Close Windows Program With Remote Command

[cdm710]

I was wondering if this is even possible. I'd like to close IM programs if users are running them. Is there a way to issue a remote command to close the program if I can detect it's running? If it's possible, how can I go about doing this?

[Alexei]

Yes, it can be easily configured. Use combination of a trigger with a remote command to execute standard Windows command 'taskkill' under certain conditions.

[cdm710]

Can I use taskkill in combination with a trigger that is activated when proc.num[aim.exe] > N when N=1? If so what sort of syntax is required to execute the taskkill command? Also, will the taskkill remote command be run every time the process is detected, or is it a one detection kind of thing?

[cdm710]

Ok, I created a remote command action that is triggered when Zabbix detects aim.exe is running.

I decided that instead of trying to kill the process, I would rather display a message saying IM programs are prohibited. How do I do that? Is it possible to easily echo such a message, and if so how because I can't seem to get it to work...

[cdm710]

I created a script in /home/zabbix/bin entitled message.bat

Here's the script:

@echo off
echo IM Programs are Prohibited. Close the Program Immediately.
pause

I created a script media type and named it /home/zabbix/bin/message.bat with a description name of AIM Message.

The action's event source is the "AIM Running" trigger. The operation that is run when this event source is active is Chris:/home/zabbix/bin/message.bat. I've also tried Chris:AIM Running, which didn't make any difference. Here's my zabbix_agentd.log from my Windows machine:

2216:20070709:141642 Requested [system.run[/home/zabbix/bin/message.bat,nowait]]
2216:20070709:141642 Run command '/home/zabbix/bin/message.bat'
2216:20070709:141642 Execute command 'cmd /C "/home/zabbix/bin/message.bat"'
2216:20070709:141642 Sending back [1]
3280:20070709:141643 Processing request.

Anyone know what I'm doing wrong here?

[swaterhouse]

The script needs to be on the windows machine not the zabbix server

[cdm710]

I was trying to avoid that scenario because I'd rather not have to go and put the script on every machine...Is there really no way to have the script on the server?

[swaterhouse]

You could try putting the script on one of the windows servers and run it through a windows share (i.e. \\windowsservername\scripts\myscript.bat). You could keep it on the zabbix server but you either need to setup a samba share or setup services for unix on windows (or whatever they call it this week).

Scott

[cdm710]

Ok, that makes sense. I still can't get it working with the script on the host machine, however. The log file looks about the same, but here it is:

4084:20070710:081540 In check_security()
4084:20070710:081540 Requested [proc.num[aim.exe]]
4084:20070710:081540 Sending back [1]
3064:20070710:081542 Processing request.
3064:20070710:081542 In check_security()
3064:20070710:081542 Requested [system.run[C:\Program Files\Zabbix\message.bat,nowait]]
3064:20070710:081542 Run command 'C:\Program Files\Zabbix\message.bat'
3064:20070710:081542 Execute command 'cmd /C "C:\Program Files\Zabbix\message.bat"'
3064:20070710:081542 Sending back [1]

I'm probably missing something small, but regardless it's still not working.

[richb]

Are you sure that the script isn't running and you're missing it? 'echo', from within a bat file will only display the text if there is a command window open. If not it will pop up a command window, display the text then close it almost immediately.

What you probably want is a VBScript popup:

MsgBox "This is a test", false, "This is the title"

Save this code as noim.vbs

Then use

cscript /nologo \\server\share\noim.vbs

in the zabbix conf file. This will display a dialog box, with an OK button. The dialog is displayed until the user clicks OK. To test it simply double-click on the .vbs file.

Hope this helps

[swaterhouse]

I think the problem may be that you want the script to display the message to the logged in user but the script is run under the user account of the zabbix service (either LocalSystem or some other user you may have defined) which will not display in the currently logged in users space.

I think you would be better off sending a message via netsend.