Post your Windows examples here

[oliverm]

Im trying to setup Zabbix to monitor some windows servers and it seems theres a lack of info on how to best to use the Win32 Agent and a lack of examples.

So, i thought I would invite Windows admins to post examples of their triggers here so that....errr....well.....I can learn how to create my own :)

Olly

[hornos]

Hi,

No one is willing to share ?
:(

[RohrbaGe]

I´m monitoring several Windows servers,
but I just use the standard functions that are delivered with zabbix.
That seems to be enought in the most cases, only special thing is monitoring the HP raid system on hardware errors with snmp.


Ro

[peter_field]

I have been annoyed for some time now about not being able to collect information about Windows software RAID status. I found this VB script the other day, works a treat.

' ************************************************** ******************
' ** Check the status of Windows Software RAID **
' ************************************************** ******************
'
' Version 1.02
'
' 11/10/2006 Peter Field
' - Added return code 4: system doesn't have WSH 5.6 installed.
'
' 14/09/2006 Peter Field
' - Updated to report "General error reading configuration" if diskpart
' doesn't return any data (i.e. diskpart doesn't exist on Win2000)
' - Disabled the initial check for "Mirror" or "RAID-5"
' - Changed return value to a number
'
' Based off original script by Oliver Hookins, Anchor Systems
' http://www.shipyard.com.au/articles/sysadmin/windows-software-raid-check.py
'
' Return value (status of all volumes):
' 0 = Healthy
' 1 = Rebuilding
' 2 = Failed
' 3 = Error reading configuration
' 4 = Windows Scripting Host is old (requires 5.6)
'

Option Explicit

Dim WshShell, oExec
Dim Line, RE1, RE2, RE3
Dim Failure

Failure = 0

If Wscript.Version < 5.6 Then
' WSH 5.6 is required for WScript.Shell.Exec
Failure = 4
Wscript.Echo(Failure)
WScript.Quit(Failure)
End If

Set WshShell = CreateObject("WScript.Shell")

' Execute the DISKPART program and grab the output
Set oExec = WshShell.Exec("%comspec% /c echo list volume | diskpart")

' Set up some regular expression objects
'Set RE1 = New RegExp
Set RE2 = New RegExp
Set RE3 = New RegExp
'RE1.Pattern = "Mirror|RAID-5"
RE2.Pattern = "Failed|(At Risk)" ' At Risk indicates errors have been reported for a disk and it may need to be reactivated.
RE3.Pattern = "Rebuild"

If oExec.StdOut.AtEndOfStream Then
Failure = 3
Else
While Not oExec.StdOut.AtEndOfStream
Line = oExec.StdOut.ReadLine

' Tests for Mirrored or RAID-5 volumes
'If RE1.Test(Line) Then

' Tests for Failed RAID volumes
If RE2.Test(Line) Then
If Failure < 2 Then Failure = 2

' Tests for Rebuilding volumes
ElseIf RE3.Test(Line) Then
If Failure = 0 Then Failure = 1

End If
'End If
WEnd
End If

' Print out the appropriate test result
Wscript.Echo(Failure)
WScript.Quit(Failure)
Save it as 'raidchk.vbs' in your Zabbix agent folder, put a line in your agent config:
UserParameter=uRaidChk,cscript.exe /nologo "c:\zabbix\raidchk.vbs"

then setup an item in Zabbix, set the key to 'uRaidChk' and data type numeric. I would set a high update interval as it is a bit slow to run, I have my update interval currently at 86400. Then create a trigger like:
{Windows_t:uRaidChk.last(0)}>0

On Windows 2000, you will need to download the diskpart utility and place it in the system32 directory, 2003 has this out of the box.

You will also require Windows Scripting Host 5.6 or better, the script has been updated to return a value of 4 if it is not installed.

[peter_field]

It is handy to know any Windows services that are set to start automatically that are no longer running. This script will report a list of auto start services not running.

Option Explicit
' -------------------------
' Auto Services Not Running
' -------------------------
'
' Version 1.00
' 11 August 2006, Peter Field
'
' Original script source unknown.
'
' Displays a list of Windows services that are set to start Automatically,
' but are not currently running.
'
Dim strComputer, wbemServices, wbemObjectSet, wbemObject, strMessage
On Error Resume Next
Set wbemServices = GetObject("winmgmts:\\.")
Set wbemObjectSet = wbemServices.InstancesOf("Win32_Service")
strMessage=""
For Each wbemObject In wbemObjectSet
if wbemObject.StartMode = "Auto" Then
if wbemObject.State <> "Running" Then
' Wscript.Echo """" & wbemObject.Name & """,""" & wbemObject.State & """,""" & wbemObject.DisplayName & """"
If strMessage<>"" Then strMessage=strMessage & ", "
strMessage=strMessage & wbemObject.DisplayName
End If
End If
Next
If strMessage="" Then
Wscript.Echo "None"
Else
Wscript.Echo strMessage
End If

Save it as 'Auto-Services-Not-Running.vbs' in your Zabbix agent folder. Put a line in your agent config like:
UserParameter=uServicesNotRunning,cscript.exe /nologo "c:\zabbix\Auto-Services-Not-Running.vbs"

Then create an item in Zabbix:
key: uServicesNotRunning
type: character
update interval: high (mine is 14400 as the script is slow)

Then create a trigger in Zabbix:
Expression: {Windows_t:uServicesNotRunning.str(None)}=0

You might want to change your action to include
Value: {{HOSTNAME}:{TRIGGER.KEY}.last(0)}
in the message so you can see the services not running right in the alert email.

Enjoy.

[dhackd]

Here is a little code I put together to Check Individual Service Status. This could be used for any service running on a machine.


-----------------------------------------------------------------------
Add to: zabbix_agentd.conf
-----------------------------------------------------------------------

UserParameter=svc-MSSQLSERVER,cscript.exe c:\zabbix\CheckServiceStatus.vbs COMPUTERNAME MSSQLSERVER //nologo

-----------------------------------------------------------------------
CheckServiceStatus.vbs
-----------------------------------------------------------------------
set args = WScript.Arguments
num = args.Count

if num = 0 then
WScript.Echo "Usage: [CScript | WScript] CheckServiceStatus.vbs <computername> <servicename>"
WScript.Quit 1
end If

computername = args.Item(0)
servicename = args.Item(1)

wscript.stdout.write GetService(computername, servicename)

Function GetService(strComputer, strSrvce)

On Error Resume Next

Dim objWMIService
Dim colListOfServices
Dim objService

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
("Select DisplayName,State from Win32_Service Where Name = '" & strSrvce & "'")

If Err.Number <> 0 Then
GetService = "Stopped"
Err.Clear
Else
For Each objService in colListOfServices
GetService = "Running"
strState = objService.State
Next
End If

End Function

-----------------------------------------------------------------------
Setup new item in Zabbix
-----------------------------------------------------------------------

Description: svc-MSSQLSERVER
Type: ZABBIX agent (active)
Key: svc-MSSQLSERVER
Type of information: Character
Update interval (in sec): 30
Keep history (in days): 7
Keep trends (in days): 365
Status: Monitored
Show value throw map: As is
Applications: -none-



Let me know if you have any issues.

dhackd

[peter_field]

You can monitor indervidual Windows services using a standard agent item. I only created a script because I wanted to know out of all of the services on the system which are meant to be running, which ones aren't?

However, handy script never-the-less, and thanks for the input. :)

From: http://www.zabbix.com/manual/v1.1/config_items.php

service_state
State of service. Parameter is service name. 0 - running 1 - paused 2 - start pending 3 - pause pending 4 - continue pending 5 - stop pending 6 - stopped 7 - unknown 255 - SCM communication error Parameter must be real service name as it seen in service properties under "Name:", not service display name!

[qix]

Hello,

I have adjusted a script to retrieve values from the Xwall mail filtering application (http://www.dataenter.co.at/products/xwall.htm)

It is based on the MRTG data collection mentioned here (http://www.dataenter.co.at/doc/xwall_mrtg.htm).You will need to slightly modify the Xwall configuration, so please have a look at it.

Values for the output are mentioned in the script, these include queue sizes and virus counts, etc.

' Parameters:

' 0 ?

'

' 1 InboundSMTPQueueCount

' 2 OutboundSMTPQueueCount

'

' 3 InboundSMTPMsgCount

' 4 OutboundSMTPMsgCount

' 5 InboundSMTPByteCount

' 6 OutboundSMTPByteCount

' 7 InboundSMTPConnectionCount

' 8 OutboundSMTPConnectionCount

'

' 9 InboundPOP3MsgCount

' 10 OutboundPOP3MsgCount

' 11 InboundPOP3ByteCount

' 12 OutboundPOP3ByteCount

' 13 InboundPOP3ConnectionCount

' 14 OutboundPOP3ConnectionCount

'

' 15 InboundExchQueueCount

' 16 OutboundExchQueueCount

'

' 17 InboundExchByteCount

' 18 OutboundExchByteCount

' 19 InboundExchMsgCount

' 20 OutboundExchMsgCount

' 21 InboundExchConnectionCount

' 22 OutboundExchConnectionCount

'

' 23 OutboundSMTPRate1

' 24 InboundSMTPRate1

'

' 25 InboundSMTPMsgBlockCount

' 26 InboundSMTPMsgSpamCount

'

' 27 InboundSMTPGreyCount

' 28 NotUsed

'

' 29 InboundVirusCount

' 30 OutboundVirusCount







Option Explicit



Dim oWinsock 'As OSWINSCK.Winsock

Dim sURL 'As String

Dim sPage 'As String

Dim sServer 'As String

Dim nPort 'As Long

Dim sBuffer 'As String

Dim sSource 'As String

Dim bClose 'As Boolean

Dim sLen 'As Long

Dim sArr

Dim sHop

Dim sLeft

Dim xArray

Dim a

Dim Param





'initialize variables

sSource = "": bClose = False: sLen = 0: sHop = 1: a = 0

sPage = "": sServer = "127.0.0.1": nPort = 25: sBuffer = ""

Param = WScript.Arguments(0)





If sServer <> "" Then

Set oWinsock = CreateObject("OSWINSCK.Winsock")

Wscript.ConnectObject oWinsock, "oWinsock_"

oWinsock.Connect CStr(sServer), CLng(nPort)

Else

sSource "Invalid URL"

bClose = True

End If





Sub oWinsock_OnClose()

oWinsock.CloseWinsock

if InStr (1,sBuffer, ",",0) < 0 Then

Wscript.Echo sSource

End If

bClose = True

Set oWinsock = Nothing

End Sub



Sub oWinsock_OnConnect()

oWinsock.SendData "HELO XWall-stat" & vbCrLf

Wscript.Sleep 1

oWinsock.SendData "XBMRTG" & vbCrLf

Wscript.Sleep 1

oWinsock.SendData "quit" & vbCrLf

End Sub



Sub oWinsock_OnDataArrival(ByVal bytesTotal)

oWinsock.GetData sBuffer

if InStr(1,sBuffer, ",",0) > 0 Then

sLen = Len(sBuffer) - 4

sSource = (Right(sBuffer,sLen))

End If

End Sub



Sub oWinsock_OnError(ByVal Number, Description, _

ByVal Scode, ByVal Source, ByVal HelpFile, _

ByVal HelpContext, CancelDisplay)

' Wscript.Echo Number & ": " & Description

oWinsock.CloseWinsock

bClose = True

End Sub



While Not bClose

Wscript.Sleep 1

Wend



if sSource = "" Then

sSource = "0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0"

End if



if Param <> "" Then

xArray = Split(sSource,",")

Wscript.echo xArray(Param)

Else

Wscript.echo 0

End If



The script is depended on the OstroSoft Winsock Component (http://www.ostrosoft.com/oswinsck.asp) because it needs to connect over tcp port 25 to the Xwall service.


I have made the following agent config changes to get it all running:

UserParameter=xwall[InboundSMTPQueueCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 1
UserParameter=xwall[OutboundSMTPQueueCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 2
UserParameter=xwall[InboundSMTPMsgCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 3
UserParameter=xwall[OutboundSMTPMsgCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 4
UserParameter=xwall[InboundSMTPByteCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 5
UserParameter=xwall[OutboundSMTPByteCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 6
UserParameter=xwall[InboundSMTPConnectionCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 7
UserParameter=xwall[OutboundSMTPConnectionCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 8
UserParameter=xwall[InboundExchQueueCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 15
UserParameter=xwall[OutboundExchQueueCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 16
UserParameter=xwall[InboundExchByteCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 17
UserParameter=xwall[OutboundExchByteCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 18
UserParameter=xwall[InboundExchMsgCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 19
UserParameter=xwall[OutboundExchMsgCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 20
UserParameter=xwall[InboundExchConnectionCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 21
UserParameter=xwall[OutboundExchConnectionCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 22
UserParameter=xwall[InboundSMTPRate1],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 23
UserParameter=xwall[OutboundSMTPRate1],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 24
UserParameter=xwall[InboundSMTPMsgBlockCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 25
UserParameter=xwall[InboundSMTPMsgSpamCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 26
UserParameter=xwall[InboundSMTPGreyCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 27
UserParameter=xwall[InboundVirusCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 29
UserParameter=xwall[OutboundVirusCount],cscript /nologo "C:\Program Files\Zabbix Agent\xwallpoller.vbs" 30


I based the script on something i found on the internet a while back (example script), but i can't remember where it's from so credits go to whomever wrote the original. (If someone knows, please let me know so I can edit this post to include the source).

Happy polling!!


This is the source of the original script: http://www.ostrosoft.com/oswinsck/oswinsck_vbscript.asp
I found out the script hang when XWALL was not responding for some reason witch in turn caused the agent to hang as well while it was waiting for response. This hammered away on resources and caused various troubles with our main Xwall server. I have updated the script in this post so that the script will return a value of zero when it doesn't get a response. Not a very glamorous solution, but it works like a charm! ;)

[RobertS]

I use this script to check if a Windows host was not updated since x days. I do this by checking the date of "updspapi.log" in c:\windows or c:\winnt

'================================================= =========================
' uLastWinUpdate.vbs
'
' 2006/11/07
' Robert Stadler
'
' Display days since last windows update, if updspapi.log not found it returns 0
'
'================================================= =========================
Option Explicit
On Error Resume Next

Dim oFSO, latestDate

Set oFSO = CreateObject("scripting.FilesystemObject")

latestDate = Date
If oFSO.FileExists("c:\windows\updspapi.log") Then
latestDate = oFSO.GetFile("c:\windows\updspapi.log").DateLastModified
ElseIf oFSO.FileExists("c:\winnt\updspapi.log") Then
latestDate = oFSO.GetFile("c:\winnt\updspapi.log").DateLastModified
End If

Wscript.Echo DateDiff("d", latestDate, Date)

[ohookins]

Hi,

I'm the original author of the Windows software RAID check script. Has anybody run into problems running this on Windows 2003 x64? It seems that the script can't find diskpart.exe even though it is there and file security doesn't seem to be a problem (which I've confirmed with object access auditing).

Putting diskpart.exe elsewhere (like C:\WINDOWS) allows it to run fine. There seems to be some sort of bizarre security setting or (god forbid) bug in Windows causing this to not work. Any ideas?

By the way, thanks Peter for the improvements to the script, the original version was rather lacking in safety checks.

[qix]

Hi RobertS,

I edited your script because when none of the checked files exist, it displays 0 days which is off course inaccurate.


'================================================= =========================
' uLastWinUpdate.vbs
'
' 2006/11/07
' Robert Stadler
'
' 2008/02/27
' Improved by Raymond Kuiper to report ZBX_NOTSUPPORTED when file not exists.
'
' Display days since last windows update, if updspapi.log not found it returns 0
'
'================================================= =========================
Option Explicit
On Error Resume Next

Dim oFSO, latestDate, msg

Set oFSO = CreateObject("scripting.FilesystemObject")

latestDate = Date
If oFSO.FileExists("c:\windows\updspapi.log") Then
latestDate = oFSO.GetFile("c:\windows\updspapi.log").DateLastModified
msg = DateDiff("d", latestDate, Date)
ElseIf oFSO.FileExists("c:\winnt\updspapi.log") Then
latestDate = oFSO.GetFile("c:\winnt\updspapi.log").DateLastModified
msg = DateDiff("d", latestDate, Date)
Else msg = "ZBX_NOTSUPPORTED"

End If

Wscript.Echo msg

Thanks a lot for the script, it is very handy!

[fast.ryder]

Hello, everyone!

I have been using Zabbix for a short period of time, but with great success regarding monitoring Windows based servers.

For me, almost everything can be monitored from Performance Monitor; all you have to do is start "perfmon.exe" and add counters to the screen. In the properties page of each counter, simply copy the counter's name to Zabbix as a new item, type "zabbix agent" and let Zabbix server do the rest of the work.

Now, of course not everything and every type of information can be obtained from Performance Monitor, and in that case the scripts provided here by the rest of all of you can really help a lot. Software-raid is exactly one of those cases.

You can try, p.ex., to monitor a SQL Server instance from Perfmon, since Microsoft has (incredibly...) been nice enough to provide free performance counters even for the free versions like MSDE or SQL Express.

Cheers,

Ivo Pereira
IT Consultant
Portugal

[alex400]

monitor Windows NIC

http://www.zabbix.com/forum/showthread.php?t=8806

[jojo]

check whether an application is running:

Save this file as somethingmeaningful.vbs:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = 'Database.exe'")

If colProcesses.Count = 0 Then
Wscript.echo "0"
Else
Wscript.echo "1"
End If


service state and proc_cnt do not allow you to check if an application with no services attached to it is running.

Create a new item in zabbix, type should be set to numeric integer, throw map should be set to service state and voila.

[feighong]

Hi Guys,
Need a big hand hand I guess and I would appreciate if someone does. Looks like this is easy for you. I just started to setup zabbix v1.4.5.

I was asked by my manager to install zabbix in one of our server but the account name/user is not 'zabbix' it's a different one. Do i need to do additional config? Incase, what module in PHP or which conf file do i need to change and what changes should be made?

I'm also having a hard time configuring the server. I have no idea what are the UNIX commands are so i'm completely blind about this staff.

I have already installed php, apache, MySQL, C complier, net-snmp, GNU make, and libcurl.


I have configured php and apache to meet the requirements. Database, tables and all default values in the tables are already there. But i'm having diffuculty understanding which path do i need to load zabbix_server.conf. Did run the zabbix_agentd.conf by using the zabbixwin32 but I'm receiving errors when using command zabbix_agentd.exe --config c:\zabbix_agentd.conf install. I already forgot the error message but was able to unstall the service.

I really need assistance. Thanks a lot in advance! c'',)

BTW, the server has windows on it and I'm using wampserver 2.0 to manage php, apache, mysql services.

[Hotzenwalder]

Does anyone have detailed info on the settings for the item to use the uLastWinUpdate.vbs script? I keep getting a ZBX_NOTSUPPORTED. :confused:

Thanks in advance!

[Raph]

i'm having an issue, i really hope someone can help.

I have been running the uraidchk script to monitor software raid status on multiple windows servers, with no issue. Recently we have added 2 new servers to our topology that have 2 software raids (2 partitions, being mirrored to the mirror drive), i mention this because all the other servers have 1 partition, being mirrored.

If i run in command cscript.exe /nologo "c:\raidchk.vbs", it returns the correct value of 0 indicating raid is healthy. However, through zabbix it always returns 3, which means "Error reading configuration".

i can't figure out why this is happening , any help would be greatly appreciated.

Technical info:
Running server 1.4.5 on Centos, agent is also 1.4.5 running on windows server 2003

uraidchk.vbs (as previously posted in this thread):

' ************************************************** ******************
' ** Check the status of Windows Software RAID **
' ************************************************** ******************
'
' Version 1.01
'
' 14/09/2006 Peter Field
' - Updated to report if diskpart doesn't return any data (i.e. diskpart doesn't exist on Win2000)
' - Disabled the initial check for "Mirror" or "RAID-5"
' - Changed return value to a number for easier handling in Zabbix
'
' Based off original script by Oliver Hookins, Anchor Systems
' http://www.shipyard.com.au/articles/sysadmin/windows-software-raid-check.py
'
' Return value (status of all volumes):
' 0 = Healthy
' 1 = Rebuilding
' 2 = Failed
' 3 = Error reading configuration
'

Option Explicit

Dim WshShell, oExec
Dim Line, RE1, RE2, RE3
Dim Failure

Failure = 0

Set WshShell = CreateObject("WScript.Shell")

' Execute the DISKPART program and grab the output
Set oExec = WshShell.Exec("%comspec% /c echo list volume | diskpart")

' Set up some regular expression objects
'Set RE1 = New RegExp
Set RE2 = New RegExp
Set RE3 = New RegExp
'RE1.Pattern = "Mirror|RAID-5"
RE2.Pattern = "Failed|(At Risk)" ' At Risk indicates errors have been reported for a disk and it may need to be reactivated.
RE3.Pattern = "Rebuild"

If oExec.StdOut.AtEndOfStream Then
Failure = 3
Else
While Not oExec.StdOut.AtEndOfStream
Line = oExec.StdOut.ReadLine

' Tests for Mirrored or RAID-5 volumes
'If RE1.Test(Line) Then

' Tests for Failed RAID volumes
If RE2.Test(Line) Then
If Failure < 2 Then Failure = 2

' Tests for Rebuilding volumes
ElseIf RE3.Test(Line) Then
If Failure = 0 Then Failure = 1

End If
'End If
WEnd
End If

' Print out the appropriate test result
Wscript.Echo(Failure)

WScript.Quit(Failure)

zabbix_agentd.conf:

Server=******
ServerPort=****
Hostname=********
ListenPort=****
DebugLevel=3
LogFile=c:\zabbix_agentd.log
Timeout=3
UserParameter=uRaidChk,cscript.exe /nologo "c:\raidchk.vbs"

[elvar]

It is handy to know any Windows services that are set to start automatically that are no longer running. This script will report a list of auto start services not running.

Option Explicit
' -------------------------
' Auto Services Not Running
' -------------------------
'
' Version 1.00
' 11 August 2006, Peter Field
'
' Original script source unknown.
'
' Displays a list of Windows services that are set to start Automatically,
' but are not currently running.
'
Dim strComputer, wbemServices, wbemObjectSet, wbemObject, strMessage
On Error Resume Next
Set wbemServices = GetObject("winmgmts:\\.")
Set wbemObjectSet = wbemServices.InstancesOf("Win32_Service")
strMessage=""
For Each wbemObject In wbemObjectSet
if wbemObject.StartMode = "Auto" Then
if wbemObject.State <> "Running" Then
' Wscript.Echo """" & wbemObject.Name & """,""" & wbemObject.State & """,""" & wbemObject.DisplayName & """"
If strMessage<>"" Then strMessage=strMessage & ", "
strMessage=strMessage & wbemObject.DisplayName
End If
End If
Next
If strMessage="" Then
Wscript.Echo "None"
Else
Wscript.Echo strMessage
End If

Save it as 'Auto-Services-Not-Running.vbs' in your Zabbix agent folder. Put a line in your agent config like:
UserParameter=uServicesNotRunning,cscript.exe /nologo "c:\zabbix\Auto-Services-Not-Running.vbs"

Then create an item in Zabbix:
key: uServicesNotRunning
type: character
update interval: high (mine is 14400 as the script is slow)

Then create a trigger in Zabbix:
Expression: {Windows_t:uServicesNotRunning.str(None)}=0

You might want to change your action to include
Value: {{HOSTNAME}:{TRIGGER.KEY}.last(0)}
in the message so you can see the services not running right in the alert email.

Enjoy.


Is there a way to put exclusions into this? For example, the Performance Logs & Alert service is always set to automatic but only runs when needed. Being able to exclude certain services would be excellent.

Thanks for this contribution!

Kind regards,
Elvar

[peter_field]

Is there a way to put exclusions into this? For example, the Performance Logs & Alert service is always set to automatic but only runs when needed. Being able to exclude certain services would be excellent.

Thanks for this contribution!

Kind regards,
Elvar

This took me back to the dim dark ages of VBscript, used to PowerShell now, but here goes:

Option Explicit
' -------------------------
' Auto Services Not Running
' -------------------------
'
' Version 1.10
' 11 August 2006, Peter Field
'
' 1.10 27/04/2009 - Added ability to exclude specific services.
' 1.00 11/08/2006 - Original script source unknown.
'
' Displays a list of Windows services that are set to start Automatically, ' but are not currently running.
'
Dim strComputer, wbemServices, wbemObjectSet, wbemObject, strMessage, excludedServices
On Error Resume Next
Set excludedServices=CreateObject("Scripting.Dictionary")
excludedServices.Add "Performance Logs and Alerts", "Excluded because its almost never running"

Set wbemServices = GetObject("winmgmts:\\.")
Set wbemObjectSet = wbemServices.InstancesOf("Win32_Service")
strMessage=""
For Each wbemObject In wbemObjectSet
If wbemObject.StartMode = "Auto" Then
If wbemObject.State <> "Running" Then
If Not excludedServices.Exists(wbemObject.DisplayName) Then
'Wscript.Echo """" & wbemObject.Name & """,""" & wbemObject.State & """,""" & wbemObject.DisplayName & """"
If strMessage <> "" Then strMessage = strMessage & ", "
strMessage = strMessage & wbemObject.DisplayName
End If
End If
End If
Next
If strMessage="" Then
Wscript.Echo "None"
Else
Wscript.Echo strMessage
End If

[elvar]

This took me back to the dim dark ages of VBscript, used to PowerShell now, but here goes:

Option Explicit
' -------------------------
' Auto Services Not Running
' -------------------------
'
' Version 1.10
' 11 August 2006, Peter Field
'
' 1.10 27/04/2009 - Added ability to exclude specific services.
' 1.00 11/08/2006 - Original script source unknown.
'
' Displays a list of Windows services that are set to start Automatically, ' but are not currently running.
'
Dim strComputer, wbemServices, wbemObjectSet, wbemObject, strMessage, excludedServices
On Error Resume Next
Set excludedServices=CreateObject("Scripting.Dictionary")
excludedServices.Add "Performance Logs and Alerts", "Excluded because its almost never running"

Set wbemServices = GetObject("winmgmts:\\.")
Set wbemObjectSet = wbemServices.InstancesOf("Win32_Service")
strMessage=""
For Each wbemObject In wbemObjectSet
If wbemObject.StartMode = "Auto" Then
If wbemObject.State <> "Running" Then
If Not excludedServices.Exists(wbemObject.DisplayName) Then
'Wscript.Echo """" & wbemObject.Name & """,""" & wbemObject.State & """,""" & wbemObject.DisplayName & """"
If strMessage <> "" Then strMessage = strMessage & ", "
strMessage = strMessage & wbemObject.DisplayName
End If
End If
End If
Next
If strMessage="" Then
Wscript.Echo "None"
Else
Wscript.Echo strMessage
End If



Wow, thanks for the quick reply! I will try this out asap. Just out of curiosity, why do you have the update interval set to something so high? Maybe I'm not understanding correctly, but when I manually run the script it completes in under 10 seconds. Wouldn't 30 seconds or 60 seconds for the update interval be sufficient?


Thanks,
Elvar

[elvar]

This took me back to the dim dark ages of VBscript, used to PowerShell now, but here goes:

Option Explicit
' -------------------------
' Auto Services Not Running
' -------------------------
'
' Version 1.10
' 11 August 2006, Peter Field
'
' 1.10 27/04/2009 - Added ability to exclude specific services.
' 1.00 11/08/2006 - Original script source unknown.
'
' Displays a list of Windows services that are set to start Automatically, ' but are not currently running.
'
Dim strComputer, wbemServices, wbemObjectSet, wbemObject, strMessage, excludedServices
On Error Resume Next
Set excludedServices=CreateObject("Scripting.Dictionary")
excludedServices.Add "Performance Logs and Alerts", "Excluded because its almost never running"

Set wbemServices = GetObject("winmgmts:\\.")
Set wbemObjectSet = wbemServices.InstancesOf("Win32_Service")
strMessage=""
For Each wbemObject In wbemObjectSet
If wbemObject.StartMode = "Auto" Then
If wbemObject.State <> "Running" Then
If Not excludedServices.Exists(wbemObject.DisplayName) Then
'Wscript.Echo """" & wbemObject.Name & """,""" & wbemObject.State & """,""" & wbemObject.DisplayName & """"
If strMessage <> "" Then strMessage = strMessage & ", "
strMessage = strMessage & wbemObject.DisplayName
End If
End If
End If
Next
If strMessage="" Then
Wscript.Echo "None"
Else
Wscript.Echo strMessage
End If



This is working perfect so far as I can tell. Thank you very much!


Kind regards,
Elvar

[gospodin.horoshiy]

Anyone want to see my solution for tracking Win Software being installed/removed? Its kinda strange, but works well in my enviroment.

[gospodin.horoshiy]

Ok, few guys PMed me so here it is:

1. To get full list of software:
1.1 Create script in C:\Program Files\Zabbix Agent\
called uAllPrograms.vbs:
with
WScript.Echo strConvert(InstalledApplications("."),"Windows-1251","cp866")

Function InstalledApplications(node)
Const HKLM = &H80000002 'HKEY_LOCAL_MACHINE
Set oRegistry = GetObject("winmgmts://" _
& node & "/root/default:StdRegProv")
sBaseKey = _
"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal l\"
iRC = oRegistry.EnumKey(HKLM, sBaseKey, arSubKeys)

For Each sKey In arSubKeys

iRC = oRegistry.GetStringValue( _
HKLM, sBaseKey & sKey, "DisplayName", sValue)
If iRC <> 0 Then
oRegistry.GetStringValue _
HKLM, sBaseKey & sKey, "QuietDisplayName", sValue
End If
If sValue <> "" and instr(sValue, "KB")=0 and instr(InstalledApplications, sValue&vbCrLf)=0 Then
InstalledApplications = _
InstalledApplications & sValue & vbCrLf
End If
Next
End Function

'================================================= ============================
Function StrConvert(strText, strSourceCharset, strDestCharset)
Const adTypeText = 2
Const adModeReadWrite = 3

Dim objStream

Set objStream = WScript.CreateObject("ADODB.Stream")

With objStream
.Type = adTypeText
.Mode = adModeReadWrite

.Open
.Charset = strSourceCharset
.WriteText strText
.Position = 0
.Charset = strDestCharset
strConvert = .ReadText
End With

Set objStream = Nothing
End Function
'================================================= ============================

1.2Create user parameter in your zabbix_agentd.conf
UserParameter=uAllPrograms, cscript.exe /nologo "C:\Program Files\Zabbix Agent\uAllPrograms.vbs"

1.3 Create item in Zabbix called uAllPrograms and type of Text

2. To get only new software/uninstalled software since last check:
2.1
Create script in C:\Program Files\Zabbix Agent\
called uDiffPrograms.vbs:
with
'KNOWN BUG: If Application name conatins '-' symbol then e-mail alert containing software list will be sent all on one line instead of each packet on a single line
variable=InstalledApplications(".")
'WScript.Echo strConvert(variable,"Windows-1251","cp866")

'Whats this
Const ForReading = 1
Set objFSO = CreateObject("Scripting.FileSystemObject")
'Create old file if does not exist
If objFSO.FileExists("C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt")=0 Then
Set objFile4 = objFSO.CreateTextFile("C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt")
objFile4.WriteLine variable
objFile4.Close
'Wscript.Echo "No C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt file"
Wscript.Echo "0x0"
WScript.Quit
End if
'Create 'new' file
Set objFile3 = objFSO.CreateTextFile("C:\Program Files\Zabbix Agent\uDiffPrograms_new.txt")
objFile3.WriteLine variable
objFile3.Close


'Compare old and new files
Set objArgs = Wscript.Arguments
Set objFile5= objFSO.GetFile("C:\Program Files\Zabbix Agent\uDiffPrograms_new.txt")
Set objFile6 = objFSO.GetFile("C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt")

If objFile5.Size <> objFile6.Size Then
' Wscript.Echo "The file is different."
Else
'Wscript.Echo "They are the same."

objFSO.DeleteFile "C:\Program Files\Zabbix Agent\uDiffPrograms_new.txt"
Wscript.Echo "0x0"
WScript.Quit

End If
'Search for removed applications
Set objFile2 = objFSO.OpenTextFile("C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt", ForReading)

Do Until objFile2.AtEndOfStream
strAddress2 = objFile2.ReadLine
If InStr(variable, strAddress2&vbCrLf) = 0 Then
strNotCurrent2 = strNotCurrent2 & strAddress2 & vbCrLf
End If
Loop
objFile2.Close



'Search for installed applications
Set objFile1 = objFSO.OpenTextFile("C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt", ForReading)

oldvar = objFile1.ReadAll

objFile1.Close
objFSO.DeleteFile "C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt"
Set objFile2 = objFSO.OpenTextFile("C:\Program Files\Zabbix Agent\uDiffPrograms_new.txt", ForReading)

Do Until objFile2.AtEndOfStream
strAddress = objFile2.ReadLine
If InStr(oldvar, strAddress&vbCrLf) = 0 Then
strNotCurrent = strNotCurrent & strAddress & vbCrLf
End If
Loop
objFile2.Close
'Rename C:\Program Files\Zabbix Agent\uDiffPrograms_new.txt to C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt
objFSO.MoveFile "C:\Program Files\Zabbix Agent\uDiffPrograms_new.txt" , "C:\Program Files\Zabbix Agent\uDiffPrograms_old.txt"
'Output
if strNotCurrent <> "" and strNotCurrent2 <> "" then
WScript.Echo strConvert("New software installed:" & vbCrLf & strNotCurrent & vbCrLf & "Software uninstalled:" & vbCrLf & strNotCurrent2,"Windows-1251","cp866")
'WScript.Echo strConvert("Новые программы были установлены:" & vbCrLf & strNotCurrent & vbCrLf & "Следующие программы были удалены:" & vbCrLf & strNotCurrent2,"Windows-1251","cp866")
Wscript.Quit
End if
if strNotCurrent <> "" then
WScript.Echo strConvert("New software installed:" & vbCrLf & strNotCurrent,"Windows-1251","cp866")
'WScript.Echo strConvert("Новые программы были установлены:" & vbCrLf & strNotCurrent,"Windows-1251","cp866")
End if
if strNotCurrent2 <> "" then
WScript.Echo strConvert("Software uninstalled:" & vbCrLf & strNotCurrent2,"Windows-1251","cp866")
'WScript.Echo strConvert("Следующие программы были удалены:" & vbCrLf & strNotCurrent2,"Windows-1251","cp866")
End If

Function InstalledApplications(node)
Const HKLM = &H80000002 'HKEY_LOCAL_MACHINE
Set oRegistry = GetObject("winmgmts://" _
& node & "/root/default:StdRegProv")
sBaseKey = _
"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal l\"
iRC = oRegistry.EnumKey(HKLM, sBaseKey, arSubKeys)

For Each sKey In arSubKeys

iRC = oRegistry.GetStringValue( _
HKLM, sBaseKey & sKey, "DisplayName", sValue)
If iRC <> 0 Then
oRegistry.GetStringValue _
HKLM, sBaseKey & sKey, "QuietDisplayName", sValue
End If

If sValue <> "" and instr(sValue, "KB")=0 and instr(InstalledApplications, sValue&vbCrLf)=0 Then
'and instr(InstalledApplications, sValue&vbCrLf)=0 - to exlude possible dublicates
'instr(sValue, "KB")=0 - to exlude KB-indexed Microsoft Patches
InstalledApplications = _
InstalledApplications & sValue & vbCrLf
End If
Next
End Function

'================================================= ============================
Function StrConvert(strText, strSourceCharset, strDestCharset)
Const adTypeText = 2
Const adModeReadWrite = 3

Dim objStream

Set objStream = WScript.CreateObject("ADODB.Stream")

With objStream
.Type = adTypeText
.Mode = adModeReadWrite

.Open
.Charset = strSourceCharset
.WriteText strText
.Position = 0
.Charset = strDestCharset
strConvert = .ReadText
End With

Set objStream = Nothing
End Function
'================================================= ============================
2.2 Create userparameter:
UserParameter=uDiffPrograms, cscript.exe /nologo "C:\Program Files\Zabbix Agent\uDiffPrograms.vbs"

2.3 Create item uDiffPrograms and Text as type
2.4 Create trigger: like this one:
{Template_Windows_Active:uDiffPrograms.str(0x0)}=0

As final I get email alert like this


Time:20:06:36
Date:2009.10.13
Host: trkbook.trk

Набор программ на данном компьютере был изменен.

New software installed:
1С:Предприятие 7.7 (сетевая версия)


That's all

And also, scripts are cyrilic adapted (cp1251), so there could be extra functions and stuff you might not need.


Added: Hm, both scripts in post got extra space in " sBaseKey = _
"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal l\"
iRC = oRegistry.EnumKey(HKLM, sBaseKey, arSubKeys)"

, so I better just attach scripts instead.