Alert handler using winrm for Windows

matjaz.premerl · September 13, 2023, 6:41am

Hi,
For some time ago I’ve seen about alert handler for Windows.
I’m using Enterprise version, but I’m not so clear which rule should I use for Windows server. Is it the same agent rule, where is saying “Alert handler with parameters” and use “Linux via SSH”? I can’t find option where to put username and password for connection to Windows system using winrm.

Regards,
Matjaž

Norm · September 14, 2023, 9:17pm

Hi @matjaz.premerl

the Windows Alert Handler is “hidden” in the Checkmk treasures folder.
The installation instructions are in the readme file.

Here are the files on Github. You can find the treasure files on your Checkmk server as well.

github.com

Checkmk/checkmk/blob/master/doc/treasures/alert_handler/windows/README

#.
#   .--Security Warning----------------------------------------------------.
#   |               ____                       _ _                         |
#   |              / ___|  ___  ___ _   _ _ __(_) |_ _   _                 |
#   |              \___ \ / _ \/ __| | | | '__| | __| | | |                |
#   |               ___) |  __/ (__| |_| | |  | | |_| |_| |                |
#   |              |____/ \___|\___|\__,_|_|  |_|\__|\__, |                |
#   |                                                |___/                 |
#   |              __        __               _                            |
#   |              \ \      / /_ _ _ __ _ __ (_)_ __   __ _                |
#   |               \ \ /\ / / _` | '__| '_ \| | '_ \ / _` |               |
#   |                \ V  V / (_| | |  | | | | | | | | (_| |               |
#   |                 \_/\_/ \__,_|_|  |_| |_|_|_| |_|\__, |               |
#   |                                                 |___/                |
#   +----------------------------------------------------------------------+
#   |            Use this alert handler at your own risk!                  |
#   |         It can execute arbritrary code with permissions              |
#   |                of the configured windows user!                       |
#   '----------------------------------------------------------------------'

This file has been truncated. show original

Hope this helps.

Regards
Norm

matjaz.premerl · September 15, 2023, 7:00am

Hi Norman,

Yes I know about that files. But in the manual is information about putting username, password and command in the configuration part of alert handler in Enterprise Edition and there is no such possibility in user interface or I can’t find it.

Regards,
Matjaž

Norm · September 15, 2023, 7:10am

Hi @matjaz.premerl,

it should look like this:

Did you do these steps?

Copy windows_remote to /opt/omd/sites/mysite/local/share/check_mk/alert_handlers

Copy windows_remote_alert_handler.py to /opt/omd/sites/mysite/local/share/check_mk/web/plugins/wato/

Otherwise, you probably will not have it in the drop-down menu.

Regards
Norm

matjaz.premerl · September 15, 2023, 7:35am

Oh, this is really my bad. I don’t know why, but I was expecting those fields even before I copy the files. I will copy the files and then try the functionality.

Thank you.

Regards,
Matjaž

matjaz.premerl · September 15, 2023, 11:14am

Hi Norman,

I’ve managed with the handler. In my simple test scenario I’m able to start the Windows Service, if Checkmk monitor solution put status of service to CRIT as not running.

Regards,
Matjaž

Norm · September 15, 2023, 12:37pm

Hi @matjaz.premerl,

great to hear!

I have a similar setup at a customer running, and it works pretty good.

PS: Maybe mark the first post as a solution to help others in the future.

Regards
Norm

BH2005 · October 4, 2023, 12:36pm

Hi,

what was the command you send to the remote client for that???

Greetz Bernd

matjaz.premerl · October 4, 2023, 12:51pm

Hi,

I’ve tested with Spooler Windows service, so I just put value “net start Spooler” in the configuration option within Agent Handler parameters in “Command to execute”.

Regards,
Matjaž

system · October 3, 2024, 12:51pm

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.