Windows Client mounted shares

[GerardZ]

Hi,

Im new to Zabbix and have been wrecking my brain with something for a week or two now.

Basically, i want to monitor mounted shares on windows clients. I have 2 pyshical disks and 5 logical. I have a basic vbscript called logicaldisktest.vbs that reports on the drives connected:

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set colDrives = objFSO.Drives

For Each objDrive in colDrives
    Wscript.Echo "Drive letter: " & objDrive.DriveLetter
Next

However when i run it via an active agent (userp in the .conf file)

UserParameter=LogChk,cscript //Nologo "C:\Zabbix\logicaldisktest.vbs"

it produces the output as follows:

Drive letter C, Drive letter D

However ive got 1 pyshical drive (C), an Cd drive (D) and 5 shared drives mapped to drive letters. When i run the script from the local PC it brings back all the drives (pyshical and logical). Why is it not working when it runs via Zabbix?

I've tried this a few ways now...
-Log item
-using the called script to write to a log file and importing the log file (the log file populates when i run the vbs script locally but when i leave it to the agent it only writes the physically connected drives to the log, even though its calling the same script)
-incresaing/decreasing update interval etc
-running script directly via system.run
-running a bat to run the script to populate a log file and reading from it!!!

but no matter what way i do it it outputs the same result where it doesnt pick up the logical drives when run remotely.

Any ideas?

[aib]

Check this thread - Extension to Zabbix discovery

[GerardZ]

Cheers, Ive grabbed the latest version and installed successfully.

Not sure what to do next?

Do i create a new discovery rule as follows, Not im guessing i need an item prototype?

<IMG>https://www.zabbix.com/forum/attachment.php?attachmentid=6752&stc=1&d=139455679 6</IMG>

sorry, pretty new to this.

Ultimately im hoping for an output of

"Drive connected: C, J, K, L"

Cheers for help.

[coreychristian]

if I were to guess, the issue you are running into is that the local system user doesn't have access to read the mapped drives.

One work around you maybe able to try is to create a service account for the zabbix agent (if you don't have one already) and make sure that the drives are automatically mapped for this user.

I am not 100% sure that would fix your issue, but it seems like to me that's what you would need to overcome anyway.

[GerardZ]

Thanks for reply Corey,

Do you mean though that the remote user doesnt have access to the information about the mapped drives?

As i am logged in as the local user (with full admin). I can access the Zabbix server and check if there is a zabbix user profile? Do you think thats what the issue may be That the Zabbix server doesnt have permissions to retrieve the drive information?

Thanks,
g.

[coreychristian]

Sorry I think I may have misunderstood how you are running the script, sorry not all of the screen shots are showing up for me.

Are you running it from the zabbix servers agent, or the agent on the system you want to monitor?

Either way though, it would seem that the drives aren't mounted when the script runs, or for that user.

The easiest way to monitor these to me would be to enable the zabbix agent to see the drives and use a standard LLD.

I would suggest using a service account for the zabbix agent service, though you could still use local system.

Here is a link to how you could map the drives to local system, I would think with a different service account though it would likely be a bit easier.

https://support.asperasoft.com/entries/23290747-How-to-map-network-shares-into-drives-to-a-Windows-service-permanently

[tchjts1]

Out of curiosity - if you have the Zabbix agent installed on your host servers, why are you not using the default LLD rule that is included in the Template OS Windows?

Or am I missing something here?

If you attach this template to your Windows hosts, the already existing LLD rule will give you the information you are looking for. LLD rules can take up to an hour to initially report the data.

[GerardZ]

Sorry I think I may have misunderstood how you are running the script, sorry not all of the screen shots are showing up for me.

Are you running it from the zabbix servers agent, or the agent on the system you want to monitor?

Either way though, it would seem that the drives aren't mounted when the script runs, or for that user.

The easiest way to monitor these to me would be to enable the zabbix agent to see the drives and use a standard LLD.

I would suggest using a service account for the zabbix agent service, though you could still use local system.

Here is a link to how you could map the drives to local system, I would think with a different service account though it would likely be a bit easier.

https://support.asperasoft.com/entri...ce-permanently

Hi, Im running the agent on my own laptop at the moment so im in control of the agent only at the minute. Yes it definitely appears that the zabbix process running the script is only returning the C: and D: drives.

Whats strange is that the server is calling the script ok on the client and the client is running. I would have thought that as soon as the script runs the output would have been beyond control of Zabbix.

so to summarize i run and get: Drives C,D,E,F,G etc
Zabbix runs script via an active agent item and gets: C, D

[GerardZ]

Out of curiosity - if you have the Zabbix agent installed on your host servers, why are you not using the default LLD rule that is included in the Template OS Windows?

Or am I missing something here?

If you attach this template to your Windows hosts, the already existing LLD rule will give you the information you are looking for. LLD rules can take up to an hour to initially report the data.

Hi,

That only returns information for the C drive.



cheers,
G.

[GerardZ]

So how would i go about testing my vbs script from the Zabbix server perspective? What permissions can i alter if the problem is indeed to do with the remote command permission from server to agent?

As an aside here is the results in the debug log:

6716:20140312:170429.061 Requested [vfs.fs.discovery]
6716:20140312:170429.062 Sending back [{
"data":[
{
"{#FSNAME}":"C:",
"{#FSTYPE}":"NTFS"},
{
"{#FSNAME}":"D:",
"{#FSTYPE}":"UNKNOWN"},
{
"{#FSNAME}":"E:",
"{#FSTYPE}":"FAT32"}]}]

(E is a USB i have plugged in)

No sign of logical drives at all

[coreychristian]

Hey Gerard,

I found this article which might help, I think you would need to go through all the steps, as I mentioned I don't have a dev system to test this on so I am a bit limited in what I can do.

I was able to just run the agent locally as my user then see a network drive mapped through the LLD disk discovery script while running the agent locally instead of as a service.

bash-4.1$ /usr/bin/zabbix_get -s XXXXXXXXXXXX-k vfs.fs.discovery
{
"data":[
{
"{#FSNAME}":"A:",
"{#FSTYPE}":"UNKNOWN"},
{
"{#FSNAME}":"C:",
"{#FSTYPE}":"NTFS"},
{
"{#FSNAME}":"D:",
"{#FSTYPE}":"NTFS"},
{
"{#FSNAME}":"E:",
"{#FSTYPE}":"UNKNOWN"},
{
"{#FSNAME}":"Z:",
"{#FSTYPE}":"NTFS"}]}

Here is a link explaining things.

http://stackoverflow.com/questions/1...d-by-a-service

Here is maybe a better explanation why I found in the comments.

The reason why you are able to access the drive in when you normally run the executable from command prompt is that when u are executing it as normal exe you are running that application in the User account from which you have logged on . And that user has the privileges to access the network. But , when you install the executable as a service , by default if you see in the task manage it runs under 'SYSTEM' account . And you might be knowing that the 'SYSTEM' doesn't have rights to access network resources.

There can be two solutions to this problem.

To map the drive as persistent as already pointed above.

There is one more approach that can be followed. If you open the service manager by typing in the 'services.msc'you can go to your service and in the properties of your service there is a logOn tab where you can specify the account as any other account than 'System' you can either start service from your own logged on user account or through 'Network Service'. When you do this .. the service can access any network component and drive even if they are not persistent also. To achieve this programmatically you can look into 'CreateService' function at http://msdn.microsoft.com/en-us/libr...(v=vs.85).aspx and can set the parameter 'lpServiceStartName ' to 'NT AUTHORITY\NetworkService'. This will start your service under 'Network Service' account and then you are done.

You can also try by making the service as interactive by specifying SERVICE_INTERACTIVE_PROCESS in the servicetype parameter flag of your CreateService() function but this will be limited only till XP as Vista and 7 donot support this feature.

[GerardZ]

Hi Corey,

Thanks for the help thus far. I aprreciate your efforts. I changed the service to runas as a network service but it didnt help

I would consider mapping them in some sort of persistant manner but ive to deploy this on 40 windows machines tomorrow and the shares are essential to our business so i dont want to tamper with them.

[coreychristian]

No problem, sorry I couldn't help more.

Another option for you might be just monitoring the shared folders on the server where they exist, then just writing your script to verify the client has access to the share, and have zabbix report on that.