The Foscam control script for ZoneMinder which I found on the ZoneMinder wiki was a good starting point, but seemed to have left and right wired backwards, and didn’t support the presets. So I’ve updated it to fix those issues, the script is below.

To install: find where the control scripts are installed on your distro. In mine I found the files in:

/usr/lib/perl5/site_perl/5.8.8/ZoneMinder/Control/

If you’re not sure where to look, run the command:

locate PanasonicIP.pm

This will return the location of one of the existing control scripts.

Once you’ve found them, create a new file called FoscamFI8918W.pm and paste the code below into it. As with the original script this assumes there is an admin user with no password on your camera. This will have to do until I can work out how to pass through a proper username and password from the ZoneMinder frontend.Update 27/02/2011: the username and password are now passed via the Control Device field. See below.

You’ll need to add the control script to the ZoneMinder interface and attach it to your camera. First make sure that ZoneMinder is configured to support controllable cameras. Open Options from the main console and click OPT_CONTROL in the System tab.

Then open the source options for the camera you want to control. Select the Control tab, and click Edit next to Control Type. Click the Add New Control button, then enter the following settings (Update 27/02/2011, see bottom of post for updated settings for IR control and username/password.):

Now save and close that window, and refresh the one for your camera. You should now see the Foscam FI8918W script in the list. Select it, and enter the IP address of the camera in the Control Address box. Make sure Controllable is ticked, then click Save.

Now if you view the camera you’ll have a Control option near the top. Click it to reveal the Pan/Tilt controls, along with the presets:

That’s it. Enjoy your controllable cameras!Â

Download the FoscamFI8918W.pm script. Rename to .pm.

I’ll update this post when I work out the password passthrough and how to turn the IR LED on and off via ZoneMinder. Update 27/02/2011: the script now uses Sleep and Wake to turn the IR off and on and passes the username and password via the Control Device parameter. You’ll need to enable those options on the Main tab of the Control like so:

And put your username and password query string in the Control Device field:

# ==========================================================================
#
# ZoneMinder Foscam FI8918W IP Control Protocol Module, $Date: 2009-11-25 09:20:00 +0000 (Wed, 04 Nov 2009) $, $Revision: 0001 $
# Copyright (C) 2001-2008 Philip Coombes
# Modified for use with Foscam FI8918W IP Camera by Dave Harris
# Modified Feb 2011 by Howard Durdle (http://durdl.es/x) to:
#      fix horizontal panning, add presets and IR on/off
#      use Control Device field to pass username and password
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
#
# ==========================================================================
#
# This module contains the implementation of the Foscam FI8918W IP camera control
# protocol
#
package ZoneMinder::Control::FoscamFI8918W;
 
use 5.006;
use strict;
use warnings;
 
require ZoneMinder::Base;
require ZoneMinder::Control;
 
our @ISA = qw(ZoneMinder::Control);
 
our $VERSION = $ZoneMinder::Base::VERSION;
 
# ==========================================================================
#
# Foscam FI8918W IP Control Protocol
#
# ==========================================================================
 
use ZoneMinder::Debug qw(:all);
use ZoneMinder::Config qw(:all);
 
 use Time::HiRes qw( usleep );
 
sub new
{
	my $class = shift;
	my $id = shift;
	my $self = ZoneMinder::Control->new( $id );
	my $logindetails = "";
	bless( $self, $class );
	srand( time() );
	return $self;
}
 
our $AUTOLOAD;
 
sub AUTOLOAD
{
	my $self = shift;
	my $class = ref($self) || croak( "$self not object" );
	my $name = $AUTOLOAD;
	$name =~ s/.*://;
	if ( exists($self->{$name}) )
	{
		return( $self->{$name} );
	}
	Fatal( "Can't access $name member of object of class $class" );
}
our $stop_command;
 
sub open
{
	my $self = shift;
 
	$self->loadMonitor();
 
	use LWP::UserAgent;
	$self->{ua} = LWP::UserAgent->new;
	$self->{ua}->agent( "ZoneMinder Control Agent/".ZM_VERSION );
 
	$self->{state} = 'open';
}
 
sub close
{
	my $self = shift;
	$self->{state} = 'closed';
}
 
sub printMsg
{
	my $self = shift;
	my $msg = shift;
	my $msg_len = length($msg);
 
	Debug( $msg."[".$msg_len."]" );
}
 
sub sendCmd
{
	my $self = shift;
	my $cmd = shift;
	my $result = undef;
	printMsg( $cmd, "Tx" );
 
	my $req = HTTP::Request->new( GET=>"http://".$self->{Monitor}->{ControlAddress}."/$cmd".$self->{Monitor}->{ControlDevice} );
	my $res = $self->{ua}->request($req);
 
	if ( $res->is_success )
	{
		$result = !undef;
	}
	else
	{
		Error( "Error check failed:'".$res->status_line()."'" );
	}
 
	return( $result );
}
 
sub reset
{
	my $self = shift;
	Debug( "Camera Reset" );
	my $cmd = "reboot.cgi?";
	$self->sendCmd( $cmd );
}
 
#Up Arrow
sub moveConUp
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Up" );
	my $cmd = "decoder_control.cgi?command=0&";
	$self->sendCmd( $cmd );
}
 
#Down Arrow
sub moveConDown
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Down" );
	my $cmd = "decoder_control.cgi?command=2&";
	$self->sendCmd( $cmd );
}
 
#Left Arrow
sub moveConLeft
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Left" );
	my $cmd = "decoder_control.cgi?command=6&";
	$self->sendCmd( $cmd );
}
 
#Right Arrow
sub moveConRight
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Right" );
	my $cmd = "decoder_control.cgi?command=4&";
	$self->sendCmd( $cmd );
}
 
#Diagonally Up Right Arrow
sub moveConUpRight
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Diagonally Up Right" );
	my $cmd = "decoder_control.cgi?command=90&";
	$self->sendCmd( $cmd );
}
 
#Diagonally Down Right Arrow
sub moveConDownRight
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Diagonally Down Right" );
	my $cmd = "decoder_control.cgi?command=92&";
	$self->sendCmd( $cmd );
}
 
#Diagonally Up Left Arrow
sub moveConUpLeft
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Diagonally Up Left" );
	my $cmd = "decoder_control.cgi?command=91&";
	$self->sendCmd( $cmd );
}
 
#Diagonally Down Left Arrow
sub moveConDownLeft
{
	my $self = shift;
	$stop_command = "1";
	Debug( "Move Diagonally Down Left" );
	my $cmd = "decoder_control.cgi?command=93&";
	$self->sendCmd( $cmd );
}
 
#Stop
sub moveStop
{
	my $self = shift;
	Debug( "Move Stop" );
	my $cmd = "decoder_control.cgi?command=1&";
	$self->sendCmd( $cmd );
}
 
#Move Camera to Home Position
sub presetHome
{
	my $self = shift;
	Debug( "Home Preset" );
	my $cmd = "decoder_control.cgi?command=25&";
	$self->sendCmd( $cmd );
}
 
#Set preset
sub presetSet
{
    my $self = shift;
    my $params = shift;
    my $preset = $self->getParam( $params, 'preset' );
	my $presetCmd = 30 + ($preset*2);
    Debug( "Set Preset $preset with cmd $presetCmd" );
    my $cmd = "decoder_control.cgi?command=$presetCmd&";
    $self->sendCmd( $cmd );
}
 
#Goto preset
sub presetGoto
{
    my $self = shift;
    my $params = shift;
    $stop_command = "1";
    my $preset = $self->getParam( $params, 'preset' );
    my $presetCmd = 31 + ($preset*2);
    Debug( "Goto Preset $preset with cmd $presetCmd" );
    my $cmd = "decoder_control.cgi?command=$presetCmd&";
    $self->sendCmd( $cmd );
}
 
#Turn IR on
sub wake
{
	my $self = shift;
	Debug( "Wake - IR on" );
	my $cmd = "decoder_control.cgi?command=95&";
	$self->sendCmd( $cmd );
}
 
#Turn IR off
sub sleep
{
	my $self = shift;
	Debug( "Sleep - IR off" );
	my $cmd = "decoder_control.cgi?command=94&";
	$self->sendCmd( $cmd );
}
 
1;

The TransportAgentFactory type "RegExCatchAll.CatchAllFactory" doesn't exist.
The TransportAgentFactory type must be the Microsoft .NET class type of the transport agent factory.
Parameter name: TransportAgentFactory
    + CategoryInfo          : InvalidArgument: (:) [Install-TransportAgent], ArgumentException
    + FullyQualifiedErrorId : 6F5E297B,Microsoft.Exchange.Management.AgentTasks.InstallTransportAgent

This error occurs because when you install the assembly Exchange Server checks for the Types associated with the Transport Agent Assembly. This means it looks for the versions of Microsoft.Exchange.Data.Common.dll and Microsoft.Exchange.Data.Transport.dll it was compiled with. Since they were pre SP1 DLLs it won’t find them on the SP1 system. This is also true if (as in my case) you had already successfully installed the Transport Agent on a non SP1 system and subsequently upgraded Exchange to SP1. Once Exchange starts as SP1 for the first time, your Transport Agent will fail to start and crash the Exchange Transport Service.

The fix, for now, is to recompile the Transport Agent using the SP1 copies of the two DLLs which you’ll find on the Exchange Server in:

C:\Program Files\Microsoft\Exchange Server\V14\Public

Once you have a fixed DLL, you’ll need to replace the running copy on your Exchange Server. This took me several attempts – and for about 20 minutes I thought there was an error with my code as I continued to get the error message above. It turned out that because I had tried to install the broken DLL once in my Powershell session, and hadn’t exited and restarted Powershell, it was in some sense “caching” the failure. In the end I issued an IISRESET from within Powershell, then tried to install the DLL again.

This time it worked perfectly and now my Transport Agent is running happily under Exchange Server 2010 SP1.

In this case I’m loading SQL scripts from an AES encrypted zip and running them against a database. The name of the resource (bundle) and the script (scriptname) I want to run have been passed in as strings. passwordForZip is a string containing the password for the zip file.

// get the assembly and resource stream for our bundle
Assembly _assembly;
_assembly = Assembly.GetExecutingAssembly();
 
Stream _zipFileStream;
_zipFileStream = _assembly.GetManifestResourceStream(bundle);
 
// use Ionic.Zip to open the zip file
using (ZipFile zipFile = ZipFile.Read(_zipFileStream))
{
	// continue if the file exists in the zip
	if (zipFile.EntryFileNames.Contains(scriptname))
	{
		// memoryStream and streamReader to load and parse the file
		MemoryStream memoryStream = new MemoryStream();
		StreamReader streamReader = new StreamReader(memoryStream);
 
		// load the script
		ZipEntry zipEntry = zipFile[scriptname];
 
		// extract using the password, piping output to the memorystream
		zipEntry.ExtractWithPassword(memoryStream, passwordForZip);
 
		// seek to the beginning of the file,
                // then read entire contents into string
		memoryStream.Seek(0, SeekOrigin.Begin);
		scriptText = streamReader.ReadToEnd();
 
		// try and execute it, return false if failure, tidy up afterwards
		try
		{
			this.ServerConnection.ExecuteNonQuery(scriptText);
		}
		catch (SqlException exception)
		{
			LogMessageToFile(exception.Message);
			return false;
		}
		finally
		{
			streamReader.Close();
		}
	}
}

Note the security section which disables some paranoid protection IIS has switched on by default. If your server doesn’t allow double escaping of request strings, the YOURLS links with a + in them don’t work. This breaks the admin interface and the stats reporting pages.

The rest of the web.config is standard stuff to fix a non-canonical hostname, and make sure the IDs are rewritten to the right pages:

<system.webServer>
	<security>
		<requestFiltering allowDoubleEscaping="true" />
	</security>
	<rewrite>
	<rules>
		<rule name="Canonical Host Name" stopProcessing="true">
			<match url="(.*)" />
			<conditions>
				<add input="{HTTP_HOST}" negate="true" pattern="^domain\.com$" />
			</conditions>
			<action type="Redirect" url="http://domain.com/{R:1}" redirectType="Permanent" />
		</rule>
		<rule name="YOURLS 1" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)/?$" ignoreCase="false" />
			<conditions logicalGrouping="MatchAll">
				<add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
				<add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
			</conditions>
			<action type="Rewrite" url="/yourls-go.php?id={R:1}" appendQueryString="false" />
		</rule>
		<rule name="YOURLS 2" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)\+/?$" ignoreCase="false" />
			<action type="Rewrite" url="/yourls-infos.php?id={R:1}" appendQueryString="false" />
		</rule>
		<rule name="YOURLS 3" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)\+all/?$" ignoreCase="false" />
			<action type="Rewrite" url="/yourls-infos.php?id={R:1}&amp;all=1" appendQueryString="false" />
		</rule>
	</rules>
	</rewrite>
</system.webServer>

1) I run my own Exchange Server.  It provides ActiveSync, Outlook Web Access, and Outlook Anywhere for my company’s email domains and my personal durdle.com domain.

2) I provide email addresses at durdle.com for family members (and a few people who just happen to share the family name).

Historically all those family emails have been maintained by Gradwell without going near my Exchange Server.  The durdle.com MX records in DNS pointed to Gradwell’s servers for mail delivery and I had a forwarder at Gradwell that would redirect my – and only my – messages to the Exchange Server.  For a number of reasons I needed to change this so that all email is delivered via my Exchange Server.  I made this change yesterday, discovering one problem in the process.

Email Suffixes

Gradwell’s mail server supports email suffix matching.  If you have a GMail account you may be familiar with the approach.  Say you have an email john@gmail.com.  Gmail will actually deliver mail to john+anything@gmail.com; you can add any suffix you like after the + and GMail will still deliver it to your inbox.  Gradwell support this by allowing you to place a period after the local part so you can use john.anything@example.com.  You don’t have to create these email addresses anywhere – you can just start using it and the mail server will make sure it gets to you.

This is fantastically useful because it means that when a website asks for your email address you can give out a custom throwaway email just for that site.  So when you sign up at DodgyCo.com, you give them the email john.dodgyco@example.com.  If you ever receive spam because DodgyCo sold your email address you’ll know a) who sold you out, and b) which email address to add to your spam filter.

Exchange Server

Enter Microsoft Exchange Server.  I’m currently running the 2010 edition, but the problem I’m about to describe (and solve!) exists in every recent version.  Exchange Server doesn’t support email suffixes.  Every recipient has to have an alias created on the server.  If you want to deliver to john.suffix@example.com you’d better remember to create an alias for that user, otherwise the Exchange Recipient Filter will reject the message since – as far as it is concerned – the user does not exist on the server.

Worse, Exchange doesn’t even implement any generic CatchAll functionality.  CatchAll would allow the server to redirect messages for non-existing recipients to a specific address. Smart people have created solutions to the CatchAll problem but all that does is allow you to define one mailbox for ALL non-deliverable messages to be delivered to.  Since I need to provide suffix matching to multiple users this doesn’t work for me.

Time to extend Exchange’s functionality!

Transport Agents

Transport Agents were introduced in Exchange 2007 to replace Exchange 2003’s SMTP Event Sinks and have been retained largely unchanged in Exchange 2010.  Broadly speaking when a message arrives at an Exchange Server it is moved through the transport pipeline as each SMTP event occurs.  Each SMTP event (Connect, MAIL FROM, RCPT TO, etc) can trigger an interested Transport Agent to perform some actions on the message.
The complete list of SMTP events and their sequence is described on this Exchange Server TechCenter page.

Transport Agents are simply DLLs written in managed code that fire on SMTP events.  Back when I contracted for the MOD I wrote a Transport Agent for Exchange 2007 which demonstrated that Exchange was capable of performing Dominance Checking on outgoing emails so I knew that it wouldn’t take to long to write a Transport Agent to filter incoming messages.  I was able to reuse some of that code and also made use of some of Wilbert De Graaf’s CatchAll Agent code which made the handling of a configuration file very quick to implement.  Thank you Wilbert!

Requirements

I had a couple of requirements for my Transport Agent:

1) It should allow redirection of multiple suffixes to different recipients.

2) It should allow me to ban delivery to any previously used suffixes and ensure that the sender receives a non-deliverable report.

I ended up meeting these requirements by using C# to write a Transport Agent that accepts its configuration from an XML file.  The config.xml defines multiple regular expressions to match against along with associated redirect addresses.  It also lists banned email addresses which the Transport Agent should reject.

To mimic the Gradwell behaviour which we were already making use of I needed to match firstname then a dot and then any word before the domain.  This is a fairly simple regular expression in C#, and looks like this:

^firstname+\.[a-z]+@example.com$

The config.xml takes the form:

<config>
    <redirect pattern="^john+\.[a-z]+@domain.com$" address="john@domain.com" />
    <redirect pattern="^jane+\.[a-z]+@domain.com$" address="jane.doe@gmail.com" />
    <banned address="john.spam@domain.com" />
    <banned address="jane.newsletter@domain.com" />
</config>

Here we define two patterns for redirect, one to an internal recipient and one redirect to an external SMTP address.  We also ban two known “bad” recipient addresses.

You’ll need to provide at least one redirect entry, but you’re not required to ban any addresses if you don’t want to.  Also, while redirects specifiy regular expressions to match, banned addresses are just strings which are simply compared. I leave it as an exercise for the reader to add regular expressions to the banned list!

The Code

Whenever the config.xml file is changed, the agent reloads it and parses the XML.  It puts the banned emails into a List and the regular expression patterns and redirect addresses into a Dictionary.  If any of the emails in the config appear invalid the new configuration is rejected and the agent continues to use the running config.

The agent defines a RCPT TO: handler.  This event is fired as soon as the sending MTA starts to transmit the recipient addresses. rcptArgs contains the argument we need: RecipientAddress, which we store as a lowercase string for comparison. Although the spec (RFC2821) actually requires email addresses to be case sensitive, I’ve never met an MTA that adheres to that part of the spec. So for our purposes email addresses are case insensitive and we can do all comparisons in lowercase.

public void RcptToHandler(ReceiveCommandEventSource source, RcptCommandEventArgs rcptArgs)
{
// Get the recipient address as a lowercase string.
string strRecipientAddress = rcptArgs.RecipientAddress.ToString().ToLower();

It performs two checks. First – is the recipient address in the ban list?

// Search the banned email List for the recipient.
bool exists = catchAllConfig.Banned.Exists(element => element == strRecipientAddress);
if (exists)
{
	// If found respond to the sending MTA with the reject response.
	source.RejectCommand(CatchAllAgent.rejectResponse);
 
	// No further processing.
	return;
}

And second, does the recipient address match any of the regular expressions?

// For each pair of regexps to email addresses
foreach (var pair in catchAllConfig.AddressMap)
{
	// Create the regular expression and the routing address from the dictionary.
	Regex emailPattern = new Regex(pair.Key);
	RoutingAddress emailAddress = pair.Value;
 
	// If the recipient address matches the regular expression.
	if (emailPattern.IsMatch(strRecipientAddress))
	{
		// And if the recipient is NOT in the address book.
		if ((this.addressBook != null) &&
			(this.addressBook.Find(rcptArgs.RecipientAddress) == null))
		{
			// Redirect the recipient to the other address.
			rcptArgs.RecipientAddress = emailAddress;
 
			// No further processing.
			return;
		}
	}
}

Note that in both cases as soon as we’ve got a positive result we stop further processing. If an address is in the ban list we immediately reject it, and if we find a matching regular expression we use its paired address to redirect the message and stop looking for further matches.

I’ve given enough information here that a C# developer with some spare time could create this Transport Agent themselves. However I know that it is really useful to have a package you can just download and install without having to worry about compiling it yourself. So I’ve packaged the DLL together with installation scripts and the install and configuration guide.

Please visit the product page for more information and to purchase the Transport Agent. Payment is via PayPal, you will receive the download link within minutes of payment.

First, list the orphan users to make sure this is the problem:

EXEC sp_change_users_login 'Report'

Usually I already have the login and password set up on the server, this being the case you can fix the orphan by doing:

EXEC sp_change_users_login 'Auto_Fix', 'user'

If not, and you want/need to create the login and password, you’ll need to do this instead:

EXEC sp_change_users_login 'Auto_Fix', 'user', 'login', 'password'

For example, I want a canonical host name (so visitors always see workavoidance.net with no www prefix in the address bar) and to ensure that the WordPress permalinks work properly. While I was at it I took the opportunity to disable hot-linking of our images, since for some reason a Russian website had taken a shine to some of our Armory graphics.

Below is the web.config I created. It redirects users to the canonical host name, enables WordPress permalinks and disables hot-linking of our images. The redirect proved something of a problem to begin with. Our iPhone App “Monkey Shaker” has an online high score system. Scores are submitted from the app via an encrypted HTTP POST to a PHP page which decrypts the information and updates the database. I discovered that when you issue a server side redirect most clients won’t re-POST their data to the new page – they will issue a GET for the new page and the original POST data is lost. This meant that highscore submissions were failing.

(NB: this isn’t as big a disaster as it sounds since we built a very robust mechanism to retry score submission into the app.)

So, you’ll note an extra entry in the web.config to exclude that page from a redirect:

<add input="{URL}" negate="true" pattern="scoresubmit\.php$" />

“Why not just change the URL in the app to be canonical?!” You may well ask. Yes, we probably will, but that relies on issuing an update and getting over a quarter of a million users to download it. This way we don’t have to rely on that.

Still to come – how I implemented caching in WordPress and in our high score system to improve performance.

Here’s the rewrite rules section of the completed web.config:

<rule name="Canonical Host Name" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTP_HOST}" negate="true" pattern="^workavoidance\.net$" />
<add input="{URL}" negate="true" pattern="scoresubmit\.php$" />
</conditions>
<action type="Redirect" url="http://workavoidance.net/{R:1}" redirectType="Permanent" />
</rule>
 
<rule name="Prevent image hotlinking">
<match url=".*\.(gif|jpg|png)$"/>
<conditions>
<add input="{HTTP_REFERER}" pattern="^$" negate="true" />
<add input="{HTTP_REFERER}" pattern="^http://workavoidance\.net/.*$" negate="true" />
</conditions>
<action type="Rewrite" url="/no.png" />
</rule>
 
<rule name="wordpress" patternSyntax="Wildcard">
<match url="*" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
</conditions>
<action type="Rewrite" url="index.php" />
</rule>

If you install Java 6 Update 13 and then try and log into Cisco SDM 2.5 it will fail. The SDM console will not load.

I found I had to go back to Java 6 Update 6 (available at the Java archive page, or direct download.).

With that the Cisco SDM started working again. I’ve not found anything about this on the Cisco site.

bindSid = "LDAP://<sid =" & SID & ">"
set oVal = GetObject(bindSid)
Result = oVal.Get("cn")
set oVal = Nothing

So if you have a list of SIDs and want to translate them into meaningful account names, this will do it without relying on using WMI – which on a lot of secure networks is locked down (or at least should be!).

Why do I need this? It’s a part of a larger script I’m writing that will archive specific Group Policy Objects from the \SYSVOL\<domainname>\Policies\ folder of a PDCe. One of the files in a GPO is the GptTmpl.inf file which gives a list of the User Rights Assignments (SeBackupPrivilege, SeShutdownPrivileg etc) along with the SIDs of the accounts that have been given those privileges (e.g. S-1-5-19). I wrote a script that reads the SIDs and queries the DC for the account names. This code fragment works more reliably (and I think faster) than the WMI calls I was previously using.

He used a custom compiled “rcon” binary to talk directly to the game server’s Remote Console port. This is the port that allows an administrator to configure the game, kick players, change maps and generally do all the useful stuff that a game admin needs to do. It’s the protocol used by the hlstats live stats page to determine what is happening right now on the game server. Unfortunately, as far as my Googling shows, such a binary doesn’t exist for win32. There is a perl module (kkrcon.pm) which does the work inside hlstats, but the command line wrapper for kkrcon.pm – kkrcon.pl – doesn’t seem to have been updated since 2001 and so doesn’t work for Source titles.

A little Perl hacking later and I’ve created a version of the kkrcon.pl wrapper that is capable of using the Source rcon protocol. You can download both the module and the wrapper here: source server rcon perl script. This was tested on Windows Server 2003 running ActiveState Perl.

With that done, we can use MRTG to run another Perl script which will run the new kkrcon.pl with the right parameters, request some data from the game server and then parse it into a format that MRTG can understand. The two scripts I used are much the same as I found on the Zokahn site, but tweaked to use my new kkrcon.pl instead of the binary and to pass the parameters in a slightly different way. You can grab the scripts here: MRTG Counter-Strike: Source perl data source scripts.

The last step is the MRTG config file itself, here’s what the CSS Users part of mine looks like:

Target[server.CS-Users]:`.\m_cs-s_users.pl <server_ip> <port> <rcon_password>`
Title[server.CS-Users]: Active Counter-Strike:Source users
PageTop[server.CS-Users]: <H1>Counter-Strike:Source Users</H1>
MaxBytes[server.CS-Users]: 16
ShortLegend[server.CS-Users]: #
YLegend[server.CS-Users]: Active Users
Legend1[server.CS-Users]: Current active CS:Source users
LegendI[server.CS-Users]: Users
LegendO[server.CS-Users]:
Options[server.CS-Users]: growright,nopercent,gauge,integer
Unscaled[server.CS-Users]: ymwd

It’s very important to note that those are back ticks (`) on the first line – NOT apostrophes (‘). This caught me out and stopped MRTG generating data until I’d fixed it.

You can see my graphs here, although there isn’t a lot of data yet – just waiting for the clan to wake up and start playing!