check av in windows os

[SchylgeICT]

dear reader,
Referring to this thread:

https://www.zabbix.com/forum/showthread.php?t=47691

I'm trying to setup av monitoring. The idea is to check if it is up and running and up to date. Every other outcome, should produce a warning.

Enabled userparamter and user parameterunsafe in agent. Set timeout in server to 10s.
trigger: ({DESKTOP-GQG9LLBroduct_state.last(0)}<>266240) and ({DESKTOP-GQG9LLBroduct_state.last(0)}<>397312) and ({DESKTOP-GQG9LLBroduct_state.last(0)}<>397568)

first tested a wmic line:
UserParameter=product_state,wmic /NAMESPACE:\\root\SecurityCenter2 PATH AntiVirusProduct GET /value | find "productState"
this outputs productState=123456. The item in server says a numeric value is expected instead of a string. When setting the item to "character" there are no errors at item level, but then the trigger produces an error. The item value "product_state" now returns "productState=123455" and it can only compare numeric values.

So i thought i'd only want the number as result and not the whole "productState=12345"

so next

a powershell script which actually only produces the numeric value:
UserParameter=product_state,C:\Windows\System32\Wi ndowsPowerShell\v1.0\powershell.exe -nologo C:\zabbix\av_check.ps1
This script, which runs for a millisecond, gives a timeout exceed on the item in server.

third tried a batch, which also has the number as outcome when running in cmd.exe:
FOR /F %%A IN ('WMIC.EXE /NAMESPACE:\\root\SecurityCenter2 Path AntiVirusProduct Get ProductState ^| FINDSTR.EXE /R /C:"[0-9]"') DO SET ProductState=%%A
echo.%ProductState%

UserParameter=product_state,C:\zabbix\av_check.bat

serverside in item it now comes with a result %ProductState% . Again with error a numeric value is expected.

i've been struggling now for 4 days with this. Can anyone help me out?
BTW when running:
zabbix_agentd.exe --test "product_state" locally on the client all userparameters return:
product_state [m|ZBX_NOTSUPPORTED] [Unsupported item key.]

which is strange since the item result serverside actually shows data being generated.

[kaspars.mednis]

So i thought i'd only want the number as result and not the whole "productState=12345"

Maybe try preprocessing in item ? it has very powerfull capabilities

something like regexp (?<==)[\w+.-]+

best regards
Kaspars

[SchylgeICT]

Hi,
Thanks for your suggestion. I never came up with the idea using that. Last time i used Zabbix was with 1.8.1. I think alot has changed.
I'm scannig through the preprocessing docs. But cannot really find an example.
When you say regexp (?<==)[\w+.-]+

i choose "regular expession" from the drop down and enter "(product_state<==)[\w+.-]+" in parameters field. What do i enter in the outcome field (i have "N" now)? It needs a value. Tried a few things but it gives wrong results.

[kaspars.mednis]

The regular expression i typed was wrong, here is the right one

Regular expression: \=(.*)

Output: \1

Kaspars

[SchylgeICT]

Yes, that's it.
I'm gonna take a deep dive into preprocessing.
thanks a thousend times.

one more question regarding the value mapping i had to create according to the referred forum post. I'm just checking if the captured number is unequal to the number in the triggers expression. If it is unequal it generates a warning. What are the value mappings for then. I do not think i need them.

[kaspars.mednis]

i don't fully understand your question...

so each product state integer value has a value mapping

https://social.msdn.microsoft.com/Forums/en-US/6501b87e-dda4-4838-93c3-244daa355d7c/wmisecuritycenter2-productstate?forum=vblanguage

you can create a custom value mapping lets say AV Product State
you map 393472 => disabled and up to date
397584 => enabled and out of date
397568 => enabled and up to date

and so on

but as far as i know, the item type is numeric unsigned, and zabbix interprets it as integer
because of that, triggers must use numeric values

value mappings just made the information more "human readable" on screen
you can make a trigger name with {ITEM.LASTVALUE} on {HOSTNAME} macro, and it will nicely display on screen "Antivirus is disabled and up to date on Server1"

best regards,
Kaspars

[SchylgeICT]

Hi,

i'm most likely going to scan very different workstations with different scanners. Since i do not know all the different product states. So after install the zabbix agent on a workplace i have to manually check if the AV scanner is running up to date, and than check what product state number that is for that specific scanner.
In my trigger expression i will add that number to the expression and use that number to check if is is not equal:
({DESKTOP-GQG9LLBroduct_state.last(0)}<>266240) and ({DESKTOP-GQG9LLBroduct_state.last(0)}<>397312) and ({DESKTOP-GQG9LLBroduct_state.last(0)}<>397568)
(all the above numbers are scanners that are running and up to date)

if is not equal than a warning is given with the triggers title "Antivirus is OUT of date or not running". That works withou the use of value mappings

Oh and while testing I came across the fact that powershell scripts timeout exceed. I think that in the future I will be running various powershell scripts from "userParameter". If you have an idea why that happens than please tell me.

Thanks again for your help. I'm very gratefull after 4 days struggling

[kaspars.mednis]

Hello !

have you increased the timeout in zabbix_agentd.conf ?
the default value of 3 is not good for complex script execution

Kaspars

[kaspars.mednis]

if is not equal than a warning is given with the triggers title "Antivirus is OUT of date or not running". That works withou the use of value mappings

the value mapping in combination with macro {ITEM.LASTVALUE} will give you exact product state in human readable format like

Antivirus is {ITEM.LASTVALUE} on {HOST.NAME}

Antivirus is OUT of date (12345) on server 1
Antivirus is NOT RUNNIG (54321) on server 2

Best regards
Kaspars

[SchylgeICT]

Yes I completely understand now.
Doing it that way I indeed need to find all possible productstate of every anti virus that i encounter. Now it returns:
Antivirus is 397568 on DESKTOP-GQG9LLB

because there is no value mapping for 397568

thanks for all the help.

best regards,
Ruud