Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows Storage Monitoring Parsing #2665

Closed
BPJOHN1990 opened this issue Dec 6, 2023 · 1 comment
Closed

Windows Storage Monitoring Parsing #2665

BPJOHN1990 opened this issue Dec 6, 2023 · 1 comment

Comments

@BPJOHN1990
Copy link

BPJOHN1990 commented Dec 6, 2023

Hi, I have followed

https://wazuh.com/blog/monitoring-windows-resources-with-performance-counters/ in trying to create counters for my Windows Endpoints, however, I could like to monitor available free space as well.
I have included the below codes into performance_monitor.xml according to the tutorial

<rule id="304000" level="3">
  <if_sid>301000</if_sid>
  <field name="winCounter.Path">\\LogicalDisk(*)\\% Free Space</field>
  <description>Windows Counter: Available Free Space</description>
  <group>STORUsage,</group>
</rule>

<rule id="304001" level="5">
  <if_sid>304000</if_sid>
  <field name="winCounter.CookedValue" type="pcre2">^[0-1]\d.\d+%$</field>
  <description>Windows Counter: Available Disk Space Less Than 20%</description>
  <group>STORUsage,</group>
</rule>

And have added this additional counter from my agent.conf but I am not receiving the alerts, other others such as memory and processor usage are just fine so I am thinking there is something wrong in my performance_monitor.xml. Any help would be greatly appreciated.

<wodle name="command">
    <disabled>no</disabled>
    <tag>STORUsage</tag>
    <command>Powershell -c "@{ winCounter = (Get-Counter '\LogicalDisk(*)\% Free Space').CounterSamples[0] | ConvertTo-Json -compress"</command>
    <interval>15m</interval>
    <ignore_output>no</ignore_output>
    <run_on_start>yes</run_on_start>
    <timeout>0</timeout>
</wodle>
@BPJOHN1990
Copy link
Author

Shifted to Wazuh issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant