Monitoring available Windows updates

[eger]

The original request was here: http://www.zabbix.com/forum/showthread.php?p=49493. Someone was looking for a way to monitor available Windows updates. I put together a crude script based on the one here: http://www.microsoft.com/technet/scr....mspx?mfr=true

The script below, coupled with a scheduled task, will allow you to make triggers based on the count of available Windows updates on a Windows 2000, 2003, XP, Vista, and maybe Windows 7 machine.

The WSH script. Save this to a file (such as winupdate.wsh):

serverName = "zabbix.mydoamin.com"
hostName = "web_server.mydomain.com"
zbxSender = "C:\Program Files\Zabbix Agent\zabbix_sender.exe"

updatesHigh = 0
updatesOptional = 0

Set objSearcher = CreateObject("Microsoft.Update.Searcher")
Set objSysInfo = CreateObject("Microsoft.Update.SystemInfo")
Set objResults = objSearcher.Search("IsInstalled=0")
Set colUpdates = objResults.Updates
Set WSHShell = CreateObject("WScript.Shell")

For i = 0 to colUpdates.Count - 1

	If (colUpdates.Item(i).IsInstalled = False AND colUpdates.Item(i).AutoSelectOnWebSites = False) Then
		updatesOptional = updatesOptional + 1
	ElseIf (colUpdates.Item(i).IsInstalled = False AND colUpdates.Item(i).AutoSelectOnWebSites = True) Then
		updatesHigh = updatesHigh + 1
	End IF
    
Next

updatesTotal = (updatesHigh + updatesOptional)

WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[total] -o " & updatesTotal
WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[high] -o " & updatesHigh
WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[optional] -o " & updatesOptional
WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[reboot] -o " & objSysInfo.RebootRequired

WScript.Quit 0

You will need to change variables serverName, hostName, and zbxSender. They are the Zabbix Server, Agent Hostname, and location of the zabbix_sender binary.

You will need to add a scheduled task to run this script as often as you want to get Windows Update data (I run it every 6 hours since I only really care about Windows Update data daily).

1. Click to 'Add Scheduled Task' in the Scheduled Tasks window.
2. For program to run, click the Browse button and locate the check_updates.vbs file and select it.
3. Check to perform this task Daily or on a time schedule you want (customizable).
4. For user to run as, enter in without the quotes, "NT AUTHORITY\SYSTEM", it doesn't need a password (or an administrator use if you wish).
5. Right click on the schedule and clock 'Run' to have it send data to the Zabbix Server

Then create some new items for your Template or Host to use it. Create an item for each of these 3 keys:

• win_updates[total]
• win_updates[high]
• win_updates[optional]
• win_updates[reboot]

Settings for win_updates[total], win_updates[high], and win_updates[optional]:

• Type: Zabbix trapper
• Type of information: Numeric (unsigned)
• Keep history: 7

Settings for win_updates[reboot]:

• Type: Zabbix trapper
• Type of information: Character
• Keep history: 7

Example triggers for high priority updates and reboot required:

High priority updates:

{Your_Template:win_updates[high].last(0)}>0

Reboot required:

({Your_Template:win_updates[high].last(0)}=0)&({Your_Template:win_updates[reboot].str(True)}=1)

You may also wish to trigger in case no data has been received from the script after a set time (which could indicate a problem with the script running):

{Your_Template:win_updates[total].nodata(86400)}=1

This would trigger when no data has been received for 86400 seconds (24 hours).

Hope someone finds this helpful!

[skygge]

Hi!
Thanks for the great HOWTO, but I have one little problem:

When I run the script by hand, it works,
but Zabbix Server is logging errors like this:

win.updates[total]] error: Get value from agent failed: ZBX_TCP_READ() failed [Interrupted system call]
20847:20090805:171614 Parameter [win.updates[total]] will be checked after 300 seconds on host [hostname]

I have over 40 windows servers and this script works well on 2 of them only.
I don't know what is wrong... please help!

[eger]

It actually only worked well on a couple of my servers also. I have re-worked the script to use zabbix_sender.exe with scheduled tasks instead to send the data which seems more reliable. I will update the post with the new instructions soon and you can try it out for me

So far, my new way with zabbix_sender is reporting correctly on about 16 machines.

[eger]

Updated main post for the way I am using zabbix sender and trapper now. Try it out and let me know if still issues I can try and resolve

[skygge]

Hi!
I have done little workaround, also with sheduled tasks today (sorry, yesterday) and it works good. The problem was in the vbs script i think, or rather with long execution time (about 15-20 seconds waiting for result).

I made sheduled task with your script which saves the result to a file (winupdate.vbs > result.txt), and Zabbix Agent just reads stored value from this file using "type" command. Reading value from the saved file is a lot faster and now everything is OK, available updates are reporting to Zabbix Server from every 40 servers .

Thanks once again!
Skygge

[eger]

That will work also. The Zabbix Sender / Trapper way won't timeout also since the script is run outside the agent. Also, using the sender allows the script just to be called once to send all 3 variables to the sender, which cuts down on time. Glad it is working for you!

[eger]

Added item and updated script for reboot required. I realized that after updates are installed and reboot is required that the updates available will be satisfied. But if the machine isn't rebooted then it isn't fully updated. You can now trigger on both.

[IT_Architect]

You can now trigger on both.

WOW! This is a cool script. I wonder if there is any way to subtract hidden updatesHigh?

[eger]

Are there such thing as hidden high priority updates and high priority updates? Based on the Microsoft provided object docs it looked like there were just optional updates and high priority updates.

[tiggs]

Hello,

I've followed the instructions above and everything seems to be working (in regards to communication anyway), but the items won't update in my database for some reason. I have the vb script running as a scheduled task and it's getting the correct number of missing updates, then sending them to my zabbix server. For some reason, they're either never making it into the database or something is preventing them from displaying in my data or trigger view. I've attached a snippet from my zappix_server.log below..

                        "key":"win_updates[total]",
                        "value":"4"}]}] len 110
 27818:20100724:235832.647 In process_new_values()
 27818:20100724:235832.647 In process_mass_data()
 27818:20100724:235832.647 In DCinit_nextchecks()
 27818:20100724:235832.647 In DCflush_nextchecks()
 27818:20100724:235832.647 End process_mass_data()
 27826:20100724:235832.661 Trapper got [{
        "request":"sender data",
        "data":[
                {
--
                        "key":"win_updates[optional]",
                        "value":"4"}]}] len 113
 27826:20100724:235832.661 In process_new_values()
 27826:20100724:235832.661 In process_mass_data()
 27826:20100724:235832.661 In DCinit_nextchecks()
 27826:20100724:235832.661 In DCflush_nextchecks()
 27826:20100724:235832.661 End process_mass_data()
 27824:20100724:235832.707 Trapper got [{
        "request":"sender data",
        "data":[
                {
--
                        "key":"win_updates[reboot]",
                        "value":"False"}]}] len 115
 27824:20100724:235832.707 In process_new_values()
 27824:20100724:235832.707 In process_mass_data()
 27824:20100724:235832.707 In DCinit_nextchecks()
 27824:20100724:235832.707 In DCflush_nextchecks()
 27824:20100724:235832.707 End process_mass_data()
 27820:20100724:235832.716 Trapper got [{
        "request":"sender data",
        "data":[
                {
--
                        "key":"win_updates[high]",
                        "value":"0"}]}] len 109
 27820:20100724:235832.716 In process_new_values()
 27820:20100724:235832.716 In process_mass_data()
 27820:20100724:235832.716 In DCinit_nextchecks()
 27820:20100724:235832.716 In DCflush_nextchecks()
 27820:20100724:235832.716 End process_mass_data()

That looks like it should be working, in my opinion. I've also attached a screenshot of one the items I've setup. A misconfigured item is the only reason I think this may not be working. Thanks in advance for your help

[eger]

The only thing I can think of is that maybe the host name of the agent machine in the WSH script and on the Zabbix Server don't match. Have you verified that the hostName in the output of the script matches the hostname set in Zabbix?

[tiggs]

Thanks for the speedy reply. I've double checked the host name in the server and script and they're exactly the same (case sensitive and everything). This is really stumping me I've attached my script, so hopefully we'll find something in here.

serverName = "184.73.xxx.xxx"
hostName = "jim-pc"
zbxSender = "C:\Program Files\Zabbix Agent\zabbix_sender.exe"

updatesHigh = 0
updatesOptional = 0

Set objSearcher = CreateObject("Microsoft.Update.Searcher")
Set objSysInfo = CreateObject("Microsoft.Update.SystemInfo")
Set objResults = objSearcher.Search("IsInstalled=0")
Set colUpdates = objResults.Updates
Set WSHShell = CreateObject("WScript.Shell")

For i = 0 to colUpdates.Count - 1

	If (colUpdates.Item(i).IsInstalled = False AND colUpdates.Item(i).AutoSelectOnWebSites = False) Then
		updatesOptional = updatesOptional + 1
	ElseIf (colUpdates.Item(i).IsInstalled = False AND colUpdates.Item(i).AutoSelectOnWebSites = True) Then
		updatesHigh = updatesHigh + 1
	End IF
    
Next

updatesTotal = (updatesHigh + updatesOptional)

WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[total] -o " & updatesTotal
WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[high] -o " & updatesHigh
WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[optional] -o " & updatesOptional
WSHShell.Exec zbxSender & " -z " & serverName & " -s " & hostName & " -k win_updates[reboot] -o " & objSysInfo.RebootRequired

WScript.Quit 0

[eger]

Try doing some debugging with the "C:\Program Files\Zabbix Agent\zabbix_sender.exe" binary. You can check the PDF manual or just run it to find the syntax. Try creating an arbitrary Zabbix trapper item and then send some data for it and see if it shows up. This would at least eliminate any scripting/scheduling issue.

This sounds like it is a problem with zabbix trapper/zabbix rather than my script though. I actually don't have a working Zabbix environment at the moment so I can't do any testing (no longer work for the company I deployed Zabbix for) :\

[tiggs]

Ok, so I ran the trapper commands manually and input some test data and it's definitely making it to the Zabbix server without issue, so your script isn't the problem. It's just not updating on the web interface. See below.

[tiggs]

I also did some poking around in the database. The item is there, but no data is writing to it for some reason.