Having been in this situation recently, I needed to audit and report on the types of files open on the file server, my hunch was a certain select number of users were running applications (like *gulp* lotus notes) from the network share.

Disappointed with the powershell scripts on the interwebs, I decided to write my own function to perform this task:

[sourcecode language=”powershell”]
function get-openfiles{
param(
$computername=@($env:computername),
$verbose=$false)
$collection = @()
foreach ($computer in $computername){
$netfile = [ADSI]"WinNT://$computer/LanmanServer"

$netfile.Invoke("Resources") | foreach {
try{
$collection += New-Object PsObject -Property @{
Id = $_.GetType().InvokeMember("Name", ‘GetProperty’, $null, $_, $null)
itemPath = $_.GetType().InvokeMember("Path", ‘GetProperty’, $null, $_, $null)
UserName = $_.GetType().InvokeMember("User", ‘GetProperty’, $null, $_, $null)
LockCount = $_.GetType().InvokeMember("LockCount", ‘GetProperty’, $null, $_, $null)
Server = $computer
}
}
catch{
if ($verbose){write-warning $error[0]}
}
}
}
Return $collection
}
[/sourcecode]

The function above (get-openfiles) has been written to accept an array of servers to the command line and it will return the following items:

• The ID of the open file.

• The server it’s open from.

• The username who has the file open.

• The amount of locks the file has.

A couple of quick examples for using this command are below:


Retrieving open files from server1:






[sourcecode language=”powershell”]get-openfiles -computername server1 | select server,itempath,lockcount[/sourcecode]



Retrieve a count of open files that end with the nsf file type (Lotus Notes):






[sourcecode language=”powershell”](get-open files -computername server1,server2 | ? {$_.itempath -like "*.nsf*"}).count()[/sourcecode]



Retrieve a report of total open files on a number of file servers:



[sourcecode language=”powershell”]get-openfiles -computername server1,server2,server3,server4,server5 | group -property server[/sourcecode]

“Your XenApp servers have very high disk queue’s and IO”

“What’s causing it?”

“dunno…”

With Server 2008, the task manager’s resource monitor feature will help you find these items. But in server 2003 this was a perilous task. The specific details for disk io per process are stored in performance monitor under each specific process running. Trying to analyse each process was a massive pain, but powershell can do some very clever work to help alleviate this!

I wrote two quick functions which act similar to “top” in linux for giving an on screen view, updating at interval of what exactly is creating IO activity. These two functions are:

get-IODataBytes:

Get-IODataOperations

The code for these functions are below:

[sourcecode language=”powershell”]
function get-iodatabytes{
$result=(get-counter -counter "Process(*)IO Data Bytes/sec" -ea 0).countersamples | ? {$_.cookedvalue -gt 0} | select instancename,@{Name="SessionID";Expression={if ($_.path.contains("#")){($_.path.split("#)"))[1]}else{"0"}}},@{Name="IO Data Bytes/sec";Expression={[math]::Round($_.cookedvalue,0)}},@{Name="IO Data KBytes/sec";Expression={[math]::Round($_.cookedvalue / 1024,0)}} | sort -Descending "IO Data Bytes/sec" | ft
$currentqueue=(((get-counter -counter "PhysicalDisk(0 C:)Current Disk Queue Length" -ea 0).countersamples) | select cookedvalue).cookedvalue
clear
write-warning "Hit [CTRL] + [C] to exit live capture"
write-host "Current Disk queue: $currentqueue"
return $Result
}

FUnction get-IODataOperations {
$result=(get-counter -counter "Process(*)IO Data Operations/sec" -ea 0).countersamples | ? {$_.cookedvalue -gt 0} | select instancename,@{Name="SessionID";Expression={if ($_.path.contains("#")){($_.path.split("#)"))[1]}else{"0"}}},@{Name="IO Data Operations/sec";Expression={[math]::Round($_.cookedvalue,0)}} | sort -Descending "IO Data Operations/sec" | ft
$currentqueue=(((get-counter -counter "PhysicalDisk(0 C:)Current Disk Queue Length" -ea 0).countersamples) | select cookedvalue).cookedvalue
clear
write-warning "Hit [CTRL] + [C] to exit live capture"
write-host "Current Disk queue: $currentqueue"
return $Result
}

[/sourcecode]

if you wish to loop one of these functions, simply use the following code:

[sourcecode language=”powershell”]
while ($true){
get-iodataoperations
start-sleep 1
}
[/sourcecode]

I immediately jumped to the registry HKEY_LOCAL_MACHINEClusterResources and found the resource by guid of my misbehaving file cluster. I could see all the shares missing were still published as resources as below:

Upon reviewing the event logs, each time the cluster was failed over, each missing share was logging the following event:

Log Name: System
Source: Microsoft-Windows-FailoverClustering
Date: xx/xx/xxxx 08:00:27
Event ID: 1068
Task Category: File Server Resource
Level: Warning
Keywords:
User: SYSTEM
Computer: XXXXXXXXXXX.Domain.com
Description:
Cluster file share resource 'File Server FileServer' cannot be brought online. Creation of file share 'Vedeni' (scoped to network name Fileserver) failed due to error '5'. This operation will be automatically retried.

Upon reviewing the share permissions, an over zealous administrator had trimmed the NTFS permissions, removing the local system account. Upon each cluster resource coming online, the cluster uses the local system account to enumerate the shares and present them. Remove this account and your shares wont come online!

This  account doesnt need to be on every folder, just each folder a share is based on. E.g. if you share d:sharefinance as serverfinance, only the finance folder needs access granted to the system account.

To resolve, configure the system account to have access to the folder on “this folder only” then restart the file server resource. The resource will come on-line and your shares will be available again!

Often when restarting a server its nice to get a complete timeline of when the server went down and subsequently comes back up. I found this script a while back but found it lacked the later port 3389 to enable remote desktop again. I editted the following script from eric and have been using it for a very long time now.

http://www.ericwoodford.com/use_ping_to_notify_when_server_reboots

I have modified it slightly to include a program called portqry, when a server is restarted it monitors ping responses until the server goes down. It then continually pings the server until it gets a response. Once a responce on icmp is received it will query port 3389 (remote desktop) until it gets a response indicating the server is now ready to be logged into again.

you can either type rebooter “servername” or simply type rebooter and the program will ask you for the servers name.

After the jump is the code, and the zip file i have uploaded packaging it all together.

The script is available here with all the neccessary batches/programs, best to extract them to your %windir%system32 where they can be accessed from cmd.

http://www.4shared.com/file/64988601/c29bd123/rebooter.html

echo off
 CLS
 Set A=0
 Set ServerName=%1
if not '%1'=='' goto :Pass1
 Set /p ServerName=[What is the server name?]
 if not '%ServerName%'=='' goto :Pass1
 echo Failed to get Server name..
 Goto :End
:Pass1
 Title Checking %servername%
 Echo Checking Server %ServerName% for response
 echo Check # _
 :Pass1a
 ping %ServerName% > %servername%-results.txt
 find /C "Request timed out" %servername%-results.txt > %servername%-fresults.txt
for /F "skip=1 tokens=1,2 delims=:" %%a in (%servername%-fresults.txt) DO (
 if NOT "%%b"==" 0" goto :TimedOut
 cls
 Echo Checking Server %ServerName% for response
 echo Check # %A%
 Set /A A+=1
 Goto :Pass1a
 )
 :TimedOut
 Set DownTime=%TIME%
 Title %servername% DOWN
 Echo Server Down %DownTIME% Passes: %A%
 Set B=0
 :Pass2
 ping %ServerName% > %servername%-results.txt
 find /C "Request timed out" %servername%-results.txt > %servername%-fresults.txt
 for /F "skip=1 tokens=1,2 delims=:" %%a in (%servername%-fresults.txt) DO (
 if "%%b"==" 0" set uptime=%time% & set c=0 & goto :BackUp
 CLS
 Echo Checking Server %ServerName% for response
 echo Check # %A% - Server Down: %DownTime%
 Echo Waiting For Server to come up: %B%
 Set /A B+=1
 Goto :Pass2
 )
:BackUp
 Title %servername% Pinging
 cls
 Echo Checking Server %ServerName% for response
 echo Check # %A% - Server Down: %DownTime%
 echo Server Pinging Again: %uptime% - Passes: %B%
 Echo Checking rdp port:
 portqry -n %servername% -q -e 3389
 Set /A C+=1
 if %errorlevel% NEQ 0 goto :backup
 del %servername%-fresults.txt
 del %servername%-results.txt
 cls
 Title %servername% UP
 Echo Checking Server %ServerName% for response
 echo Check # %A% - Server Down: %DownTime%
 echo Server Pinging Again: %uptime% - Passes: %B%
 echo RDP available @ %time% - Passes: %C%
 @echo.
 Echo Server down @ %downtime% Service restored @ %time%
 pause
 :End

This is a vbs file and uses a servers.txt (keep the txt file in the same location as the script) file as a reference for each of the servers you wish to connect to. I’ve tested this on up to 30 servers at a time with flawless output. This script can be run as a schedueled task and accross psexec. Just one point to note, if it is being executed from a UNC path, map the drive first or it will fail to lookup servers.txt

I use this script as a daily check to check up on all the file servers and exchange servers in the morning.

Heres an example of the html file you are finished with.

Server Utilization Report

Server1 Drive Utilization

Created 26/02/2008 12:14:12 by morgan_a

For the code, click more…

‘Andrew Morgan February 2008
‘connects to a device and lists all capacity & free space

Dim objService,objLocator
Dim objFSO, objOutFile,objFile1
Dim objNetwork

‘Get Date Vars
strMonth = Month(Date)
strDay = Day(Date)
strYear = Right(Year(Date),2)

On Error Resume Next

‘Location of HTML file that will be created (dont use network shares unless drive is mapped)
htmFile=”c:” & strMonth & “-” & strDay & “-” & strYear & “.htm”

‘Name of servers text file (must be kept in the same directory as the script)
serverlist=”servers.txt”

Const myGreen=”008000″
Const myRed=”FF0000″
Const myYellow=”FFD700″

set objNetwork=CreateObject(“wscript.network”)
Set objFSO=CreateObject(“Scripting.FileSystemObject”)
Set objOutFile=objFSO.CreateTextFile(htmFile)
Set objFile1=objFSO.OpenTextFile(serverlist,1)

‘Write Lead in of htm file
‘Change the next line to change the header
objOutfile.WriteLine “<HTML><HEAD><TITLE>Server Logical Drive Utilization</TITLE></HEAD>”
‘objOutfile.WriteLine “<BODY BGCOLOR=” & CHR(34) & “FFFFF” & CHR(34)& “>”
objOutfile.WriteLine “<BODY BGCOLOR=FFFFF>”
objOutfile.WriteLine “<H1>Server Utilization Report</H1></P>”

Do While objFile1.AtEndOfStream<>True
strServer=objFile1.ReadLine

If strServer<>”” Then
‘reinitialize
PerFree=””
Graph=””
Size=””
Free=””

objOutfile.WriteLine “<BR>” & UCASE(strServer) & ” Drive Utilization<BR><HR>”

‘Create locator
Set objLocator = CreateObject(“WbemScripting.SWbemLocator”)
If Err.Number then
objOutfile.WriteLine “Error ” & err.number & ” [0x” & CStr(Hex(Err.Number)) & “] occurred in creating a locator object.<BR>”
If Err.Description <> “” Then
objOutfile.WriteLine “Error description: ” & Err.Description & “.</p>”
End If
Err.Clear
End If

‘Connect to the namespace which is either local or remote
‘Uncomment next line for debugging
‘wscript.echo “Connecting to ” & “(“&strServer&”,rootcimv2)”

Set objService = objLocator.ConnectServer (strServer,”rootcimv2″)
ObjService.Security_.impersonationlevel = 3
If Err.Number then
objOutfile.WriteLine “Error ” & err.number & ” [0x” & CStr(Hex(Err.Number)) &”] occurred in connecting to server ” & UCASE(strServer) & “.<BR>”
objOutfile.WriteLine “Make sure you are using valid credentials that have administrative rights on this server.</P>”
If Err.Description <> “” Then
objOutfile.WriteLine “Error description: ” & Err.Description & “.</P>”
End If
Err.Clear
Else

objOutfile.WriteLine “<Table Border=0 CellPadding=5>”
For Each item In objService.InstancesOf(“Win32_LogicalDisk”)
If item.DriveType=3 Then ‘get local drives only
PerFree=FormatPercent(item.FreeSpace/item.Size,2)
Graph=FormatNumber((item.Freespace/1048576)/(item.Size/1048576),2)*100
Size=FormatNumber(item.Size/1048576,0) & ” MB”
Free=FormatNumber(item.FreeSpace/1048576,0) & ” MB”

objOutfile.WriteLine “<TR>”
objOutfile.WriteLine “<TD>” &item.DeviceID & ” </TD>”
objOutfile.WriteLine “<TD>Size: ” & Size & “</TD>”
objOutfile.WriteLine “<TD>Free: ” & Free & “</TD>”
objOutfile.WriteLine “<TD><B><Font Size=+1 Color=” & GraphColor(graph) & “>” & String(Graph,”|”) & “</Font></B></TD>”
objOutfile.WriteLine “<TD>” & PerFree & ” Free</TD></TR>”
End If
Next
objOutfile.WriteLine “</Table>”
End If
End If
Loop
objFile1.Close

objOutfile.WriteLine(“</P><Font Size=-1><B><I> Created ” & NOW & ” by ” & objNetwork.UserName & “</I></B></Font>”)
objOutfile.WriteLine(“</BODY></HTML>”)
objOutfile.Close
‘commented echo back
‘wscript.Echo VBCRLF & “See ” & htmfile & ” for results”
Function GraphColor(graph)
On Error Resume Next
If Graph > 30 Then
GraphColor=myGreen
Exit Function
End If
If Graph < 10 Then
GraphColor=myRed
Else
GraphColor=myYellow
End If
End Function
Sub CheckResponse(response)
If response=”” Then
wscript.Echo “You didn’t enter anything in the last input box or you cancelled the script.”
wscript.Quit
End If
End Sub

‘EOF