search

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
Apache License 2.0
852 stars 173 forks source link

Request: Reporting in Zabbix #281

Open rvtkruys-valtech opened 2 years ago

rvtkruys-valtech commented 2 years ago

Don't know, if this is logical. But, could it be possible to provide some guidelines on how to integrate this into Zabbix? Or does any one already managed to do this?

with regards, Roland

xeraph commented 2 years ago

If anyone can contribute zabbix code, I will provide the Logpresso Watch REST API for integration.

rvtkruys-valtech commented 2 years ago

Ok, this is the config for the zabbix_agentd.conf file: UserParameter=log4j2.scan,C:\Tools\log4j2-scan.exe --scan-log4j1 --scan-logback --exclude "C:\Users\<user.name>\Onedrive" --drives c,d --report-json --no-empty-report

Manual: Extending Zabbix agents

For testing you can run it using the following command: zabbix_agentd -t log4j2.scan -c "C:\Program Files\Zabbix Agent\zabbix_agentd.conf"

But it result in an error message: _Timeout while executing a shell script. [m|ZBXNOTSUPPORTED] [Timeout while executing a shell script.] I have increased the timeout on both server and client and have it set on 30 seconds. Maybe a bit much, but we are testing.