0

I wonder if it's possible to monitor if a Windows application is running under specific user or not. Let's say there are 2 Win users (accounts) on the server: User 1 has application.exe running all the time and I don't need to monitor it as it's being used by stuff; User 2 should have the same application.exe to be running but since no one will use it I need Zabbix to monitor and alert if it's not launched. Normally you would monitor if application is running via following trigger:

{HOST_NAME:proc_info[TestProcess.exe,wkset,sum].last(#1)}<1

So my question is if it's possible to monitor if application.exe is running under specific Win user or not. Any ideas would be highly appreciated. Thank you.

2

You can do this with system.run[] key using Powershell.

First you need to put in your agent configuration file EnableRemoteCommands=1. After that you need to restart the "Zabbix Agent" service.

Next step is just create new item with parameters:

Type: Zabbix agent

Key (ex. cmd): system.run[powershell.exe -nolog -command "(Get-Process -Name cmd -IncludeUserName | Format-Table -Autosize)"]

Type of information: Text

Effect: enter image description here

Next you can use item Preprocessing, and in Javascript display the desired data. Then just create a trigger that will check if the data is consistent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.