Boost System Reliability: Monitor Your Windows Task Scheduler with New Relic

What is Windows Task Scheduler?

Windows Task Scheduler is a powerful built-in tool that allows you to automate tasks on your Windows system. You can schedule tasks to run at specific times, dates, or intervals, making it ideal for automating routine maintenance, data backups, software updates, and more.

Why monitor Task Scheduler?

Monitoring your Task Scheduler is crucial for several reasons, including:

• Proactive issue detection: Identify potential problems before they escalate, such as failed tasks or excessive resource consumption.
• Improved system reliability: Ensure that critical tasks are run reliably and on time.
• Enhanced security: Monitor security-related tasks and their status.
• Optimized resource utilization: Analyze task performance and identify opportunities for optimization.

New Relic

New Relic is a comprehensive cloud-based observability platform that provides real-time insights into the performance of your applications, infrastructure, and digital experiences. 

New Relic Flex is a powerful feature within the New Relic platform that allows you to collect custom metrics from virtually any source. In this blog post, we'll leverage New Relic Flex to monitor the health and performance of Task Scheduler.

By integrating New Relic Flex with Task Scheduler, you can gain valuable visibility into the health and performance of your automated tasks.

What to monitor in Task Scheduler

Before diving into the technical implementation, let's identify the key aspects of Task Scheduler that should be monitored:

1. Task status:
   • Whether the task completed successfully or failed.
   • The reason for failure (if applicable).
2. Error logs:
   • Review error logs to identify and troubleshoot issues.
   • Monitor for recurring error patterns.
3. Resource utilization:
   • Monitor CPU and memory usage during task execution.
   • Identify tasks that consume excessive resources.

By monitoring these aspects, you can proactively identify and resolve issues, ensuring the reliability and efficiency of your automated tasks.

Set up New Relic Flex for Task Scheduler monitoring

Prerequisites

• A New Relic account. If you don’t have a New Relic account, you can sign up for one for free here. 
• New Relic infrastructure agent installed on your Windows server using the guided install.
• PowerShell installed.
• Download all files of the Windows Scheduled Task monitor integration from GitHub here. 

Steps to configure and deploy New Relic Flex integration

Capture Task Scheduler’s status details

1. Log on to the Windows Server host.
2. Copy all the files of the integration to the Windows Server host.
3. Open the file WindowsScheduledTaskInfo.ps1 in Windows PowerShell IDE and update the script to filter Tasks to be monitored in the Task Paths and Task Names.
   1. The script provided captures all tasks except for Task Path / Microsoft (contains systems default tasks).
   2. Test the script to ensure it runs without errors.

4. Install the New Relic infrastructure agent following the guided install or the preferred MSI installer method. 
5. The New Relic infrastructure agent should be installed in the C:\Program Files\New Relic\newrelic-infra directory.
6. Copy the following files to C:\Program Files\New Relic\newrelic-infra\integrations.d\ directory: 
   1. WindowsScheduledTaskInfo.ps1
   2. windows-scheduledtask-info-new.yml
7. Check for any errors reported while running this integration in the C:\Program Files\New Relic\newrelic-infra\newrelic-infra.log file.
8. Once the installation has completed successfully, the PowerShell script creates C:\Program Files\New Relic\newrelic-infra\integrations.d\windows-scheduled-task-info.json file, which contains the Task Scheduler details. The JSON structure looks similar to this:

9. Log in to your New Relic account.
10. Click Query Your Data and then run the following New Relic Query Language (NRQL) query:
    1. FROM WindowsScheduledTaskInfo SELECT *

11. This script captures relevant information about the status of a scheduled task:
    1. FROM WindowsScheduledTaskInfo, SELECT latest(LastRunTimeInMillis), latest(LastTaskResultHex), latest(NextRunTimeInMillis) FACET TaskPath, TaskName.

Capture Task Scheduler’s history and event logs

On Windows Server, scheduled task history is logged to the Windows event log. In addition to troubleshooting, these logs help you to detect any malicious activity on the servers.

1. Log on to the Windows Server host.
2. Enable history and Windows event log for Task Scheduler:
   1. Open Task Scheduler.
   2. In the Actions pane on the right side, click Enable All Tasks History.

2. Refer to the following links to enable Tasks History:
   2. https://docs.nxlog.co/integrate/windows-task-scheduler.html 
   3. https://answers.microsoft.com/en-us/windows/forum/all/oddly-named-tasks-in-task-scheduler-revealed/0259c489-335b-47f2-b35e-5815f2a2604e 
   4. https://stackoverflow.com/questions/23227964/how-can-i-enable-all-tasks-history-in-powershell 

4. Install the New Relic infrastructure agent following the guided install or the preferred MSI installer method. 
5. The New Relic infrastructure agent should be installed in the C:\Program Files\New Relic\newrelic-infra directory.
6. Copy the following files to C:\Program Files\New Relic\newrelic-infra\integrations.d\ directory: 
   4. WindowsScheduledTaskInfo.ps1
   5. windows-scheduledtask-info-new.yml
7. Check for any errors reported while running this integration in the C:\Program Files\New Relic\newrelic-infra\newrelic-infra.log file.
8. Once the installation has completed successfully, the PowerShell script creates C:\Program Files\New Relic\newrelic-infra\integrations.d\windows-scheduled-task-info.json file, which contains the Task Scheduler details. The JSON structure looks similar to this:

4. Configure log forwarder by copying the following files to C:\Program Files\New Relic\newrelic-infra\logging.d\ directory
   1. winevt_taskscheduler_logs.yml
5. Log in to your New Relic account.
6. Click Query Your Data and then run the following NRQL query:
   1. FROM Log SELECT StringInserts AS ScheduledTask, Level, Opcode, EventID, Task AS TaskCode, hostname, message WHERE logtype = 'windows_taskscheduler_history'

Visualizing Task Scheduler data in New Relic

Configure custom dashboards

1. Log in to your New Relic account.
2. Navigate to Logs > Lookup tables.
3. Click Add a table and then provide the following details:
   1. Name: windows_event_log_level
   2. Description: Log level for windows event
   3. Drag and drop lookup csv file: windows_event_log_level.csv
   4. Click Add.

1. Click Add a table and then provide the following details:
   1. Name: windows_scheduled_task_result_descriptions
   2. Description: windows scheduled task result descriptions
   3. Drag and drop lookup csv file: windows-task-result-descriptions.csv
   4. Click Add.
   5. This list is populated from https://en.wikipedia.org/wiki/Windows_Task_Scheduler 

5. Click Query Your Data and then run the following NRQL queries to ensure the Log Level and Task descriptions are displayed correctly:
   1. FROM Log JOIN (FROM lookup(windows_event_log_level) SELECT log_code, log_level) ON Level = log_code SELECT StringInserts AS ScheduledTask, log_level, Opcode, EventID, Task AS TaskCode, hostname, message WHERE `logtype` = 'windows_taskscheduler_history'
   2. FROM WindowsScheduledTaskInfo LEFT JOIN (FROM lookup(windows_scheduled_task_result_descriptions) SELECT task_result_code, task_result_description) ON LastTaskResultHex = task_result_code SELECT latest(LastRunTimeInMillis), latest(LastTaskResultHex), latest(task_result_description), latest(NextRunTimeInMillis) FACET TaskFullPathStringLiteral
6. Import Dashboard.
   1. From the integration files, open dashboard_windows_scheduled_task_oveview.json file in a text editor, and replace accountId 9999999 with the accountId, where you are importing this dashboard.
   2. On New Relic UI, Navigate to Dashboards and click Import Dashboard.
   3. Copy the updated JSON content from the above step in the “Paste your json code” text box and then click the Import dashboard button.
   4. Edit the dashboard created and then update the default value for the Scheduled Task variable.

Note: Based on the naming convention of scheduled tasks in Logs, dashboard widgets might require adjustments to the NRQLs

Setting up alerts

To proactively address issues, you can set up alerts based on specific conditions. You may adjust any or all of the attributes as per your requirements.

• Task failures: Trigger alerts when tasks fail to run successfully.
  • Query: FROM WindowsScheduledTaskInfo SELECT percentage(count(*), LastTaskResultHex != '0x0') AS ErrorPercent FACET TaskPath, TaskName
  • Window duration: 5 minutes
  • Streaming method: Event Timer
  • Timer: 1 minute
  • Condition threshold: static
  • Critical condition: above 0 at least once in 5 minutes
• Missed executions: Notify you when tasks are missed or delayed.
  • Query: FROM WindowsScheduledTaskInfo SELECT latest(NumberOfMissedRuns)  - earliest(NumberOfMissedRuns) FACET TaskPath, TaskName
  • Window duration: 6 hours
  • Streaming method: Event Timer
  • Timer: 1 minute
  • Condition threshold: static
  • Critical condition: above 0 at least once in 6 hours

Best practices for Task Scheduler monitoring

• Regularly review and update task definitions: Ensure that tasks are configured correctly and are still relevant.
• Optimize task scripts: Write efficient scripts to minimize performance overhead.
• Fine-tune New Relic configuration: Adjust the polling interval and metric thresholds to balance data granularity and performance.

By following these best practices and leveraging New Relic's capabilities, you can significantly improve the reliability and performance of your Task Scheduler.

Conclusion

By integrating New Relic Flex with your Windows Task Scheduler, you can gain valuable insights into the health and performance of your automated tasks. This empowers you to proactively identify and resolve issues, helping to ensure the smooth operation of your critical processes.