# G-Log in NinjaOne

Three ready-made scripts that run G-Log from NinjaOne on a web server, without a browser, a port or a key. They use
`glog.com`, the command-line companion of `glog.exe` that ships with G-Log 0.7.0 and later. The same approach works
from any RMM, a scheduled task or a runbook.

NinjaOne has no web server log monitoring of its own: its HTTP monitor says from the outside *that* a site is down.
These scripts say *why*, from the logs on the server itself.

| Script | What it does | Exit code |
|---|---|---|
| [`GLog-Alert.ps1`](GLog-Alert.ps1) | reads the logs of the last 15 minutes; when there are findings of the chosen severity, the output is the alert text: requests, error shares, response time, and each finding with what to do | 0 nothing, 1 findings or the logs could not be read |
| [`GLog-Report.ps1`](GLog-Report.ps1) | reads the logs of the last 24 hours and fills custom fields: a summary, requests, server error percentage, p95, the findings, and an HTML report | 0 filled, 1 the logs could not be read |
| [`GLog-Search.ps1`](GLog-Search.ps1) | the log lines of the last hour that match a query, such as every server error on the payment pages; optionally an alert when there are any | 0 done, 1 matches with `-AlertOnMatch` |

None of them changes anything on the server. Exit code 2 always means the same: `glog.com` was not found, or the
input was wrong.

---

## The third way: no script at all

Since 0.23.0 a G-Log **server** can fill the same fields over the NinjaOne API, for every web server it collects, so
nothing runs on those machines. Set it up once, on the server:

```
glog --ninja-setup --ninja-url https://eu.ninjarmm.com --ninja-client-id <id> --ninja-client-secret <secret>
```

In NinjaOne: **Administration - Apps - API** - add an app of type *Machine to Machine*, scopes *monitoring* and
*management*. The client secret is shown once; it goes into `keys.json` on the server, which only SYSTEM and
Administrators can read.

The service then does a round every hour: for each machine it looks up the device with the same name and writes the
numbers of the last 24 hours. `glog --ninja-fields` shows what would be sent, `glog --ninja-now` sends it right
away, and `glog --ninja-off` removes the connection. The fields are the same as below, so the two ways can be mixed
or swapped without touching anything in NinjaOne.

Use the scripts when you want a value at a moment you choose (a check every 15 minutes, a search on demand), and the
API when you want every web server filled from one place.

## 1. Install G-Log on the web servers

The MSI installs silently, so it goes out like any other application in NinjaOne:

```
msiexec /i G-Log-<version>-x64.msi /qn CONTEXTMENU=0
```

`glog.com` then sits in `C:\Program Files\GariaNetTools\G-Log\`, which is where the scripts look. Installed somewhere
else, pass `-GLog "D:\Tools\G-Log\glog.com"`.

## 2. Add a script

Create a new PowerShell script in NinjaOne's automation library, paste the contents of the file, and set it to **run
as System**, so every log folder can be read.

Every setting is a parameter with a sensible default. The default log path is the IIS log folder of the machine,
`C:\inetpub\logs\LogFiles`, with every site in it; pass `-LogPath` for one site, for an ASP.NET Core, Apache or nginx
log, or for a share. Pass settings as preset parameters, for example `-SinceMinutes 30 -FailOn warning`, or define
script variables with the same name (`logPath`, `sinceMinutes`, `failOn`, ...): the scripts read those from the
environment.

Only the lines of the chosen period are read, and files last written before it are skipped, so a folder with months
of logs costs no more than today's file.

## 3. The alert

`GLog-Alert.ps1` reads the last 15 minutes and ends with exit code 0 when there is nothing at or above the chosen
severity (`critical` by default, or `warning`, `info`). Otherwise it ends with exit code 1, and the output is the
alert text:

```
ALERT: findings at or above warning in the last 15 minutes on WEB01.

G-Log 0.7.0 report of C:\inetpub\logs\LogFiles
Period:   2026-09-15 14:05 to 14:19 UTC
Window:   from 2026-09-15 14:04 UTC
Requests: 21630, server errors 4.12%, client errors 2.71%, response time p50 31 ms, p95 1250 ms
Findings: 1 critical, 2 warning, 1 info

CRITICAL  4.12% of requests got a server error
          Start with the URLs in chapter 4 ...
WARNING   /product/{id} gives a server error on 18.00% of requests
          ...
```

Schedule it every 15 minutes and let NinjaOne raise an alert or a ticket when the script fails, so the ticket already
says what is wrong and where. `-HttpErrPath C:\Windows\System32\LogFiles\HTTPERR` adds the HTTP.sys error log (read in
full, not only the last minutes).

## 4. The report: create the custom fields first

`GLog-Report.ps1` writes to device custom fields. Create them before the first run, and allow automations to write to
them:

| Field | Type | Holds |
|---|---|---|
| `glogSummary` | Text | `WEB01: 1706530 requests in the last 24 h, 0.29% server errors, p95 292 ms, 1 critical, 3 warning. Read 2026-09-15 06:00.` |
| `glogRequests` | Integer | `1706530` |
| `glogServerErrorPercent` | Decimal | `0.29` |
| `glogP95Ms` | Integer | `292` |
| `glogFindings` | Text | `CRITICAL: Card numbers in URLs: 3 requests; WARNING: ...` |
| `glogReport` | WYSIWYG | key numbers, the findings with what to do, the slowest pages and the URLs with server errors, as tables |

Other names? Pass `-SummaryField`, `-RequestsField`, `-ServerErrorField`, `-P95Field`, `-FindingsField` and
`-ReportField`. An empty name skips that field.

With the fields in place, NinjaOne conditions can alert on a threshold, such as `glogServerErrorPercent` above 2 or
`glogP95Ms` above 1500.

The script calls NinjaOne's `Ninja-Property-Set-Piped`, or `Ninja-Property-Set` when only that one is there. Without
either - in an ordinary PowerShell window - it prints the values instead, which is the way to try it before it goes
into NinjaOne. Once a day is a sensible schedule; `-SinceHours` sets the period.

## 5. The search

`GLog-Search.ps1 -Query "status:5xx url:/pay/*"` prints the matching lines of the last hour, with file and line
number, in the activity of the device. With `-AlertOnMatch` it ends with exit code 1 when any line matches: an alert
for *any server error on the payment pages*, with the lines themselves in the alert.

Query terms, all of which have to match: `status:5xx` or `status:500,503`; `url:/api/*`; `url:"/my files/*"` for a
value with spaces; `client:10.1.2.3` or `ip:10.1.0.0/16`; `user:`; `method:POST`; `host:`; `ua:curl`; `ref:`;
`query:`; `sub:`; `win32:`; `time>2s`; `time<100ms`; any other word or quoted text anywhere in the line; a `-` in
front excludes a term.

---

## Doing it yourself

The scripts are an example, not a requirement. The core is a few lines:

```powershell
$glog = "$env:ProgramFiles\GariaNetTools\G-Log\glog.com"
[Console]::OutputEncoding = [Text.Encoding]::UTF8
$r = (& $glog --report C:\inetpub\logs\LogFiles --since 1h --format json --with-text --out -) -join "`n" | ConvertFrom-Json
if ($LASTEXITCODE -ne 0) { exit 1 }
'{0} requests, {1} findings: {2}' -f $r.summary.requests, @($r.advice).Count, $r.advice[0].title
```

- **`glog.com`, not `glog.exe`.** `glog.com` starts `glog.exe`, waits and passes the exit code on, and stops it when
  the script is stopped. Scripts that call it keep working when `glog.exe` gets a window of its own.
- **`--out -`** writes to standard output, so nothing lands on disk. `--out NUL` gives only the exit code.
- **`--since 15m`** (or `2h`, `7d`) reads the last stretch of time; `--from` and `--to` take a UTC window such as
  `2026-09-15T07:00`.
- **`--format text`** is the plain-English summary, **`--format csv --table errors.statusCodes`** one table
  (`--tables` lists them), **`--with-text`** adds the English title and what to do to each finding in the JSON.
- **`--fail-on warning`** ends with exit code 3 when there is a finding of that severity or worse.
- **Exit codes:** 0 done, 1 reading or writing failed (the reason is on standard error), 2 wrong arguments, 3 a
  finding at or above `--fail-on`.

## Security

- The scripts only read. G-Log changes no IIS setting and writes nothing unless told to with `--out`.
- **Do not write output as System into a folder ordinary users can write to**: a link planted there could send the
  file elsewhere. The scripts write to standard output only.
- The alert and the report show what the logs contain: URLs with query strings, client addresses, user names, and
  passwords or tokens found in URLs. Install with `MASKSENSITIVE=1` to mask those in every run.

## What was tested, and what was not

Tested on Windows 11 under Windows PowerShell 5.1 - what NinjaOne runs by default - with a stand-in for NinjaOne's
field command (`tools/tests/test-ninjaone.ps1`), against a log generated for the current day with an incident: every
exit code, the fields and their values compared with `glog.com` itself, the alert on both sides of the threshold, a
query with quotes, and a folder with an old log that is skipped.

**Not tested inside NinjaOne itself, and not on a production IIS server.** If a field stays empty, check the field
name, its type, and that automations are allowed to write to it.