Updates

Posted on

Symantec Endpoint Protection has quite a hold on the Anti-Virus market share. Many have environments where it’s used, and may not be the administrators or even able to view data from the Symantec Endpoint Protection Manager. In light of that, I’ve written a PowerShell script to check the last update time for SEP definitions that can either be run manually or set as a scheduled task.

# Check if Symantec Endpoint Protection is installed. If not, exit.

#Check last write date of AV definitions and compare to a variable set for time – 7 days. 

# Write to the event log whether definitions are current or not

#Send email if definitions are out of date

*Things to Note*

  • As it stands, in each of the “if ($writetime” blocks there is a “write-host”. If you plan on running this as a scheduled task you’ll want to remove or comment out those lines.
  • I will also be writing this as a SCOM management pack, and an SCCM Compliance Item.

 



###################################################################
## Check Symantec Endpoint Protection Antivirus Definition Dates ##
## v1.1 ##
## Matt Hansen // 01-06-2017 ##
###################################################################

#Set Variables
$hostname = hostname
$7daysago = (get-date).AddDays(-7)
$key = 'HKLM:SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs'

#Test for registry key path and execute if neccessary
if (test-path -path $key)
{

$path = (Get-ItemProperty -Path $key -Name DEFWATCH_10).DEFWATCH_10
$writetime = [datetime](Get-ItemProperty -Path $path -Name LastWriteTime).lastwritetime
#Write-Host A min ago was $7daysago. DEFs was last written at $writetime

if ($writetime -lt $7daysago)
{Write-host "You have old defs"
Write-EventLog -LogName "Application" -Source "Symantec Antivirus" -EventId "7076" -EntryType "Warning" -Message "Symantec Definitions are older than 7 days. Last update time is was $writetime"
$notify = "yes"
}

if ($writetime -gt $7daysago)
{Write-host "You have current defs"
Write-EventLog -LogName "Application" -Source "Symantec Antivirus" -EventId "7077" -EntryType "Information" -Message "Symantec Definitions are current within 7 days. Last update time is was $writetime"
$notify = "no"

}

#Email Notify
if ($notify -eq "yes")
{
$param = @{
SmtpServer = "smtpserver@company.local"
Port = 25
UseSsl = $false
#Credential = "you@gmail.com"
From = "SymantecDefChecks@mcompany.local"
To = "administrator@company.local"
Subject = "Symantec Defintions Out-of-Date on $hostname"
Body = "Symantec Definitions are older than 7 days. Last update time is was $writetime on $hostname"
}
Send-MailMessage @param
#write-host "Email Sent"
}

}
Else {Write-host "Not installed"}

I hope this makes your day at least a little bit easier.

Thanks,

Advertisements

PAL (Performance Analysis of Logs) Tool, you need to use this!

Posted on

We all have performance issues at one time or another, and the majority of what I hear admins doing is the age old “Turn it off and back on again” or some variation thereof depending on the situation.

off_and_on_again

 

 

This isn’t always the fix, so we move on to the logs — right? Well you should anyways. Depending on what OS you’re in you look at Task Manager, PerfMon, Resource Monitor, a third-party application or something at an abstracted level if the machine in question is virtualized. If you’re using built-in tools like a PerfMon capture or a Data Collection Set (DCS), they can be helpful but sometimes just hard to understand if you’re looking for something other than am I using too much RAM or CPU %. This is where PAL comes in, it does the analysis of the logs for you and writes them to an HTML page with easy(er) to read and understand output and statistics.

 

The PAL tool is a powerful tool that reads in a performance monitor counter log and analyzes it using known thresholds. It is written by Performance SME Clint Huffman who is a Premier Field Engineer for Microsoft.

Features:

  • Common built-in thresholds for many major Microsoft products such as IIS, MOSS, SQL, BizTalk, Exchange, and Active Directory.
  • An easy “click-next” GUI that makes running these reports extremely simple.
  • A GUI that allows you to edit, or create your own thresholds.
  • Creates an HTML with an optional XML report.
  • Analyzes performance counters for thresholds that vary based on the criteria entered by the user specifying the machines role and hardware specifications.

 

Let’s walk through a basic use of PAL.

 

First, you’re going to go to pal.codeplex.com to download the PAL setup .zip file.

Pal_Page_img1

 

 

 

You’re then going to unzip the folder and run setup.exe, when you do you will most likely get this message.

ChatControls_img2

Click yes, and it will take you to the download page of the .NET Chart Controls page where you can download and install them real quick.

 

 

Then Run setup.exe again and you should be good to go. Next, Next Next and it’s installed, now let’s run this!

Pal_Welcome_img4

 

 

Click next to, and it will take you to the “Counter Log” tab. On this page you select your .blg, .csv, or .tsv performance log files that you’ve created already. PAL comes with a sample log that I’ll be using for this demonstration. Note that if you don’t want to process the whole log you can select a date range to process.

Select_and_date_img6

 

 

If you click Next, you’ll be taken to the “Threshold File” tab. Here you can select which threshold you’d like to use. If you’re just looking at SQL, or Exchange, or whatever performance logs you’ve captured, you can select that here to include those specific thresholds. If you’re just looking at general system overall performance the “System Overview” file works, which is what we will be using here since that’s what the sample log file is based on.

Thresholds_img7

 

 

If you know exactly what you’re looking for and want to make your own file, you’re able to do that as well! Choose a basic file and click “Edit” and you’ll be taken to a GUI that allows you to edit the threshold file in an environment that resembles PerfMon.

Edit1_img8

Edit2_img9

 

 

Click next and you’re taken to the “Questions” tab. Here you select the OS, PhysicalMemory and UserVa (which is only for 32-bit machine log files). The thresholds chosen on the previous screen are modified based on the information you put in here.

Questions_img10

 

 

Click Next again and you’re taken to the “Output Options” tab. Here you have two options to modify if you wish. First is the Analysis Interval, that allows you to choose the interval in seconds that the log is split into. By default, it takes the total time span of the file and splits it 30 times. You can then choose to process every single counter in the log file if you want to be extremely detailed. Note that changing either of these can have a huge impact on the performance of the system that is running them and how long it will take to process.

Output_options_img11

 

 

 

Click next and you’re taken to the “File Ouptut” tab. Here you can select where your output goes. *Note* there will be an html document as well as a folder that holds the images in the html document, so if you’re sending the data to someone you will have to grab both pieces.

fileoutput_img12

 

 

Click next and you’re taken to the Queue tab and the Execute tab. These shows what powershell code you’ve generated thus far in the process, if you have more than one file to process you can queue them up and run them all under the same instance of PAL. This is also where you choose how much CPU you’re going to delicate to the processing of the logs. I am going to tell you that this program pulls the ENTIRE log file into memory and processes it there. Keep that in mind when your working here, if you only have 4GB of RAM on your laptop and are running a 7GB SQL performance log — well…kiss your disk good bye because you’re going to be running 3GB of that out of page file. Also note that this is a VERY intensive process and if you give it all of your CPU cores it WILL use them as you will note in a screenshot I took below.

Queue_img13

Execute_img14

 

 

Click finish and it will kick off the process, as I said — take a look at that CPU!

CPU_img15

Processing1_img14

Once it’s finished it will look like this. *Note* that the sample log I pulled here was 504Kb with only 787 instances and it still ran at 100% CPU for a little over 4 minutes. I have a dedicated VM in my development environment that I give 32GB RAM and 16 cores to eat through these and still sometimes with SQL it may take a few hours.

done_img16

It then opens up the web page that it created, I’ve added a few snips of what it looks like here. It starts with a table of contents, and then lays out everything it just processed in nice tables and graphs.

WebPage_17

WebPage_18

 

 

You can download a full zip file of the web page, and the folder that contains the images below.

http://matthansen.me/SamplePerfmonLog_PAL_ANALYSIS_2014-10-01_08-51-54.zip

 

 

 

This tool has been extremely helpful to me, and I hope I’ve just made your day at least a little bit easier by sharing it with you!