Hi geeks,

I have a hairy windows problem, I'm hoping someone more experienced than myself can help. We're using a nagios plugin to monitor pending Window Updates across our servers.

The plugin works by examining c:\windows\\SoftwareDistribution\ReportingEvents.log, and looking for the last line which matches "successfully detected x updates". It uses the number of detected updates to report all-good or updates-due.

We have several Win2008r2 servers in SBS-controlled AD domains, and the contents of the file is typically like this:

---
....AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 4 updates.
....AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 4 updates.
....Success Software Synchronization Windows Update Client successfully detected 0 updates.
....AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 4 updates.
....AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 4 updates.
....Success Software Synchronization Windows Update Client successfully detected 0 updates.
---

This host has 3 optional updates (not sure why it keeps detecting 4). But anyway, because of the last line, the plugin CORRECTLY ignores optional updates, but does actually alarm when there are legitimate updates.

Now, a host which is on a NON-SBS AD domain, the contents of the file look like this:

---
....AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 6 updates.
....AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 6 updates.
....AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 6 updates.
---

But this host has 5 optional updates. However, my plugin is alarming on 6 updates.

We've compared the group policy settings, the windows update settings on the two hosts, and they're the same. Neither site is using WSUS.

When there is a legit update (like IE10 last night), both hosts will record this in the file, and it's counted against one of the detected updates. But still, the SBS-managed host seems to later split the detected updates into optional and non-optional, whereas the standard AD-managed host does not.

Any clever ideas?

Thanks,
D