Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.

Open-AudIT

What's on your network?
It is currently Thu Mar 28, 2024 8:46 pm

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 22 posts ]  Go to page Previous  1, 2
Author Message
 Post subject: Re: New Audit Script
PostPosted: Wed Mar 07, 2012 6:14 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
[quote="Mark"]Try again :-)

Succes!

Next objective: Audit my IP-RANGE using audit_list.vbs
I'll start a new thread if I experience problems.

Top
 Profile  
Reply with quote  
 Post subject: Re: New Audit Script
PostPosted: Wed Mar 07, 2012 6:18 am 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1964
Location: Brisbane, Australia
[quote]Next objective: Audit my IP-RANGE using audit_list.vbs

If you supply a list into audit_list, all it does is enumerate that list and call audit_windows.
If you need to supply credentials, make sure your list looks like -
[code]array("COMPUTERNAME strUser=USER strPass-PASS", "etc", "etc")[/code]
It should "just work"... :D
NOTE - COMPUTERNAME should be a name or IP Address - shouldn't matter.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
 Post subject: Re: New Audit Script
PostPosted: Wed Mar 07, 2012 7:44 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
[quote="Mark"]Try and enumerate the returned collection though and of course an error is thrown - but by cscript and not my function. Nasty. any ideas? anyone, anyone, Bueller, Bueller??? :D

This is because you're passing wbemFlagReturnWhenComplete (16 of the 48) to the ExecQuery.
If you change the 48 to 32 your stuff should work. This will mean that the call doesn't return until the query is complete which will slow down the processing a bit. With the 48 in there I think you can be working through the early colItems while the query is still processing the later ones.

Top
 Profile  
Reply with quote  
 Post subject: Re: New Audit Script
PostPosted: Wed Mar 07, 2012 7:55 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
Potential upgrades to audit_list.vbs:

  • Pull the computer list from a file like in OAv1

  • Allow audit_run_type = "remote" to pass the individual computer strUser and strPass to psexec rather than the remote_user and remote_password. The remote_* stuff doesn't work unless all the target computers have the remote_user defined with the same remote_password


Top
 Profile  
Reply with quote  
 Post subject: Re: New Audit Script
PostPosted: Wed Mar 07, 2012 7:49 pm 
Offline
Site Admin
User avatar

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1964
Location: Brisbane, Australia
[quote]If you change the 48 to 32 your stuff should work. This will mean that the call doesn't return until the query is complete which will slow down the processing a bit. With the 48 in there I think you can be working through the early colItems while the query is still processing the later ones.


Well that's interesting. I replaced all the 48s with 32s. I then ran both versions of the script locally on my desktop. The 32 script was faster. I then ran it on a remote system - the 32 script was still faster... I'll leave it that way for now (a simple search/replace is all that's needed to change it back).

[quote]Pull the computer list from a file like in OAv1

Can do - will spend some time on it.

[quote]Allow audit_run_type = "remote" to pass the individual computer strUser and strPass to psexec rather than the remote_user and remote_password.

Shouldn't be difficult to fix that.

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.


Top
 Profile  
Reply with quote  
 Post subject: Re: New Audit Script
PostPosted: Thu Mar 08, 2012 2:33 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1259
[quote="Mark"]
Well that's interesting. I replaced all the 48s with 32s. I then ran both versions of the script locally on my desktop. The 32 script was faster....

That's nice. I guess I should have said "may" slow it down. [url=http://msdn.microsoft.com/en-us/library/windows/desktop/aa384832%28v=vs.85%29.aspx]The documentation suggests[/url] wbemFlagReturnWhenComplete (0) [Synchronous Mode] may cause problems when you're querying large data sets. You're supposed to use wbemFlagReturnImmediately (16) [Semisynchronous Mode] + wbemFlagForwardOnly (32) to mitigate this but I guess the overhead slows it down. So if you're going to query thousands of event log entries you should use 48. Otherwise 32 should be okay unless you need to iterate over the return object multiple times like in the software installed_by stuff.

Top
 Profile  
Reply with quote  
 Post subject: Re: New Audit Script
PostPosted: Fri Mar 16, 2012 5:35 am 
Offline
Newbie

Joined: Wed Feb 15, 2012 1:15 am
Posts: 13
Location: Belgium
[quote="Mark"][code]array("COMPUTERNAME strUser=USER strPass-PASS", "etc", "etc")[/code]
It should "just work"... :D

It does!

I edited audit_list.vbs[code]pc_array = array("IP-ADDRESS_1 strUser=USERNAME strPass=PASSWORD","IP-ADDRESS_2 strUser=USERNAME strPass=PASSWORD")[/code]
This is what I was looking for. An (very) affordable audit program for use in the schools I work in.
Your efforts are greatly appreciated.

I'll keep watching the board.
w.

Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 22 posts ]  Go to page Previous  1, 2

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group