With the following script I get this error running with full-command on command runner:
“Caused by: org.jawk.jrt.IllegalAwkArgumentException: Variable dynamic(“time”) is not available”
Script:
#! META
name: panos-request-content-upgrade-check
description: Grab content upgrade information
type: monitoring
monitoring_interval: 30 minutes
requires:
vendor: paloaltonetworks
os.name: panos
product: firewall
#! COMMENTS
content_update_state:
why: |
Why would anyone want to capture this metric? If the content version installed is not the most recent version you could be missing valuable threat protection.
how: |
How does the script below work? This script runs show-clock to get the current Epoch to later compare against the list of content version dates available. The available udpates are retrived in the command show-content-upgrade-check.
without-indeni:
If you didn’t have Indeni, you would need to manually check via the CLI or GUI (firewall or Panorama) to refresh/check for available updates and see if that is your currently installed version. Then you need to manually compare this against your update schedule making sure an update wasn’t missed. If you have alerts configured on the firewall you can receive alerts if a scheduled update did not run or you could also monitor your Syslog server for these events.
can-with-snmp: suspect this is false - needs verification
can-with-syslog: true
vendor-provided-management: Panorama and firewall GUI and alerts can be used to find this information manually
version_name:
why: |
This is the version number of content updates available from Palo Alto Networks.
how: |
This is pulled from the panos-request-content-upgrade-check command output.
without-indeni:
If you didn’t have Indeni, you would need to manually check via the CLI or GUI (firewall or Panorama) to refresh/check for available updates and see if that is your currently installed version. Then you need to manually compare this against your update schedule making sure an update wasn’t missed. If you have alerts configured on the firewall you can receive alerts if a scheduled update did not run or you could also monitor your Syslog server for these events.
can-with-snmp: suspect this is false - needs verification
can-with-syslog: true
vendor-provided-management: Panorama and firewall GUI and alerts can be used to find this information manually
is_newest:
why: |
It is important to know if the newest available content is currently installed.
how: |
The command panos-request-content-upgrade-check retrieves not only the versions and the dates but it also shows what has been downloaded, currently installed, or previously installed. This variable checks for the version that says it’s installed state is set to current.
without-indeni:
If you didn’t have Indeni, you would need to manually check via the CLI or GUI (firewall or Panorama) to refresh/check for available updates and see if that is your currently installed version. Then you need to manually compare this against your update schedule making sure an update wasn’t missed. If you have alerts configured on the firewall you can receive alerts if a scheduled update did not run or you could also monitor your Syslog server for these events.
can-with-snmp: suspect this is false - needs verification
can-with-syslog: true
vendor-provided-management: Panorama and firewall GUI and alerts can be used to find this information manually
external-service-error:
skip-documentation: true
#! REMOTE::SSH
show clock
#! PARSER::AWK
#Tue Aug 21 20:10:21 CDT 2018
/Mon|Tue|Wed|Thu|Fri|Sat|Sun/ {
year = $6
month = parseMonthThreeLetter($2)
day = $3
now_time = $4
split(now_time, now_vals, ":")
hour = now_vals[1]
minute = now_vals[2]
second = now_vals[3]
current_epoch = datetime(year, month, day, hour, minute, second)
writeDynamicVariable("time", current_epoch)
}
#REMOTE::SSH
request content upgrade check
#PARSER::AWK
BEGIN {
version_found = 0
latest_version = 0
}
#8024-4749 45MB 2018/05/24 18:57:10 CDT yes current
#8019-4720 45MB 2018/05/14 16:10:35 CDT no no
#8023-4746 45MB 2018/05/22 20:23:44 CDT yes previous
If the commnand request-content-upgrade-check fails to run it will return Server error : followed by the reason such as generic communicaton error.
/^[0-9]/ {
# This version_found gets set if it finds a version after running the panos command.
version_found = 1
released_on_date = $3
split(released_on_date, date_vals, "/")
year = date_vals[1]
month = date_vals[2]
day = date_vals[3]
release_time = $4
split(release_time, time_vals, ":")
hour = time_vals[1]
minute = time_vals[2]
second = time_vals[3]
release_epoch = datetime(year, month, day, hour, minute, second)
# See if latest version dynamic variable entry is less than this release's release epoch.
if ( latest_version < release_epoch ) {
# If it is less than the latest version this will now set the latest_version dyanmic variable to the release_epoch.
latest_version = release_epoch
# Now also set the version_name to the first column of data containing a number or starting with a # if it happens to be set that way in your version of code.
version_name = $1
sub(/^#/, "", version_name)
# If this latest available version of content is the "current" installed content then mark is_current as true, otherwise false.
if ($7 == "current") {
is_newest = "true"
} else {
is_newest = "false"
}
versiontags["newest_version"] = version_name
}
}
/^Error/ {
# This version_found gets set if it finds a version after running the panos command.
error_found = 1
line = $NF
errortags[i++, “line”] = $0
}
END {
Patrik writeDoubleMetric(“current-date-time”, null, “gauge”, dynamic(“time”))
writeDoubleMetric("current-date-time", null, "gauge", dynamic("time"))
if (version_found) {
writeComplexMetric("content_update_state", versiontags, is_newest)
}
if (error_found) {
writeDoubleMetric("external-service-error", errortags, "gauge", "60", error_found)
}
}