Reading Windows Event Logs in Zabbix
Now I’m going to show you a slightly more advanced item to monitor, and this one is specific to windows, and that is the Security Event ID 4625, also known as “Failed Logon”.
Monitoring this event id can be used as an early warning indicator that your server is under attack, or even someone just forgot there password and you can jump up, bounce over to there desk, and proudly offer assistance before they even ask. Or you could look across the office and say, “Hey Bartholomew, may I assist you with a password reset?”
What ever your reason is your business, i’ll just stick to showing you how its done.
Go into the Zabbix UI, Configuration → Hosts and then select the windows host that you want to monitor and then create a new item,
Give it a title, eg,
Select the type as
The agent will do the hard work, and send it to the server when it has it ready.
For the key, we use the eventlog item. This allows the Zabbix agent to read the windows event logs. For the key value enter,
Note : The skip option for the mode flag at the end. With this setting, the agent will only scan through new data, rather than historical data. By not doing this, the initial scan of the item will use a lot of the computer resources and take some time while it scans for the first time, so if it is not important to scan the history, then use the skip option as I have done.
The other values I’ve set in my key are
Other possible names are Application , Setup , System , Forwarded Events
There are many security event ids to choose from. See my Zabbix template where I have included many PCI DSS related event ids.
https://github.com/Sean-Bradley/zabbix_windows_pci_dss_template
Note : Selecting text here instead of log , for this item will lead to the loss of local timestamp, log severity and source information.
And then press the Add button at the bottom of the page.
Note : Most importantly, the item must be configured as an active check.
Note : If your windows host is being monitored via a Zabbix proxy, then do a config cache reload on the proxy so that it has the new information about the host you just updated.
Now go to actual physical host you added the new item for, or RDP to it if it is remotely managed, and then try to log in but using the wrong password a few times.
Go back into the Zabbix UI Monitoring → Latest Data and within a minute you should see a new event appearing in the latest data for your host. The log will show the title being “An account failed to log on” and further down the text, you will find the Account name that was used.
“Guilty”, you shout at the perpetrator. “You have been caught red handed”, and then you remember, that it was you. Doh!
If you have set this up and you are not seeing the failed events show up in Zabbix, ensure that the Zabbix agent running on the host is using the Local System account login. This will be the default after installing Zabbix agent on your windows host. You can check by using the services.msc application and viewing the Log On properties for Zabbix Agent
Video Tutorial
I have created a video tutorial of the steps to set up windows event log monitoring in Zabbix
Thanks for reading my article, always remember to Clap, Comment and Share and I will write more.
Zabbix Documentation 5.2
Sidebar
Table of Contents
Windows-specific item keys
Item keys
The table provides details on the item keys that you can use with Zabbix Windows agent only.
| Key | ||||
|---|---|---|---|---|
| Description | Return value | Parameters | Comments | |
| eventlog[name, , , , , , ] | ||||
| Event log monitoring. | Log | name — name of event log regexp — regular expression describing the required pattern severity — regular expression describing severity This parameter accepts the following values: «Information», «Warning», «Error», «Critical», «Verbose» (since Zabbix 2.2.0 running on Windows Vista or newer) source — regular expression describing source identifier (regular expression is supported since Zabbix 2.2.0) eventid — regular expression describing the event identifier(s) maxlines — maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of ‘MaxLinesPerSecond’ in zabbix_agentd.win.conf mode — possible values: all (default), skip — skip processing of older data (affects only newly created items). | The item must be configured as an active check. | |
Examples:
⇒ eventlog[Application]
⇒ eventlog[Security,,»Failure Audit»,,^(529|680)$]
⇒ eventlog[System,,»Warning|Error»]
⇒ eventlog[System. ^1$]
⇒ eventlog[System. @TWOSHORT] — here a custom regular expression named TWOSHORT is referenced (defined as a Result is TRUE type, the expression itself being ^1$|^70$ ).
Note that the agent is unable to send in events from the «Forwarded events» log.
The mode parameter is supported since Zabbix 2.0.0.
“Windows Eventing 6.0” is supported since Zabbix 2.2.0.
Note that selecting a non-Log type of information for this item will lead to the loss of local timestamp, as well as log severity and source information.
See also additional information on log monitoring.
Note that enabling/disabling some components may change their ordering in the Windows interface name.
Some Windows versions (for example, Server 2008) might require the latest updates installed to support non-ASCII characters in interface names.
interval — last N seconds for storing the average value.
The interval must be between 1 and 900 seconds (included) and the default value is 1.
See also: Windows performance counters.
interval — last N seconds for storing the average value.
The interval must be between 1 and 900 seconds (included) and the default value is 1.
You can find the list of English strings by viewing the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009 .
Supported since Zabbix agent versions 4.0.13 and 4.2.7.
attribute — requested process attribute
type — representation type (meaningful when more than one process with the same name exists)
vmsize (default) — size of process virtual memory in Kbytes
wkset — size of process working set (amount of physical memory used by process) in Kbytes
pf — number of page faults
ktime — process kernel time in milliseconds
utime — process user time in milliseconds
io_read_b — number of bytes read by process during I/O operations
io_read_op — number of read operation performed by process
io_write_b — number of bytes written by process during I/O operations
io_write_op — number of write operation performed by process
io_other_b — number of bytes transferred by process during operations other than read and write operations
io_other_op — number of I/O operations performed by process, other than read and write operations
gdiobj — number of GDI objects used by process
userobj — number of USER objects used by process
Valid types are:
avg (default) — average value for all processes named
min — minimum value among all processes named
max — maximum value among all processes named
sum — sum of values for all processes named
Examples:
⇒ proc_info[iexplore.exe,wkset,sum] — to get the amount of physical memory taken by all Internet Explorer processes
⇒ proc_info[iexplore.exe,pf,avg] — to get the average number of page faults for Internet Explorer processes
Note that on a 64-bit system, a 64-bit Zabbix agent is required for this item to work correctly.
Note: io_*, gdiobj and userobj attributes are available only on Windows 2000 and later versions of Windows, not on Windows NT 4.0.
]
String — with param as displayname, path, user
Text — with param as description
Specifically for state:
0 — running,
1 — paused,
2 — start pending,
3 — pause pending,
4 — continue pending,
5 — stop pending,
6 — stopped,
7 — unknown,
255 — no such service
Specifically for startup:
0 — automatic,
1 — automatic delayed,
2 — manual,
3 — disabled,
4 — unknown,
5 — automatic trigger start,
6 — automatic delayed trigger start,
7 — manual trigger start
param — state (default), displayname, path, user, startup or description
⇒ service.info[SNMPTRAP] — state of the SNMPTRAP service
⇒ service.info[SNMP Trap] — state of the same service, but with display name specified
⇒ service.info[EventLog,startup] — startup type of the EventLog service
Items service.info[service,state] and service.info[service] will return the same information.
Note that only with param as state this item returns a value for non-existing services (255).
This item is supported since Zabbix 3.0.0. It should be used instead of the deprecated service_state[service] item.
Text — list of services separated by a newline
state — all (default), stopped, started, start_pending, stop_pending, running, continue_pending, pause_pending or paused
exclude — services to exclude from the result. Excluded services should be listed in double quotes, separated by comma, without spaces.
⇒ services[,started] — list of started services
⇒ services[automatic, stopped] — list of stopped services, that should be run
⇒ services[automatic, stopped, «service1,service2,service3»] — list of stopped services, that should be run, excluding services with names service1, service2 and service3
The exclude parameter is supported since Zabbix 1.8.1.
query — WMI query returning a single object
Example:
⇒ wmi.get[root\cimv2,select status from Win32_DiskDrive where Name like ‘%PHYSICALDRIVE0%’] — returns the status of the first physical disk
This key is supported since Zabbix 2.2.0.
Can be used for low-level discovery.
query — WMI query
Example:
⇒ wmi.getall[root\cimv2,select * from Win32_DiskDrive where Name like ‘%PHYSICALDRIVE%’] — returns status information of physical disks
JSONPath preprocessing can be used to point to more specific values in the returned JSON.
This key is supported since Zabbix 4.4.0.
Float — for percentage
available (available virtual memory), pavailable (available virtual memory, in percent), pused (used virtual memory, in percent), total (total virtual memory, default), used (used virtual memory)
⇒ vm.vmemory.size[pavailable] → available virtual memory, in percentage
Monitoring of virtual memory statistics is based on:
* Total virtual memory on Windows (total physical + page file size);
* The maximum amount of memory Zabbix agent can commit;
* The current committed memory limit for the system or Zabbix agent, whichever is smaller.
This key is supported since Zabbix 3.0.7 and 3.2.3.
Monitoring Windows services
This tutorial provides step-by-step instructions for setting up the monitoring of Windows services. It is assumed that Zabbix server and agent are configured and operational.
Step 1
Get the service name.
You can get that name by going to MMC Services snap-in and bringing up the properties of the service. In the General tab you should see a field called ‘Service name’. The value that follows is the name you will use when setting up an item for monitoring.
For example, if you wanted to monitor the “workstation” service then your service might be: lanmanworkstation.
Step 2
Configure an item for monitoring the service.
The item service.info[service,
] retrieves the information about a particular service. Depending on the information you need, specify the param option which accepts the following values: displayname, state, path, user, startup or description. The default value is state if param is not specified (service.info[service]).
The type of return value depends on chosen param: integer for state and startup; character string for displayname, path and user; text for description.
Two value maps are available Windows service state and Windows service startup type to map a numerical value to a text representation in the Frontend.
Discovery of Windows services
Low-level discovery provides a way to automatically create items, triggers, and graphs for different entities on a computer. Zabbix can automatically start monitoring Windows services on your machine, without the need to know the exact name of a service or create items for each service manually. A filter can be used to generate real items, triggers, and graphs only for services of interest.
