Pendrive detection monitor for windows

[lopexxx]

Well here I will expose how to monitor whether someone used a flash drive on any pc with Windows.
If for some security reason anyone needs to know when someone uses a flash drive, well here it is.
This monitor is designed for PCs with:

• Windows XP
• Windows Vista
• Windows 7

not yet for Windows 2000/NT (I had to modify the script)

First of all is the script that detects when someone plugs a flash drive:

@echo off
for /f "tokens=1" %%x in ('wmic logicaldisk get caption^, description ^| find /i "extra"') do (GOTO ENCONTRADO)
GOTO EXIT
:ENCONTRADO
ECHO 1
EXIT
:EXIT
ECHO 0
EXIT

Then the user parameter for the windows agent:

UserParameter=pendrive.detection,c:\scripts\pendri ve.bat

Monitor for Zabbix Frontend:


Trigger:

(change FSA_Windows for your template)

Action:


I made it thinking in someone new for zabbix or as they always say " for dummies", just like me .

I hope you find usefull this check.

Best Regards and happy 2011!
Lopexxx

PD: god bless google translator, my native language is spanish. So apologies for errors.

[scoutregis]

Good

Hello Lopexxx, great ideia.

But...I did not understand the first part. Where i should put the script?

[lopexxx]

Hi scoutregis!

This is a batch script and you can put it anywhere you want. For example, I put it in a test directory called:
C:\scripts

and the file name containing the script in:
C:\scripts\pendrive.bat

So you call the script in your agent configuration file:
UserParameters=pendrive.detection,c:\scripts\pendr ive.bat

Maybe this is the answer you were looking for:
The complication of this method is that the script goes into each pc to monitor.
I used a deployment tool to do this job.

You can also test the script directly for your own in the command console.
Greetings!

[scoutregis]

Thanks

Hi Lopexxx, thanks for the reply.

Now i see! So the next step is to create a item inside the windows template as i saw in the pictures that you posted, right ?

[lopexxx]

That´s right scoutregis!
Good luck!

[scoutregis]

Problem

Hi Loppexxx .

I tried here but with no sucesss.

I created the script and sotred in a folder then inserted the details on zabbix agent.conf then i created the item, trigger and the action but it did not show on the panel and also did not sent any alert.

Any ideia ?

[lopexxx]

I found a syntaxis error:

UserParameters=pendrive.detection,c:\scripts\pendr ive.bat

Change for:
UserParameter=pendrive.detection,c:\scripts\pendr ive.bat

I put an extra "s" in UserParameter"s", my bad
Try again please

PS: I also saw user parameters in this way:
UserParameter=pendrive.detection,"c:\scripts\pendr ive.bat"

[scoutregis]

no

Hi loppexxx,

It is not working i correct but nothing happened again.

[lopexxx]

Hi scoutregis
Have you seen if the monitor show any errors in the frontend? Like not supported.
Try to manually activate it.

Do you restart agent?

We will make it work in one way or another
Good Luck!

[scoutregis]

Hello

Hi Loppexxx

Sorry for the delay.

Yes, the item does not appear anywhere and some notifications that some not supported itens appeared but how can i activate the item manually?

[lopexxx]

Hi scoutregis!

You can activate it, clicking in monitors where it tells that it´s not supported in gray.
Try checking the log file zabbix_server.log in your zabbix server to gather the error. The location of the log file may depends on your zabbix version and OS.
For example I have zabbix server 1.8.3 in Ubuntu 10.04 LTS. The log file is in:
# /tmp/zabbix_server.log
# /tmp/zabbix_server.log.old

[scoutregis]

hello

Hello Loppex, i m using the zabbix appliance 1.8.4 that runs with opensuse.

I checked the logs but the message inside of it is the same at the frontend that is not supported.

I tried to run mannualy the script but it is not working when i try to run it appears an error on ^| find /i "extra"

the error mentioned is that the | find was not expected at this moment.

I m using windows 7 but also tried on a Win XP Pro

[lopexxx]

Its been a long time but i found the error with the help of mmatari.
You have to modify the script, because it works only with Spanish Windows OS.

In this line
for /f "tokens=1" %%x in ('wmic logicaldisk get caption^, description ^| find /i "extra"') do (GOTO ENCONTRADO)
you have to change "extra"
As I have no windows in English, I can not tell for sure which word you should use.
The word "extra" is used to find the line "Disco extraíble" in spanish.
I guess that the word in english maybe "remo" "removable Disk".

Try use the command "wmic logicaldisk get caption" in one of your windows pc to see what im talking.
And as they say here, better late than never

[Gunsthall]

Buenas lopexxx,

Habiendo formas más elegantes de comprobar esto, un aplauso sólo por el echo de contribuir a este foro del estupendo Zabbix e incluir capturas de pantalla.

A modo comentario simplón, ¿porqué simplemente no miras el parámetro drivetype en lugar de caption? Te devuelve un número por tipo de undiad (2 para "removable drives")

Saludos