Sensor always executed twice

What version of PRTG are you using? Could you paste the code of the script here? What does it say in the sensors log tab?

PRTG version is 14.4.12.3331. The sensor log tab shows both executions of the sensor within the interval of 1 second, this is how I actually know the sensor ran twice.

Code:

param (
	[string]$h = $(throw "-h missing"),
	[string]$user = $(throw "-user missing"),
	[string]$pass = $(throw "-pass missing"),
	[string]$Contains,
	[string]$LogFile = $(throw "-LogFile missing"),
	[string]$Source,
	[int]$SensorID = $(throw "-SensorID missing"),
	[string]$rcpt # recipient(s) for email alerts
)

$StateOK = 0
$StateError = 2
$StateWarning = 1
$ELERROR = 1
$ELWARNING = 2

$RegKey = "HKLM:SOFTWARE\Wow6432Node\Paessler\PRTG Network Monitor\Probe\Sensors\EventLogMsg\" + [string]$SensorID
$LastRecord = 0
if (!(Test-Path $RegKey))
{
	try
	{
		New-Item $RegKey
		New-ItemProperty -Path $RegKey -Name LastRecord -PropertyType DWord
		$LastRecord = 0
	}
	catch
	{
		$e_xml = "<prtg><error>1</error><text>Configuration Error: Could not access registry key: " + $_.Exception.Message + "</text></prtg>"
		Write-Host $e_xml
		Exit
	}
}
else
{
	$LastRecord = (Get-ItemProperty -Path $RegKey).LastRecord
}

try
{
	# create credentials
	$pw = ConvertTo-SecureString $pass -AsPlainText -Force
	$cred = New-Object System.Management.Automation.PSCredential($user, $pw)
}
catch
{
	$e_xml = "<prtg><error>1</error><text>Credential error: " + $_.Exception.Message + "</text></prtg>"
	Write-Host $e_xml
	Exit
}

$State = $StateOK
$Msg = ""
$RCount = 0

# prepare filter string
$Filter = "LogFile='$LogFile' AND RecordNumber > $LastRecord"
if ($Source)
{
	$Filter += " AND SourceName='$Source'"
}
if ($Contains)
{
	$Filter += " AND Message LIKE '%" + $Contains + "%'"
}
# Receive events
try
{
	Get-WmiObject -Class Win32_NTLogEvent -ComputerName $h -Filter $Filter -Credential $cred | ForEach-Object {
		if ($_.EventType -eq $ELERROR)
		{
			# Error
			$State = $StateError
			$Msg += "ERROR: " + $_.Message + "; "
		}
		elseif ($_.EventType -eq $ELWARNING)
		{
			# Warning
			if ($State -ne $StateError)
			{
				$State = $StateWarning
			}
			$Msg += "WARNING: " + $_.Message + "; "
		}
		else
		{
			$Msg += "INFO: " + $_.Message + "; "
		}
		$RCount = $_.RecordNumber
	}
}
catch
{
	$e_xml = "<prtg><error>1</error><text>Error receiving log events: " + $_.Exception.Message + "</text></prtg>"
	Write-Host $e_xml
	Exit
}

# prepare output
$xml = "<?xml version=`"1.0`" encoding=`"UTF-8`" ?>`n<prtg>"
if ($State -eq $StateError)
{
	$xml += "`n`t<error>1</error>"
}
else
{
	$xml += "`n`t<result>`n`t`t<channel>EventLog State</channel>`n`t`t<value>" + $State + "</value>`n`t</result>"
	if ($State -eq $StateWarning)
	{
		$xml += "`n`t<warning>1</warning>"
	}
}
# remember last record number read and set message
if ($RCount -gt $LastRecord)
{
	Set-ItemProperty -Path $RegKey -Name LastRecord -Value $RCount
	$xml += "`n`t<text>" + $Msg.TrimEnd("; ") + "</text>"
}

$xml += "`n</prtg>"
Write-Host $xml
Exit

Sorry, that's way too complex to debug for us. Try simplifying the script (or with a way more simpler script). Also, please update to the latest version available (14.4.13.3721) and see if the problem persists.

I've stripped the script down to the example below, which shows the same behavior: If the result indicates an error state, the sensor is re-executed immediately. Furthermore, I've set the sensor to immediately go into error state on first run instead of going into warning state first. However, the protocol indicates that the sensor still goes into warning state first.

$ErrorActionPreference = "Stop"

$RegKey = "HKLM:SOFTWARE\Wow6432Node\Paessler\PRTG Network Monitor\Probe"

$FlagValue = (Get-ItemProperty -Path $RegKey).Flag
if ($FlagValue -eq $null)
{
	try
	{	
		New-ItemProperty -Path $RegKey -Name Flag -PropertyType DWord
		$FlagValue = 0
	}
	catch
	{
		$retstr = "2:Configuration Error: Could not access registry key: " + $_.Exception.Message
		Write-Host $retstr
		Exit 2
	}
}

if ($FlagValue -eq 0)
{
	Set-ItemProperty -Path $RegKey -Name Flag -Value 1
	Write-Host "4:ERROR"
	Exit 4
}
else
{
	Write-Host "0:OK"
	Exit 0
}

The script checks the value of a registry key and return OK if the value is 1 or returns an error and sets the value to 1 if it is 0. Therefore, on the first run, the state is error. Afterwards, it is OK.

The protocol of the sensor shows this:

15.01.2015 11:40:34	TEST	Ok		0 #
15.01.2015 11:40:34	TEST	Warnung		Inhaltsfehler: ERROR (Code: PE024)

Any idea why this behavior might occur? How can I have the sensor enter the error state immediately and keep this this state until the next scheduled check?

Sorry for the delay. The "warning state first" is normal to avoid false positives. Internally, a rescan is triggered after a few seconds in case the sensor goes into a warning state. If it's still in a errorneous condition, it will go into a down state.

As for the double execution - if the sensor receives a warning state, the sensor will immediately rescan to compensate network fluctuations. Thats why it runs twice. This behavior can't be changed. Hence that, because your sensor is basically self healing in the script upon execution, it can't stay in a warning state. Only if you outsource the

New-ItemProperty -Path $RegKey -Name Flag -PropertyType DWord
$FlagValue = 0

...part into a notification object that runs as soon as the sensor is in a down state.

The "self-healing part" is only a more simple example of what happens in the actual sensor in order to provide a minimum example. What we actually want is a sensor that reads log messages from a file and go into error state whenever an error message is read from said file. Since every message is only read once, there won't be an error state on the next scan. The reception of an error message by the sensor will never be the result of a "network fluctuation", so there is no need for a rescan here, it rather is destructive behavior.

Unfortunately also the suggested solution of putting this part of the sensor logic into a notification object doesn't seem to fix this. We'd want to read all log messages from the file, no matter the severity, but we certainly don't want all of them to spit out a notification. So in case of no notification, the log message "counter" wouldn't be updated an all the messages would be re-read until a notification occurs.

If I'm not mistaken, your sensors such as file content sensor does also handle this type reading before-unread parts. Can you tell me how this is managed?

The sensor works like this:

1. Check last modify time
2. Check size
3. Check last line of the file

If all three differ, the sensor fires :) As for the other problem. You could modify the script to only heal on every second run (write a lock file or something like that) - then you will see the error in PRTG and it will heal itself on the next run.

This seems to make the sensor actually work as expected. Unfortunate requirement though. But thanks for providing a workaround :)