Writing Command Line Output To A Custom Inventory Field (4276675)

Writing Command Line Output To A Custom Inventory Field

This article outlines the steps, tools and examples, needed to extract information from a text file or output created from a command line, to be used in conjunction with a custom inventory field.

  

Overview

There are many scenarios where you are able to obtain a piece of information in a text file or as output from a command line and you want a way to get that information back to the K1000 appliance. Arguably, the most useful way to get that into the K1000 appliance is via a custom inventory field

Getting the Data

Usually this just involves finding a tool, built-in or otherwise that will spit out information into a text file or the command line output. Google is your friend here.

Getting it down to one line

There are ways of handling multiple lines of text but by far the most valuable is a single line that can be tracked in the K1000 appliance inventory and easily reported on -- e.g. the built-in statistic on IP address.

In order to get the output down to one line, we use a tool called sed. This tool can:

• parse standard output (stdout) or a text file
• optionally manipulate the output using regular expressions
• generate a single line, easy to interpret output

Example 1: what if I wanted to know the active code page on a machine. To do this from a command prompt I would typechcp and get the output something like

Active Code Page: 437

Example 2: #1 is already one line so that's easy. But what if I wanted to get the output of a particular line of netstat output. For example, I want to know the status of the local port 5900 (VNC). Thenetstat -nao output looks like this:

>netstat -nao

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1456
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1352
  TCP    0.0.0.0:5800           0.0.0.0:0              LISTENING       1088
  TCP    0.0.0.0:5900           0.0.0.0:0              LISTENING       1088
  TCP    0.0.0.0:52230          0.0.0.0:0              LISTENING       552
  TCP    127.0.0.1:1028         0.0.0.0:0              LISTENING       1696
  TCP    127.0.0.1:1063         127.0.0.1:62514        ESTABLISHED     2404
  TCP    127.0.0.1:62514        0.0.0.0:0              LISTENING       504
  TCP    127.0.0.1:62514        127.0.0.1:1063         ESTABLISHED     504
  TCP    192.168.1.111:139      0.0.0.0:0              LISTENING       4
  TCP    192.168.1.111:3698     172.18.0.122:52230     SYN_SENT        552
  UDP    0.0.0.0:445            *:*                                    4
  UDP    0.0.0.0:500            *:*                                    1196
  UDP    0.0.0.0:4500           *:*                                    1196
  UDP    127.0.0.1:123          *:*                                    1664
  UDP    127.0.0.1:1900         *:*                                    1988
  UDP    127.0.0.1:3482         *:*                                    9308
  UDP    127.0.0.1:62514        *:*                                    504
  UDP    192.168.1.111:123      *:*                                    1664
  UDP    192.168.1.111:137      *:*                                    4
  UDP    192.168.1.111:138      *:*                                    4
  UDP    192.168.1.111:1900     *:*                                    1988

Using Sed.exe I can get this to one line like this:netstat -nao | sed -n "/[ ]*TCP.*:5900/p". The output now reads:

>netstat -nao | sed -n "/[ ]*TCP.*:5900/p"
  TCP    0.0.0.0:5900           0.0.0.0:0              LISTENING       1088

Getting It Down even more

There are cases where you might want to get it down every further. In the above examples, there were many spaces which might make it difficult to report on so what if we can just capture the essence of the output.

Example 1: Let us say we only want the code page number. Sed can use pattern matching to replace string patterns with other patterns. To get it down to one value we can tell set to remove the stringActive code page: with nothing so all that is left is the number. Like this:

>chcp | sed -n "s/Active code page:[ ]*//p"
437

Example 2: Let us say we only want the port status of "LISTENING" or whatever it might be. Similar to #1 except we need to do a pattern replace before and after the value we are interested in so we can call sed twice like this

>netstat -nao | sed -n "s/[ ]*TCP.*:5900.*:[0-9]*[ ]*//p" | sed -n "s/[ ]*[0-9]*[0-9]//p"
LISTENING

Note that if the results of netstat -nao were stored in a file (e.g netstatoutput.txt) then the command line would be:

sed -n "s/[ ]*TCP.*:5900.*:[0-9]*[ ]*//p" netstatoutput.txt | sed -n "s/[ ]*[0-9]*[0-9]//p"

Putting The Data Into the Registry

Using a simple vbs script included here you can put this data into the registry. here is the source code for a script that takes standard input and write it to a subkey of HKLM\Software\KACE. The name of the subkey is the first command line argument. Standard Input is used for the value.

const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
strValueName = WScript.Arguments.Item(0)

Set StdIn = WScript.StdIn
strValue = StdIn.ReadLine
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
strComputer & "\root\default:StdRegProv")
 
strKeyPath = "SOFTWARE\KACE"
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue

The way this script works is it takes the first line of standard output from one command and puts it into a reg value that you specify. Imagine a text file called hello.txt that contained the textHello KACE!. To write this to the registry value of HKLM\Software\KACE\Greeting we would use it like this:

type hello.txt | cscript.exe set_reg_value.vbs "Greeting"

To use it to store a command line output you would have a command line as above examples and modify it to use this script. Extending Example #1 like this:

>chcp | sed -n "s/Active code page:[ ]*//p" | cscript set_reg_value.vbs "Active
Code Page"

Tracking a Custom Inventory Field

This is now trivial. This portion is covered by this document. "What is the syntax for custom inventory rules?".

Final Advanced Example

This example utilizes the above tools Disk Usage (du), sed and the built-in windows tools cscript (vbs) and Registry Editor (regedit) to report the total size of the K1000 agent folder and store it in a registry key called HKLM\Software\Kace\AgentSize

du -q "c:\program files\kace" | sed -n "s/Size:[ ]*//p" | sed -n "s/[ ]*bytes/bytes/p"  |cscript.exe set_reg_value.vbs AgentSize