1

I am currently trying to setup monitoring of windows scheduled tasks in Zabbix. It seemed easy enough to just monitor the Microsoft-Windows-TaskScheduler/Operational event log filtered by 201 events and regexing on the return code, but when I started simulating errors to test the monitoring, nothing happened.

It turns out that all our windows 2012 servers always log "return code 0" in the event log, even though it actually, sort of, displays it correctly in the Task Scheduler list view. When I say "sort of", it's because the "Last Run Result" actually displays 0x80070001 if the exit code of the program run by the scheduled task is 1.

I have spend a lot of time tweaking the settings, like user account, Run only when user is logged on, Run whether user is logged on or not, setting path on the action, Run with highest privileges, Configure for Vista/7/2012, etc. Nothing helped.

Finally I did some testing on my local machine, Windows 7, and a 2008R2 server, both of which just worked as expected.

The specific task I was testing ran a PowerShell script, using -Command so that it properly propagates the exit, but to rule out any PS issues I also tested with a batch file containing "exit 1" and finally with a small C# console program, that just returns whatever you supply on the command line. PS, batch and console program all work fine on 7 and 2008, but they all fail in the same manner on 2012.

I've google this to death, but keep coming up short. Apparently 0x80070005 and other similar error codes are have some meaning, but that's not what happens in my case. In my case it seems that my exit code is bitwise or'ed with 0x80070000.

I should note that in all the cases, even 2012, the program started by the task, actually executes and run to the end, it's just the exit code which is handled weirdly.

Following is the output from the test runs:

From Powershell (my shell writes :( if $LASTEXITCODE > 0 ):

54 :( .\ExitCodeTest.exe 1
55 :( $LASTEXITCODE
1

56 :) .\ExitCodeTest.exe 10
57 :( $LASTEXITCODE
10

Windows Server 2008 R2 Standard:

Last Run Result (from list view): 0xA
Event 201 from event log Microsoft-Windows-TaskScheduler/Operational:
Task Scheduler successfully completed task "\ErrorTest" , 
instance "{b67a26cf-7fd8-461a-93d9-a5e48e72e558}" , 
action "D:\Tasks\ExitCodeTest.exe" with return code 10.

Windows Server 2012 Datacenter (notice that the return code in the event log is 0):

Last Run Result (from list view): 0x8007000A
Event 201 from event log Microsoft-Windows-TaskScheduler/Operational:
Task Scheduler successfully completed task "\error test" , 
instance "{2bde46b8-2858-4772-a7ec-d66b29d893a6}" , 
action "D:\Tasks\ExitCodeTest.exe" with return code 0.

Source for ExitCodeTest.exe:

static void Main( string[] args )
{
    int exitCode = 0;
    if ( args.Length > 0 )
    {
        exitCode = Convert.ToInt32( args[0] );
    }
    Environment.Exit( exitCode );
}

Please help, I am at my wits end.

Thanks, John

4
  • Sounds like you've already researched heavily, but shouldn't you use the exit command from PowerShell script to send out exit code? e.g. .\ExitCodeTest.exe 10; exit $LASTEXITCODE
    – andyb
    Commented Mar 3, 2014 at 22:08
  • I compiled ExitCodeTest and used the following single line PS script & .\ExitCodeTest.exe 10; exit $LASTEXITCODE. Then, from CMD, ran a two liner 1:powershell -file test.ps1 2:echo %ERRORLEVEL% and this returned 10.
    – andyb
    Commented Mar 3, 2014 at 22:19
  • Tried another CMD using '-command' instead of external PS script; 1:powershell -command "& .\ExitCodeTest.exe 10; exit $LASTEXITCODE" 2:echo %ERRORLEVEL% and this also returned 10.
    – andyb
    Commented Mar 3, 2014 at 22:23
  • I'm not running ExitCodeTest.exe from a powershell script. In the test the scheduled task action is set to call ExitCodeTest.exe directly with the desired return code as an argument. The powershell command line output was just to demonstrate that the ExitCodeTest program Works.
    – JJJ
    Commented Mar 4, 2014 at 16:22

3 Answers 3

2

(this is NOT an answer, but StackOverflow is refusing to let me add comments - when I click 'add comment', browser scrolls to top of page :-/)

You may be misinterpreting the Last Run Result column. According to Wikipedia (http://en.wikipedia.org/wiki/Windows_Task_Scheduler), LRR values of 0, 1 and 10 are common. Ignore the 0x8007 prefix - this just indicates a WIN32 error code transformed into an HRESULT (http://msdn.microsoft.com/en-us/library/gg567305.aspx).

Try running the test and forcing an exit code of something other than 1 or 10 to see if this influences LRR.

This does not explain of course why action return code is 0 in 2012. Error code 10 is defined as 'environment is incorrect'. Could it be that 2012 server does not want to run 32bit executable?

One other suggestion (and I'm a little out of my depth); according to (http://msdn.microsoft.com/en-us/library/system.environment.exit(v=vs.110).aspx): "Exit requires the caller to have permission to call unmanaged code. The return statement does not.". Might be worth re-compiling ExitCodeTest as follows:

static int Main(string[] args)
    {    
        int exitCode = 0;
        if ( args.Length > 0 )
        {
            exitCode = Convert.ToInt32( args[0] );
        }
        return exitCode;
    }
5
  • Hi andy. You're trying hard here, I really appreciate that. I have tested with many other exit codes, if I return 255 LRR becomes 0x800700FF,so it's definitely my exit code that is being used. Also, again, this happens with a bat file, a PS script and ExitCodeTest.exe, so it's not related to Environment.Exit. It's interesting that 0x8007 means WIN32 error converted to HRESULT, I'll look a bit more into that.
    – JJJ
    Commented Mar 5, 2014 at 10:11
  • 1
    Take heart, you are not alone...stackoverflow.com/questions/19505759/…
    – andyb
    Commented Mar 5, 2014 at 12:53
  • Hmm, seems like a bug then. I'll just go with an alternative solution. I've marked you answers as correct, for your efforts :) Cheers
    – JJJ
    Commented Mar 5, 2014 at 14:35
  • 1
    I took advantage of the Azure free trial and spun up a 2012 R2 Datacenter server. I set up two tasks, one CMD and one PS. Verified that both return non-zero exit codes and results were different from yours. In all cases, the Last Run Result displayed the exact exit code I was giving (47). The Action Result Codes where shown as decimalised WIN32 facility HRESULTS. Specifically 2147942447. Convert to hex = 0x8007002F and 0x2F = 47. I tried running under different accounts and fiddling with task settings, but the results were always the same. Not sure if this helps, but there it is.
    – andyb
    Commented Mar 6, 2014 at 13:20
  • Thanks for the info. I couldn't spend any more time on this, so my scheduled tasks are now monitored with a custom PS script. Less elegant, but it works :)
    – JJJ
    Commented Mar 7, 2014 at 14:31
0

I'm seeing a similar issue on Server 2012 with a batch file that looks like it succeeds, shows a return value of 0 in event log, but a Last Run Result of 0x80070001.

I see MSFT has a hotfix available for Server 2012 which might address this issue:

http://support.microsoft.com/kb/3003689

0

I had this problem and fixed it this way. Instead of calling a batch file move the commands into the actions section of the scheduled task. I realize this may not work for you as some batch files are long.

I suspect it has to do with circumventing security on a scheduled task -- if you can change the batch file then you could get a scheduled task to run as the identity without windows being the wiser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.