Windows 모니터링 agent 설치(zabbix+sysmon+winlogbeat)

개요

---

기본적인 Windows 모니터링 도구인 zabbix agent와 시스템 로그 수집을 위한 sysmon + winlogbeat agent를 설치한다.

윈도우 로그 수집은 "Windows + Sysmon + Winlogbeat + Logstash" 를 참조하면 된다.

• winlogbeat-7.15.1
• zabbix_agent2-5.0.15

 

 

 

설치

---

zabbix_agent.conf 수정

• zabbix_agent2, zabbix_agent 중 원하는 agent를 설치하면 된다.
• zabbix_agent2.conf를 설치 예정이며 간단하게 zabbix server, hostname, Logfile 부분을 수정한다.

> zabbix_agent2.conf
...
LogFile=c:\montools\zabbix_agent2-5.0.15\zabbix_agent2.log
...
Server=<zabbix_server_ip>
...
ServerActive=<zabbix_server_ip>
...
HostnameItem=system.hostname
...

• 추가 적으로 윈도우 netstat socket 상태정보를 수집하는 UserParameter를 추가 하였다.

> zabbix_agent2.conf
...
UserParameter=sockstat.sockets, netstat -ano | find /V "hola" /C
UserParameter=sockstat.tcp.inuse, netstat -ano | findstr ESTABLISHED
UserParameter=sockstat.tcp.inuse.count, netstat -ano | find /C "ESTABLISHED"
UserParameter=sockstat.tcp.orphan, netstat -ano | findstr CLOSE_WAIT
UserParameter=sockstat.tcp.orphan.count, netstat -ano | find /C "CLOSE_WAIT"
UserParameter=sockstat.tcp.timewait, netstat -ano | findstr TIME_WAIT
UserParameter=sockstat.tcp.timewait.count, netstat -ano | find /C "TIME_WAIT"
UserParameter=sockstat.tcp.allocated, netstat -ano | findstr LISTENING
UserParameter=sockstat.tcp.allocated.count, netstat -ano | find /C "LISTENING"
UserParameter=sockstat.udp.inuse, netstat -ano | findstr UDP
UserParameter=sockstat.udp.inuse.count, netstat -ano | find /C "UDP"

 

 

winlogbeat.yml 수정

• winlogbeat.event_logs, logstash output 부분을 수정한다.

> winlogbeat.yml
...
winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security

  - name: ForwardedEvents
    tags: [forwarded]

  - name: Windows PowerShell
    event_id: 400, 403, 600, 800

  - name: Microsoft-Windows-PowerShell/Operational
    event_id: 4103, 4104, 4105, 4106

  - name: Microsoft-Windows-Sysmon/Operational
...
# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["<logstash_ip>:5044"]
...

 

 

agent 복사

• "montools" 디렉토리를 c: 에 복사한다.

montools.vol1.egg

10.00MB

montools.vol2.egg

7.76MB

 

 

설치 bat 파일 실행

• install.bat 파일을 관리자 권한으로 실행한다

> install.bat
@echo off

c:\montools\zabbix_agent2-5.0.15\zabbix_agent2.exe -i -c c:\montools\zabbix_agent2-5.0.15\zabbix_agent2.conf
net stop "Zabbix Agent 2"
net start "Zabbix Agent 2"

c:\montools\Sysmon\Sysmon64.exe -accepteula -i C:\montools\Sysmon\sysmonconfig-export.xml -l -n
net stop "Sysmon64"
net start "Sysmon64"

Powershell.exe -noprofile -executionpolicy bypass -file "c:\montools\winlogbeat-7.15.1\install-service-winlogbeat.ps1"

Powershell.exe -noprofile -executionpolicy bypass -command "Stop-Service winlogbeat"
Powershell.exe -noprofile -executionpolicy bypass -command "Start-Service winlogbeat"
pause