check_tasksched - How to get last Event-ID

[k-tf]

Hi there!

I'm currently trying to check for stuck tasks on the Windows Task Scheduler with check_tasksched.

The first idea was to refer to most_recent_run_time but that is being reset when the next schedule occurs, even if that one fails with Launch request ignored, instance already running (Event-ID 322).

So my problem could be solved in either of two ways:

1. Get a correct value for most_recent_run_time that refers to the time when the current task was really started (and not the time the scheduler did try to start a task)
2. Get the value of the last Event-ID for this task. (If it's 322, another still running task is blocking the execution of a new one)

Does somebody got an idea on how to accomplish this? Or would this a new feature request?

[k-tf]

Self-answered:

after tedious testing I verified the following return codes:

• 267009 The task is currently running
• -2147020576 - The scheduler didn't start a new task because there's already an instance of this task running. According to the Windows documentation this was supposed to be 2147750687 but not on our Windows 2016 Server and -2147020576 is also not a two-complement of 2147750687. I gave up trying to understand this.

So for my needs I trigger critical if the task

• is running longer than 50 Minutes,
• OR the exit code is negative (catches any weird exit code)
• OR the last schedule is longer ago than 70 minutes (60 Minutes is our default schedule and I add 10 Minutes to avoid false positives when the schedule is late because of heavy system load)

The final check command looks like this:
check_tasksched "filter=title eq 'MYTASK'" "critical=(exit_code = 267009 AND most_recent_run_time < -50m) OR (exit_code < 0) OR (most_recent_run_time < -70m)" "warning=exit_code = 267009 AND most_recent_run_time < -40m" "empty-state=critical" "empty-syntax=CRITICAL: Task MYTASK not found" "detail-syntax=%(title): exit_code=%(exit_code) most_recent_run_time=%(most_recent_run_time) GMT" show-all