Zabbix 27 Course - Monitoring Logs on Windows
Hello! In this video, we'll continue customizing Zabbix templates, but this time we'll look at several examples of how to monitor logs on Windows. We'll see how to view security logs from a Domain Controller, as well as monitor and generate a trigger for a specific string in a log of a service running on Windows. Let's get started!
⏰ TIMESTAMPS:
Introduction to Log Monitoring in Windows (0:00)
First example: Full Windows security logs (0:17)
Second example: Trigger for a specific security ID (8:56)
Third example: Read a specific string in a service log (15:17)
Final comments (28:09)
✍ Instructions for what we saw in this video:
**Script that fetches all the data from the specific Windows security event
✅Download:
https://drive.google.com/file/d/1QyFi...
**Windows security event script needed to create our new item and Trigger
✅Download:
https://drive.google.com/file/d/1aiv-...
👉 Script to monitor a specific string in a log of an operating service in Windows
In Zabbix config:
UserParameter=custom.logmonitor,powershell -command "Get-Content 'FULL_WINDOWS_PATH' | Select -String '[STRING_A_SEARCH]' | Select-Object -Last 1 | Out-String"
For example:
UserParameter=custom.logmonitor,powershell -command "Get-Content 'C:\Program Files\Zabbix Agent 2\zabbix_agent2.log' | Select-String 'DC' | Select-Object -Last 1 | Out-String"
Script in Host:
✅Download:
https://drive.google.com/file/d/1B2Gz...
Note: This script can also be used to assign a trigger from Zabbix.
👉 TIP: Command to manually test scripts locally before configuring them in Zabbix
UserParameter=RandomName,powershell.exe -ExecutionPolicy Bypass -File C:\path\to\file\script_name.ps1
👉 Recommended link with security ID:
https://www.techtarget.com/searchwind...