chiefgeek
a1a17e81a1
Includes updated JS challenge scripts with Claude-User whitelist, same-site referer bypass, Blackbox-Exporter allowed bot, and all new exporters, cheat sheets, and automation scripts.
468 lines
17 KiB
PowerShell
468 lines
17 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Azure AD Connect Sync Prometheus Metrics Exporter
|
|
.DESCRIPTION
|
|
Prometheus exporter for Azure AD Connect - sync cycle status, last sync
|
|
timestamp, connector space object counts, export/import errors, password
|
|
sync status, staging mode, and auto-upgrade state. Exports metrics as
|
|
Prometheus-compatible text format.
|
|
.PARAMETER Mode
|
|
Output mode: 'stdout' (default), 'textfile', or 'http'
|
|
.PARAMETER Port
|
|
HTTP port for http mode (default: 9517)
|
|
.PARAMETER TextfileDir
|
|
Directory for textfile collector output (default: C:\ProgramData\node_exporter)
|
|
.PARAMETER InstallScheduledTask
|
|
Switch to create a scheduled task for auto-start on system boot
|
|
.PARAMETER TaskIntervalMinutes
|
|
Interval in minutes for the scheduled task (default: 2)
|
|
.NOTES
|
|
Author: Phil Connor
|
|
Contact: contact@mylinux.work
|
|
Website: https://mylinux.work
|
|
License: MIT
|
|
Version: 1.0
|
|
|
|
Metrics Exported:
|
|
Core Status:
|
|
- adconnect_up
|
|
- adconnect_exporter_info{version}
|
|
|
|
Sync Cycle:
|
|
- adconnect_sync_cycle_status
|
|
- adconnect_sync_cycle_in_progress
|
|
- adconnect_last_sync_timestamp
|
|
- adconnect_next_sync_timestamp
|
|
- adconnect_sync_interval_seconds
|
|
|
|
Connectors:
|
|
- adconnect_connector_space_objects{connector}
|
|
- adconnect_export_errors_total{connector}
|
|
- adconnect_import_errors_total{connector}
|
|
|
|
Password Sync:
|
|
- adconnect_password_sync_enabled
|
|
- adconnect_password_sync_last_success_timestamp
|
|
|
|
Configuration:
|
|
- adconnect_staging_mode
|
|
- adconnect_auto_upgrade_state
|
|
|
|
Exporter:
|
|
- adconnect_exporter_duration_seconds
|
|
- adconnect_exporter_last_run_timestamp
|
|
#>
|
|
|
|
param(
|
|
[ValidateSet('stdout', 'textfile', 'http')]
|
|
[string]$Mode = 'stdout',
|
|
|
|
[int]$Port = 9517,
|
|
|
|
[string]$TextfileDir = 'C:\ProgramData\node_exporter',
|
|
|
|
[switch]$InstallScheduledTask,
|
|
|
|
[int]$TaskIntervalMinutes = 2
|
|
)
|
|
|
|
# Create a scheduled task to run this script every $TaskIntervalMinutes minutes
|
|
if ($InstallScheduledTask) {
|
|
$taskName = "ADConnectSyncExporter"
|
|
$existingTask = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
|
|
|
|
if (-not $existingTask) {
|
|
$taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$($MyInvocation.MyCommand.Path)`" -Mode textfile"
|
|
|
|
if (-not $TaskIntervalMinutes -or $TaskIntervalMinutes -le 0) {
|
|
throw "TaskIntervalMinutes must be a positive integer"
|
|
}
|
|
|
|
$taskTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes $TaskIntervalMinutes) -RepetitionDuration (New-TimeSpan -Days 365)
|
|
$taskPrincipal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
|
|
|
|
try {
|
|
Write-Host "Creating scheduled task: $taskName"
|
|
Register-ScheduledTask -TaskName $taskName -Action $taskAction -Trigger $taskTrigger -Principal $taskPrincipal -Description "Exports AD Connect sync metrics for Prometheus every $TaskIntervalMinutes minutes"
|
|
|
|
$createdTask = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
|
|
if (-not $createdTask) {
|
|
throw "Failed to verify scheduled task creation"
|
|
}
|
|
Write-Host "Successfully created scheduled task: $taskName" -ForegroundColor Green
|
|
} catch {
|
|
Write-Error "Failed to create scheduled task: $($_.Exception.Message)"
|
|
throw
|
|
}
|
|
} else {
|
|
Write-Host "Scheduled task '$taskName' already exists, skipping creation"
|
|
}
|
|
}
|
|
|
|
$ErrorActionPreference = 'SilentlyContinue'
|
|
|
|
# ============================================================================
|
|
# HELPER FUNCTIONS
|
|
# ============================================================================
|
|
|
|
function Get-UnixTimestamp {
|
|
[int][double]::Parse((Get-Date -UFormat '%s'))
|
|
}
|
|
|
|
function Format-MetricValue {
|
|
param([double]$Value, [int]$Decimals = 2)
|
|
[math]::Round($Value, $Decimals)
|
|
}
|
|
|
|
# ============================================================================
|
|
# AD CONNECT METRICS
|
|
# ============================================================================
|
|
|
|
function Get-ADConnectMetrics {
|
|
$sb = [System.Text.StringBuilder]::new()
|
|
|
|
# Check if ADSync module is available
|
|
$adSyncAvailable = $false
|
|
try {
|
|
Import-Module ADSync -ErrorAction Stop
|
|
$adSyncAvailable = $true
|
|
} catch {
|
|
Write-Warning "Failed to load ADSync module: $_"
|
|
}
|
|
|
|
# --- adconnect_up ---
|
|
[void]$sb.AppendLine('# HELP adconnect_up AD Connect service reachability (1=up, 0=down)')
|
|
[void]$sb.AppendLine('# TYPE adconnect_up gauge')
|
|
$upVal = if ($adSyncAvailable) { 1 } else { 0 }
|
|
[void]$sb.AppendLine("adconnect_up $upVal")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- adconnect_exporter_info ---
|
|
[void]$sb.AppendLine('# HELP adconnect_exporter_info Exporter version information')
|
|
[void]$sb.AppendLine('# TYPE adconnect_exporter_info gauge')
|
|
[void]$sb.AppendLine('adconnect_exporter_info{version="1.0"} 1')
|
|
[void]$sb.AppendLine('')
|
|
|
|
if (-not $adSyncAvailable) {
|
|
return $sb.ToString()
|
|
}
|
|
|
|
# --- Sync scheduler metrics ---
|
|
$scheduler = $null
|
|
try {
|
|
$scheduler = Get-ADSyncScheduler -ErrorAction Stop
|
|
} catch {
|
|
Write-Warning "Failed to get sync scheduler: $_"
|
|
}
|
|
|
|
# --- adconnect_sync_cycle_status ---
|
|
[void]$sb.AppendLine('# HELP adconnect_sync_cycle_status Last sync cycle result (1=completed, 0=error)')
|
|
[void]$sb.AppendLine('# TYPE adconnect_sync_cycle_status gauge')
|
|
$cycleStatus = 0
|
|
if ($scheduler) {
|
|
try {
|
|
$lastRun = Get-ADSyncRunProfileResult -NumberRequested 1 -ErrorAction Stop
|
|
if ($lastRun -and $lastRun.Result -eq 'success') {
|
|
$cycleStatus = 1
|
|
}
|
|
} catch {}
|
|
}
|
|
[void]$sb.AppendLine("adconnect_sync_cycle_status $cycleStatus")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- adconnect_sync_cycle_in_progress ---
|
|
[void]$sb.AppendLine('# HELP adconnect_sync_cycle_in_progress Sync cycle currently running (1=yes, 0=no)')
|
|
[void]$sb.AppendLine('# TYPE adconnect_sync_cycle_in_progress gauge')
|
|
$inProgress = 0
|
|
if ($scheduler -and $scheduler.SyncCycleInProgress) {
|
|
$inProgress = 1
|
|
}
|
|
[void]$sb.AppendLine("adconnect_sync_cycle_in_progress $inProgress")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- adconnect_last_sync_timestamp ---
|
|
[void]$sb.AppendLine('# HELP adconnect_last_sync_timestamp Unix timestamp of last completed sync')
|
|
[void]$sb.AppendLine('# TYPE adconnect_last_sync_timestamp gauge')
|
|
$lastSyncTs = 0
|
|
if ($scheduler -and $scheduler.LastSuccessfulSyncCycleTime) {
|
|
try {
|
|
$lastSyncTs = [int][double]::Parse((Get-Date $scheduler.LastSuccessfulSyncCycleTime -UFormat '%s'))
|
|
} catch {}
|
|
}
|
|
[void]$sb.AppendLine("adconnect_last_sync_timestamp $lastSyncTs")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- adconnect_next_sync_timestamp ---
|
|
[void]$sb.AppendLine('# HELP adconnect_next_sync_timestamp Unix timestamp of next scheduled sync')
|
|
[void]$sb.AppendLine('# TYPE adconnect_next_sync_timestamp gauge')
|
|
$nextSyncTs = 0
|
|
if ($scheduler -and $scheduler.NextSyncCycleStartTimeInUTC) {
|
|
try {
|
|
$nextSyncTs = [int][double]::Parse((Get-Date $scheduler.NextSyncCycleStartTimeInUTC -UFormat '%s'))
|
|
} catch {}
|
|
}
|
|
[void]$sb.AppendLine("adconnect_next_sync_timestamp $nextSyncTs")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- adconnect_sync_interval_seconds ---
|
|
[void]$sb.AppendLine('# HELP adconnect_sync_interval_seconds Configured sync cycle interval in seconds')
|
|
[void]$sb.AppendLine('# TYPE adconnect_sync_interval_seconds gauge')
|
|
$intervalSeconds = 0
|
|
if ($scheduler -and $scheduler.CurrentlyEffectiveSyncCycleInterval) {
|
|
try {
|
|
$intervalSeconds = [int]$scheduler.CurrentlyEffectiveSyncCycleInterval.TotalSeconds
|
|
} catch {}
|
|
}
|
|
[void]$sb.AppendLine("adconnect_sync_interval_seconds $intervalSeconds")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- Connector metrics ---
|
|
$connectors = @()
|
|
try {
|
|
$connectors = Get-ADSyncConnector -ErrorAction Stop
|
|
} catch {
|
|
Write-Warning "Failed to get connectors: $_"
|
|
}
|
|
|
|
# --- adconnect_connector_space_objects ---
|
|
[void]$sb.AppendLine('# HELP adconnect_connector_space_objects Object count per connector space')
|
|
[void]$sb.AppendLine('# TYPE adconnect_connector_space_objects gauge')
|
|
foreach ($conn in $connectors) {
|
|
$connName = $conn.Name -replace '[\\"]', ''
|
|
$objectCount = 0
|
|
try {
|
|
$csStat = Get-ADSyncConnectorStatistics -ConnectorName $conn.Name -ErrorAction Stop
|
|
if ($csStat) {
|
|
$objectCount = $csStat.Count
|
|
}
|
|
} catch {}
|
|
[void]$sb.AppendLine("adconnect_connector_space_objects{connector=`"$connName`"} $objectCount")
|
|
}
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- adconnect_export_errors_total ---
|
|
[void]$sb.AppendLine('# HELP adconnect_export_errors_total Export errors per connector')
|
|
[void]$sb.AppendLine('# TYPE adconnect_export_errors_total gauge')
|
|
foreach ($conn in $connectors) {
|
|
$connName = $conn.Name -replace '[\\"]', ''
|
|
$exportErrors = 0
|
|
try {
|
|
$lastExportRun = Get-ADSyncRunProfileResult -ConnectorId $conn.Identifier -RunProfileName "Export" -NumberRequested 1 -ErrorAction Stop
|
|
if ($lastExportRun -and $lastExportRun.CountExportErrors) {
|
|
$exportErrors = $lastExportRun.CountExportErrors
|
|
}
|
|
} catch {}
|
|
[void]$sb.AppendLine("adconnect_export_errors_total{connector=`"$connName`"} $exportErrors")
|
|
}
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- adconnect_import_errors_total ---
|
|
[void]$sb.AppendLine('# HELP adconnect_import_errors_total Import errors per connector')
|
|
[void]$sb.AppendLine('# TYPE adconnect_import_errors_total gauge')
|
|
foreach ($conn in $connectors) {
|
|
$connName = $conn.Name -replace '[\\"]', ''
|
|
$importErrors = 0
|
|
try {
|
|
$lastImportRun = Get-ADSyncRunProfileResult -ConnectorId $conn.Identifier -RunProfileName "Full Import" -NumberRequested 1 -ErrorAction Stop
|
|
if ($lastImportRun -and $lastImportRun.CountImportErrors) {
|
|
$importErrors = $lastImportRun.CountImportErrors
|
|
}
|
|
} catch {}
|
|
[void]$sb.AppendLine("adconnect_import_errors_total{connector=`"$connName`"} $importErrors")
|
|
}
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- Password sync metrics ---
|
|
[void]$sb.AppendLine('# HELP adconnect_password_sync_enabled Password hash sync enabled (1=yes, 0=no)')
|
|
[void]$sb.AppendLine('# TYPE adconnect_password_sync_enabled gauge')
|
|
$pwdSyncEnabled = 0
|
|
if ($scheduler -and $scheduler.SyncCycleEnabled) {
|
|
try {
|
|
foreach ($conn in $connectors) {
|
|
if ($conn.ConnectorTypeName -eq 'AD') {
|
|
$pwdSync = $conn.PasswordHashSyncConfiguration
|
|
if ($pwdSync -and $pwdSync.Enabled) {
|
|
$pwdSyncEnabled = 1
|
|
break
|
|
}
|
|
}
|
|
}
|
|
} catch {}
|
|
}
|
|
[void]$sb.AppendLine("adconnect_password_sync_enabled $pwdSyncEnabled")
|
|
[void]$sb.AppendLine('')
|
|
|
|
[void]$sb.AppendLine('# HELP adconnect_password_sync_last_success_timestamp Unix timestamp of last successful password sync')
|
|
[void]$sb.AppendLine('# TYPE adconnect_password_sync_last_success_timestamp gauge')
|
|
$pwdSyncLastTs = 0
|
|
try {
|
|
$pwdSyncStatus = Get-ADSyncAADPasswordSyncConfiguration -SourceConnector (($connectors | Where-Object { $_.ConnectorTypeName -eq 'AD' } | Select-Object -First 1).Name) -ErrorAction Stop
|
|
if ($pwdSyncStatus -and $pwdSyncStatus.LastSuccessfulPingTime) {
|
|
$pwdSyncLastTs = [int][double]::Parse((Get-Date $pwdSyncStatus.LastSuccessfulPingTime -UFormat '%s'))
|
|
}
|
|
} catch {}
|
|
[void]$sb.AppendLine("adconnect_password_sync_last_success_timestamp $pwdSyncLastTs")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- Staging mode ---
|
|
[void]$sb.AppendLine('# HELP adconnect_staging_mode Staging mode active (1=yes, 0=no)')
|
|
[void]$sb.AppendLine('# TYPE adconnect_staging_mode gauge')
|
|
$stagingMode = 0
|
|
if ($scheduler -and $scheduler.StagingModeEnabled) {
|
|
$stagingMode = 1
|
|
}
|
|
[void]$sb.AppendLine("adconnect_staging_mode $stagingMode")
|
|
[void]$sb.AppendLine('')
|
|
|
|
# --- Auto-upgrade ---
|
|
[void]$sb.AppendLine('# HELP adconnect_auto_upgrade_state Auto-upgrade enabled (1=enabled, 0=disabled)')
|
|
[void]$sb.AppendLine('# TYPE adconnect_auto_upgrade_state gauge')
|
|
$autoUpgrade = 0
|
|
try {
|
|
$upgradeState = Get-ADSyncAutoUpgrade -ErrorAction Stop
|
|
if ($upgradeState -eq 'Enabled') {
|
|
$autoUpgrade = 1
|
|
}
|
|
} catch {}
|
|
[void]$sb.AppendLine("adconnect_auto_upgrade_state $autoUpgrade")
|
|
[void]$sb.AppendLine('')
|
|
|
|
$sb.ToString()
|
|
}
|
|
|
|
# ============================================================================
|
|
# COLLECT ALL METRICS
|
|
# ============================================================================
|
|
|
|
function Get-AllMetrics {
|
|
$scriptStart = Get-Date
|
|
$sb = [System.Text.StringBuilder]::new()
|
|
|
|
# Collect AD Connect metrics
|
|
[void]$sb.Append((Get-ADConnectMetrics))
|
|
|
|
# Exporter runtime
|
|
$scriptEnd = Get-Date
|
|
$duration = Format-MetricValue ($scriptEnd - $scriptStart).TotalSeconds
|
|
$timestamp = Get-UnixTimestamp
|
|
|
|
[void]$sb.AppendLine('# HELP adconnect_exporter_duration_seconds Time to generate all metrics')
|
|
[void]$sb.AppendLine('# TYPE adconnect_exporter_duration_seconds gauge')
|
|
[void]$sb.AppendLine("adconnect_exporter_duration_seconds $duration")
|
|
[void]$sb.AppendLine('')
|
|
[void]$sb.AppendLine('# HELP adconnect_exporter_last_run_timestamp Unix timestamp of last successful run')
|
|
[void]$sb.AppendLine('# TYPE adconnect_exporter_last_run_timestamp gauge')
|
|
[void]$sb.AppendLine("adconnect_exporter_last_run_timestamp $timestamp")
|
|
[void]$sb.AppendLine('')
|
|
|
|
$sb.ToString()
|
|
}
|
|
|
|
# ============================================================================
|
|
# HTTP SERVER MODE
|
|
# ============================================================================
|
|
|
|
function Start-HttpServer {
|
|
param([int]$ListenPort)
|
|
|
|
$prefix = "http://+:$ListenPort/"
|
|
$listener = [System.Net.HttpListener]::new()
|
|
$listener.Prefixes.Add($prefix)
|
|
|
|
try {
|
|
$listener.Start()
|
|
Write-Host "Starting AD Connect Sync exporter on port $ListenPort..." -ForegroundColor Green
|
|
Write-Host "Metrics available at http://localhost:$ListenPort/metrics"
|
|
|
|
while ($listener.IsListening) {
|
|
$context = $listener.GetContext()
|
|
$request = $context.Request
|
|
$response = $context.Response
|
|
|
|
if ($request.Url.AbsolutePath -eq '/metrics') {
|
|
$metrics = Get-AllMetrics
|
|
$buffer = [System.Text.Encoding]::UTF8.GetBytes($metrics)
|
|
$response.ContentType = 'text/plain; version=0.0.4; charset=utf-8'
|
|
}
|
|
else {
|
|
$html = @"
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head><title>AD Connect Sync Exporter v1.0</title></head>
|
|
<body>
|
|
<h1>AD Connect Sync Exporter v1.0</h1>
|
|
<p><a href="/metrics">Metrics</a></p>
|
|
<h2>Metrics</h2>
|
|
<ul>
|
|
<li>Sync cycle status and timing</li>
|
|
<li>Connector space object counts</li>
|
|
<li>Export and import error totals</li>
|
|
<li>Password hash sync status</li>
|
|
<li>Staging mode and auto-upgrade state</li>
|
|
</ul>
|
|
</body>
|
|
</html>
|
|
"@
|
|
$buffer = [System.Text.Encoding]::UTF8.GetBytes($html)
|
|
$response.ContentType = 'text/html; charset=utf-8'
|
|
}
|
|
|
|
$response.ContentLength64 = $buffer.Length
|
|
$response.OutputStream.Write($buffer, 0, $buffer.Length)
|
|
$response.OutputStream.Close()
|
|
}
|
|
}
|
|
catch {
|
|
Write-Error "HTTP server error: $_"
|
|
Write-Error "If access denied, run: netsh http add urlacl url=http://+:$ListenPort/ user=Everyone"
|
|
}
|
|
finally {
|
|
if ($listener.IsListening) {
|
|
$listener.Stop()
|
|
}
|
|
}
|
|
}
|
|
|
|
# ============================================================================
|
|
# MAIN EXECUTION
|
|
# ============================================================================
|
|
|
|
switch ($Mode) {
|
|
'http' {
|
|
Start-HttpServer -ListenPort $Port
|
|
}
|
|
'textfile' {
|
|
$OutputFile = Join-Path $TextfileDir 'adconnect_sync.prom'
|
|
|
|
$outputDir = Split-Path $OutputFile -Parent
|
|
if (-not (Test-Path $outputDir)) {
|
|
New-Item -Path $outputDir -ItemType Directory -Force | Out-Null
|
|
}
|
|
|
|
$tempFile = Join-Path $outputDir ".adconnect_sync.$PID.tmp"
|
|
|
|
try {
|
|
$metrics = Get-AllMetrics
|
|
$metrics | Out-File -FilePath $tempFile -Encoding utf8 -NoNewline
|
|
|
|
$lineCount = ($metrics -split "`n").Count
|
|
if ($lineCount -lt 10) {
|
|
Remove-Item -Path $tempFile -Force -ErrorAction SilentlyContinue
|
|
Write-Error "Metrics file too small ($lineCount lines), keeping previous"
|
|
exit 1
|
|
}
|
|
|
|
Move-Item -Path $tempFile -Destination $OutputFile -Force
|
|
Write-Host "Metrics written to $OutputFile ($lineCount lines)" -ForegroundColor Green
|
|
}
|
|
catch {
|
|
Remove-Item -Path $tempFile -Force -ErrorAction SilentlyContinue
|
|
Write-Error "Failed to generate metrics: $_"
|
|
exit 1
|
|
}
|
|
}
|
|
default {
|
|
Get-AllMetrics | Write-Output
|
|
}
|
|
}
|