1

I wonder if it's possible to monitor if a Windows application is running under specific user or not. Let's say there are 2 Win users (accounts) on the server: User 1 has application.exe running all the time and I don't need to monitor it as it's being used by stuff; User 2 should have the same application.exe to be running but since no one will use it I need Zabbix to monitor and alert if it's not launched. Normally you would monitor if application is running via following trigger:

{HOST_NAME:proc_info[TestProcess.exe,wkset,sum].last(#1)}<1

So my question is if it's possible to monitor if application.exe is running under specific Win user or not. Any ideas would be highly appreciated. Thank you.

Arsen
  • 11
  • 3

1 Answers1

2

You can do this with system.run[] key using Powershell.

First you need to put in your agent configuration file EnableRemoteCommands=1. After that you need to restart the "Zabbix Agent" service.

Next step is just create new item with parameters:

Type: Zabbix agent

Key (ex. cmd): system.run[powershell.exe -nolog -command "(Get-Process -Name cmd -IncludeUserName | Format-Table -Autosize)"]

Type of information: Text

Effect: enter image description here

Next you can use item Preprocessing, and in Javascript display the desired data. Then just create a trigger that will check if the data is consistent.

maar
  • 485
  • 6
  • 20