How to disconnect or block a computer?

[thuongnv]

Hi all!

I have just used zabbix for 2 months. I have a question "Can zabbix disconnect or block a computer which has too high bandwidth or too many connection to it because of virus or somethings like that?"

And how to create a script to do that with zabbix! Plz help me, so many thanks!

Sorry for my bad english !

[nelsonab]

Directly no, indirectly through a script... the possibilities are nearly limitless...

First you will need to do some homework. Such as how can you even limit a computer's bandwidth. Do you have remote control of the switch the host is connected to? Can you turn off the port a computer is connected to via snmp, web interface or console (ssh/serial). Next you'll need to figure out how to script that activity.

Alternatively you could force all hosts to go through a squid proxy by setting up your firewall/router to deny all traffic to the internet for all hosts with the exception of your squid host and then point all hosts at squid. Then you could write some squid rules to deny hosts found in a specific deny file. This file could be updated by a script.

In both cases you take the script and then tie it to a Zabbix action.

Probably not as straight forward as you were looking for but what you are looking to do requires a lot of steps and the right hardware/network setup.