Anyone knows how to monitor windows server updates?

[RonaldMcDonaldTrump]

I'm looking a way to monitor windows server updates by using zabbix.

I'd focus on retrievering the actual version and which and wheter updates are availble.

Do you think is possible?

[Linwood]

It's a good question I haven't thought much about, but my first check would be to see if there are other tools which already track this. I know in the past things like Belarc Advisor attempted to track whether you had all the key security updates. The difficulty today is that you have so many different ways to do updates, deferring major, taking security only, via WSUS or direct or other config control tool, etc. that I do not think there is a simple place in windows to go and say "current or not". It might be easier to find a good tool that does this on each system, and then track its response in zabbix. This, of course, after defining what "up to date" means in your environment.

Bottom line: don't re-invent the wheel if you can find a perfectly good one elsewhere (I do not know at all if you can find a perfectly good one though - please do post back if you do).

[RonaldMcDonaldTrump]

found this template: https://share.zabbix.com/operating-s...ws-update-v1-0

I need to fix up this problem



Startup state of "Windows Update" on server " TEST-UPDATE" is disabled, zbx_winupdate.exe cannot check for updates.
nty
Value should be lower or 2

Specifically for startup:
0 - automatic,
1 - automatic delayed,
2 - manual,
3 - disabled,
4 - unknown

https://www.zabbix.com/documentation...agent/win_keys

I find something weird, I mean , that looks like I need to install zabbix agent as I did because in the setup is required to write sender path.
But in the availability section it doesn't display zabbix agent avability.

[RonaldMcDonaldTrump]

It's done

[Chewbakka-Wakka]

I'm wondering how this can be done without the use of additional scripts or programs. I've just starting playing around with wmi.get this can give some useful info. Essentially 3 things to check: Is the SVC windows update running? What update are we currently on? Are never ones available? (Simplified)

Got 2 of those 3 so far covered.

wmi.get[root\cimv2,SELECT HOTFIXID FROM win32_quickfixengineering]

- just as an example, not the solution here.

[Linwood]

I'm wondering how this can be done without the use of additional scripts or programs. I've just starting playing around with wmi.get this can give some useful info. Essentially 3 things to check: Is the SVC windows update running? What update are we currently on? Are never ones available? (Simplified)

That's why I suggested earlier to find something that already tracks it. It's really a more broad problem - some companies use WSUS (or whatever it's called today), some use 3rd party patch management; there's also Microsoft products like office, but there's risks from 3rd party products like Adobe as well that need to be checked and tracked if you really want to be comprehensive. And on top of it all is then trying to keep it updated as microsoft and others change their techniques.

[mike_seventeen]

Don't know if any of you will have an answer for this but I've setup up everything from this link: https://share.zabbix.com/operating-s...ws-update-v1-0

The log of zbx-winupdate shows that it found available updates when checking for them and it also show that it's sending the data towards zabbix_sender, however it doesn't seem to be actually sending the data to the zabbix server.



Accordingly there's no data in "Latest data".



Probably one of the reasons is that I did something wrong or didn't do something that I should've to start with. Hopefully some of you will have an awnser to this.
Quick note, this is the first time I'm ever using Zabbix, currently I'm studying programming so this isn't exactly my area. I'm pretty much inexperienced.

[jluvs2ride]

It's done

What was the Special Sauce that made this work?

[acatic1]

What was the Special Sauce that made this work?

Yes please, how was this done?

[Ranjith.Rokkam]

How was this done? what changes made in Agent level / Special scripts that has been added to get this data.

Regards,
Ranjith

[dimir]

Some work was done on it, check out registry monitoring. You can monitor WindowsUpdate-specific registry keys for their values using Agent 2 for Windows starting from Zabbix 6.2.0 . You can also vote for this change request (ZBXNEXT-5707) that asks for the Windows Updates monitoring template out of the box.

Possibly, this could be useful on which keys to monitor, but don't trust me on this one, I'm not good at Windows: https://github.com/vFense/vFenseAgen...Updates-&-WSUS

[Brambo]

I use these items for windows updates check, keep in mind that zabbix agent config must allow system.run and that timeout on missing updates could happen. (agent and server parameter potentially needs to be changed)
In text:

system.run[powershell.exe -c "$UpdateSession = New-Object -ComObject Microsoft.Update.Session ; $UpdateSearcher = $UpdateSession.CreateupdateSearcher() ; $UpdateSearcher.Search('IsHidden=0 and IsInstalled=0').Updates | Select-Object -expandproperty Title", wait]

system.run[powershell.exe -c "write-output (New-Object -ComObject Microsoft.Update.AutoUpdate).Results | Select-object -expandproperty LastInstallationSuccessDate"]

system.run[powershell.exe -c "write-output (New-Object -ComObject Microsoft.Update.AutoUpdate).Results | Select-object -expandproperty LastSearchSuccessDate"]

[renatobeiriz]

for me, not show all stats