This article applies to PRTG Network Monitor 13.2 or later

Monitoring the Age of Anti-Virus Signatures

In order to monitor the signature age of an anti-virus scanner installed on your system in comparison to the latest available version on a release server, use an EXE/Script sensor in PRTG and create a corresponding script file to get this information.

• The Powershell script for this concern (as given below for McAfee) will check the latest available DAT version of the scanner in the web at first.
• Then, it determines the DAT version of the installed scanner on your server.
• As result, the difference between the two version numbers will be returned as integer.

In PRTG, add an EXE/Script sensor and choose the created script in the sensor settings. You can set an error and/or warning limit in the sensor’s channel settings depending on your needs. For example, you can define that the sensor goes into warning status if the version numbers differ by 2, and into down status if the version numbers differ by 5.

Feel free to adjust the script depending on your needs. For example, you can make it applicable for anti-virus software other than McAfee, as long as this anti-virus solution writes version information into the registry. If this data has to be read out of a file, the script would have to be a bit more complex, though, it is also possible.

Script

• Copy the following script and paste it into a text editor.
• Save it as a Powershell script file (.ps1) into the /Custom Sensors/EXE subfolder of your PRTG installation.

param (
    [Parameter(Mandatory=$false)][string]$ComputerName=".",
    [Parameter(Mandatory=$false)][int]$RefreshURL=21600
)

Import-Module PSSystemTools -Force

# Define Variables
$Url = "http://update.nai.com/Products/CommonUpdater/avvdat.ini"
$TempFile = "C:\Temp\avvdat.ini"
$RegKey = "hklm:/Software/Network Associates/ePolicy Orchestrator/Application Plugins/VIRUSCAN8800"
$RegValue = "DATVersion"

# Create Temporary File
if ((Test-Path $TempFile) -eq $false) {
    $webpage = (new-object system.net.WebClient).DownloadString($Url)
    $webpage | Set-Content -Path $TempFile
}
$objTempFile = Get-Item $TempFile
if ([int]((Get-Date).Subtract($objTempFile.LastWriteTime).TotalSeconds) -gt $RefreshURL) {
    $webpage = (new-object system.net.WebClient).DownloadString($Url)
    $webpage | Set-Content -Path $TempFile
}

# Read Temporary File
$INIFile = Import-IniFile -File $TempFile
$Section = $INIFile.'AVV-ZIP'
$FileDATVersion = $Section.DATVersion


# Read Registry
$RegDATVersion = Invoke-Command -ComputerName $ComputerName -ArgumentList $RegKey,$RegValue -ScriptBlock {
    Param($RegKey,$RegValue)
    $RegDATVersion = (Get-ItemProperty $RegKey).$RegValue
    $RegDATVersion = $RegDATVersion.Split(".")
    $RegDATVersion = $RegDATVersion[0]
    $RegDATVersion
}

# Calculate and Return Result
write-host "$($FileDATVersion - $RegDATVersion):OK"

• Monitor this script with an EXE/Script sensor.

PRTG will start to monitor the age of your anti-virus signature immediately.

Jun, 2013 - Permalink