Windows Agent Remote Commands

[brhunt]

Hello,

Using Zabbix 5.4.x server and agent.

We have a Windows 2019 Server that has a service that will occasionally stop for no apparent reason. This causes an alert in Zabbix. It is not a critical service, but we would like to keep it running.

We set up a Script and and an Action to restart the service when it stops.

On the agent side, we set up: AllowKey=system.run[*] followed by DenyKey=system.run[*]

With these settings the Remote Command process is working perfectly.

The item key for the trigger is: service.info["AMD External Events Utility",state]
The trigger name is: "AMD External Events Utility" (AMD External Events Utility) is not running (startup type automatic)
The Script Command is: net start "AMD External Events Utility"

We would like to restrict the Remote Command process on the agent so that this is the only remote command that can be executed from Zabbix.

I have tried a number of permutations of the AllowKey=system.run[] statement that would lock this down, but I cannot find one that will work properly. If I use anything other than AllowKey=system.run[*], the Remote Command fails with an "Unsupported item key." error.

Can anyone help me with the proper syntax for the AllowKey statement to allow just the restart of this one service?

Thanks for any and all help.

Bryan Hunt

[keglo.peter]

Hello,

Using Zabbix 5.4.x server and agent.

We have a Windows 2019 Server that has a service that will occasionally stop for no apparent reason. This causes an alert in Zabbix. It is not a critical service, but we would like to keep it running.

We set up a Script and and an Action to restart the service when it stops.

On the agent side, we set up: AllowKey=system.run[*] followed by DenyKey=system.run[*]

With these settings the Remote Command process is working perfectly.

The item key for the trigger is: service.info["AMD External Events Utility",state]
The trigger name is: "AMD External Events Utility" (AMD External Events Utility) is not running (startup type automatic)
The Script Command is: net start "AMD External Events Utility"

We would like to restrict the Remote Command process on the agent so that this is the only remote command that can be executed from Zabbix.

I have tried a number of permutations of the AllowKey=system.run[] statement that would lock this down, but I cannot find one that will work properly. If I use anything other than AllowKey=system.run[*], the Remote Command fails with an "Unsupported item key." error.

Can anyone help me with the proper syntax for the AllowKey statement to allow just the restart of this one service?

Thanks for any and all help.

Bryan Hunt

Hi Bryan,

Can you help me please, I'm trying to set up zabbix for testing as we want to use it in our production environment but I'm struggling with the script running on Windows.

For testing I have a few linux and a Win10 host, I set up some triggers and scripts to restart services on linux, this works great. I tried the same on Windows, the trigger itself works, a problem is shown on the dashboard if I stop the service but the script in the trigger action fails every time with "Unsupported item key." error. I put "AllowKey=system.run[*]" in the Windows agent config.

Did you have any problem with this?

Thank you in advance,
Peter