Zabbix: Running Powershell scripts on hosts with system.run

This post will give you information on how to easily run complicated and long Powershell scripts with Zabbix without using any escape characters.

Table of Contents

This is the most painless way to run Powershell scripts on Zabbix Agents

So you want to garter some information on your Windows hosts, that the Zabbix agent does not support or you just want to manipulate the data being returned. Time for Powershell.

You can use system.run or User parameters to execute commands via the Zabbix agent.
They are almost the same thing.

I like system.run, because with system.run you manage the commands/script in the Zabbix GUI. Where as with User parameters you control it on the host itself.

It can be a little bit tiring working with Powershell and Zabbix, because you have to use escape characters in the Item key. But i got a trick so that we can avoid that.

Setting up the Item

The trick for avoiding escape characters is to convert your Powershell script into a base64 dump, which you then supply in the item key.

$myScriptPath = ".\testScript.ps1"
$getContent = Get-Content $myScriptPath
$base64 = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($getContent))
write-host $base64

Then you take that base64 output and input it in your item key like shown below.

system.run[powershell.exe -noprofile -nologo -encodedCommand "paste base64 output in here"]

Allow the key

Add the item key to the configuration file on all the hosts that the item will be added to.

You can allow all keys in the configuration file via AllowKey=system.run[*], however that is not recommended.

Every time i add a new item or make changes to an item with system.run, i have to make changes in the configuration file on all the hosts, that’s just how it is due to security.

Result

It works!

Decoding the script

If you ever need to decode the script, then go to base64decode.org and choose UTF-16LE as source character set.

Comments

Leave a Reply

Your email address will not be published.