Søren Eggert Lundsteen Olsen
842286d57d
One reviewable file per rule id with a Danish header: what and why, thresholds with config keys and defaults, severity, required rights (never local administrator), supported versions, collector file and member, and the evaluation in plain Danish. The Windows rules use no SQL: their exact CIM/WQL queries, event log XPath and a read-only PowerShell snippet to verify them are in a comment block. SQLI-SYN-001/002 carry the exact SQL a SQL check runs (session settings, transaction that is always rolled back, SELECT 1). A test checks every server and check rule has its file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
39 lines
1.8 KiB
SQL
39 lines
1.8 KiB
SQL
/*
|
||
SQLI-WIN-011 – Serveren er ikke genstartet i lang tid
|
||
======================================================
|
||
|
||
Hvad og hvorfor
|
||
De fleste Windows-opdateringer kræver en genstart. En server, der ikke er genstartet i flere måneder, mangler derfor
|
||
næsten sikkert sikkerhedsopdateringer.
|
||
|
||
Tærskler (agentens appsettings.json)
|
||
SQLInsight:Servers:UptimeDays standard 0 = slået fra (fx 120 for et fund efter 120 dage uden genstart)
|
||
|
||
Alvor
|
||
Lav.
|
||
|
||
Rettigheder på den overvågede server (db/permissions/grant-windows-server.ps1, aldrig lokal administrator)
|
||
WMI Enable Account/Remote Enable på root\cimv2
|
||
WS-Man: Remote Management Users · DCOM: Distributed COM Users
|
||
|
||
Understøttede versioner
|
||
Windows Server 2008 R2 og nyere.
|
||
|
||
Collector
|
||
src/SQLInsight.Servers/CimWindowsServerSource.cs – Session.GetOperatingSystemAsync (CimQueries.OperatingSystemQuery),
|
||
fra src/SQLInsight.Agent/Servers/ServerMonitor.cs – CollectPerformanceAsync.
|
||
Regel
|
||
src/SQLInsight.Rules/Servers/WindowsServerRules.cs – ServerUptimeRule
|
||
|
||
Evaluering
|
||
Oppetid = nu − LastBootUpTime. Er UptimeDays større end 0, og oppetiden mindst så mange dage, er det et fund.
|
||
Med UptimeDays = 0 er reglen "ikke relevant".
|
||
|
||
Reglen bruger ikke SQL. Forespørgslen mod Windows står herunder; filen indeholder kun kommentarer og ændrer intet.
|
||
|
||
CIM/WQL (namespace root\cimv2):
|
||
SELECT Caption, Version, BuildNumber, LastBootUpTime, TotalVisibleMemorySize, CSName FROM Win32_OperatingSystem
|
||
|
||
Efterprøv med PowerShell (skrivebeskyttet; kør på agentens server som agentens konto):
|
||
(Get-Date) - (Get-CimInstance -ComputerName SERVER -Query "SELECT LastBootUpTime FROM Win32_OperatingSystem").LastBootUpTime
|
||
*/
|