Jan-Otto Kröpke
d819362150
Every optional collector of the mixin now has alerts, generated only with that collector enabled in _config.collectors: clock source, disk drive status, page file usage, license status, scheduled task results, pending updates, Hyper-V WMI and replication health, failover cluster nodes, resources, groups and shared volumes, Storage Spaces pool and virtual disk health, DHCP scope exhaustion and DNS zone transfer failures. The alerts of the pagefile, diskdrive and license collectors join the memory, disk and system groups; the other collectors get a group of their own. New knobs: taskSelector, sharedVolumeSelector, pagefileUsageThreshold, dhcpScopeFreeWarningThreshold, dhcpScopeFreeCriticalThreshold and updatePendingDuration. The test configuration enables every optional collector and tests/optional.test.yaml covers the new alerts. Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
2.3 KiB
title
| title |
|---|
| WindowsScheduledTaskFailed |
Meaning
The last run of the scheduled task task ended with the result unknown or
terminated, and the task has not completed successfully since for one hour.
The alert needs the scheduled_task collector. terminated means the run was
stopped by a user or by the scheduler's time limit. unknown is every result
code without a named status, which includes the exit code of the task's
program and the error codes of the Task Scheduler; the documentation of the
collector lists the named codes. A program that exits with a code other than
zero on success raises this alert on every run; exclude such tasks with
taskSelector or with the include and exclude flags of the collector. A
disabled task keeps its last result but does not raise the alert.
Impact
The work of the task did not happen: backups, cleanups, reports, certificate renewals or synchronizations that are scheduled on this host. The impact depends on the task.
Diagnosis
-
Inspect
windows_scheduled_task_last_result_statusfor the task andwindows_scheduled_task_stateto see whether the task is still enabled and queued. -
On the host, read the last result and the history:
Get-ScheduledTaskInfo -TaskName '<name>' -TaskPath '<folder>' Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational -MaxEvents 50 | Where-Object Message -like '*<name>*'The history log is off by default; enable it with
wevtutil set-log Microsoft-Windows-TaskScheduler/Operational /enabled:true. -
Translate the result code:
0x1is a generic failure of the program,0x2a missing file,0x80070005an access denied, and codes of the form0x8xxxxxxxare HRESULTs of the scheduler or of the program. The other codes between0x41300and0x41325are named statuses, such asreadyorrunning, and do not raise this alert. -
Run the program by hand under the task's account to reproduce the failure.
Mitigation
Fix the program, its arguments, its working directory or the permissions of
the account the task runs as. Start the task once with Start-ScheduledTask
and confirm the result turns to success. Disable or delete tasks that are
not needed anymore instead of leaving them failing; disabling a task clears
the alert.