Vss snapshot monitoring

boxy_25 · Post by **boxy_25** » Mon Sep 12, 2022 2:42 am

Hi Alex,

We saw that the recently cyberattacks starts by disabling the vss snapshots on all servers.
We use vss snapshot on our file servers because it is very usefull for restoring files and folders, especilally when a user get some files encrypted by ransomware...
We'd like HM to monitor if snapshots are available and renewed.
I've tried to monitor the snap files but it seems that its not accessible because it's system files.
The only command i found is "vssadmin list shadows" that list all the snaps, but i cannot use it in HM
any idea how i can do that??
Thanks.

boxy_25 · Post by **boxy_25** » Mon Sep 12, 2022 7:02 am

I found a way to count snapshots with powershell

Code: Select all

(Get-CimInstance win32_shadowcopy).count

So if the output is 0 there is a pb. else it's ok
I've try to put that in a shell test but it doesn't work. I'm not very familiar with shell test...

KS-Soft · Post by **KS-Soft** » Mon Sep 12, 2022 9:09 am

Script result should look like
scriptres:Ok:5
or
scriptres:Bad:0
or
scriptres:Bad:snapshot missed

HostMonitor does not know what results are good, what results are bad so you should tell HostMonitor what status to set

https://www.ks-soft.net/hostmon.eng/mfr ... m#shellres

Regards
Alex