Is there an <output> available for Eventlog like there is for log? Some of the returns I get back have a lot of unneeded data.
-
-
Looks like the answer is no. I can't find anything regarding it.
What I want to do is check the eventlog in windows for failed login attempts, and also check the frequency of these attempts. If there are multiple attempts from the same IP, I will create an automatic firewall rule to block the IP and notify an administrator.
Since I can't seem to get this to work with Zabbix, I am creation a powershell script to check the log (since the timestamp of the last check, based on a file timestamp to avoid duplicates and make checks quicker). This should work find so my question is now
How can I take these results, which will contain certain information, and have zabbix check that the last "5 checks" or whatever contain the same returned information, and are within a specific timeframe?
Thanks
Comment