[ZBX-22198] Zabbix agent cant call powershell commands since Windows updates Created: 2023 Jan 11  Updated: 2023 Jan 23  Resolved: 2023 Jan 23

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: None
Affects Version/s: None
Fix Version/s: None

Type: Incident report Priority: Trivial
Reporter: Jeroen van der Schaar Assignee: Zabbix Support Team
Resolution: Cannot Reproduce Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Zabbix agents: 6.0.3.2400
Installed on Windows server 2019
Zabbix server: 6.0.12


Issue Links:
Sub-task

 Description   

Steps to reproduce:

  1. This problems exists since installing Windows update KB5021237 (server 2019) and KB5021235(server 2016)
  2. If this update is installed on Windows server 2016/ 2019 the zabbix agent we use (Version 6.0.3.2400) cannot use powershell to get data. The agent gets a timeout while executing the powershell command. The command itself is still usable within powershell locally.
    As soon as KB5021237 is deinstalled the agent recovers itself and it able to use powershell commands again.

This happens with all templates we use that use powershell commands for collecting data. For example WCFS, Windows Certificates Discovery, Template Windows Task Schedule and a couple of self build templates.

Im not sure if the problem is related to Windows or Zabbix Agent.

 

Extended debug logging agent side:

6472:20230111:124751.222 Requested [TaskSchedulerMonitoring[TaskLastResult,Departments Importer]]
 7516:20230111:124751.640 In collect_perfstat()
  6300:20230111:124751.658 Failed to execute command "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\Zabbix Agent\scripts\DiscoverScheduledTasks.ps1" "TaskNextRunTime" "%NAME TASK%"": Timeout while executing a shell script.
  7516:20230111:124751.659 End of collect_perfstat()
  6300:20230111:124751.661 Sending back [ZBX_NOTSUPPORTED: Timeout while executing a shell script.]
  6300:20230111:124751.663 In zbx_tls_accept()
  6300:20230111:124751.674 zbx_psk_server_cb() requested PSK identity "server_name"
  6300:20230111:124751.675 End of zbx_tls_accept():SUCCEED (established TLSv1.3 TLS_CHACHA20_POLY1305_SHA256)
  6300:20230111:124751.676 Requested [TaskSchedulerMonitoring[TaskNextRunTime,%TASK_NAME%)]]

 

 



 Comments   
Comment by Jeroen van der Schaar [ 2023 Jan 12 ]

Today also tested with zabbix agent 6.2.6, the issue remains the same. We can also confirm that other tools used in our organization that also use powershell in this way still work. Problem seems to be originating in the zabbix agent.

Comment by Edgar Akhmetshin [ 2023 Jan 19 ]

Hello

I've tried to create same setup example with Server 2019 + KB included (17763.3887) and Agent 6.0.12, but just used random script with 'Get-NetIPAddress | Format-Table' inside, since i don't know what is done inside yours.

C:\Program Files\Zabbix Agent>zabbix_get.exe -s 127.0.0.1 -k system.run["powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Program Files\Zabbix Agent\scripts\DiscoverScheduledTasks.ps1\""]

ifIndex IPAddress                                       PrefixLength PrefixOrigin SuffixOrigin AddressState PolicyStore
------- ---------                                       ------------ ------------ ------------ ------------ -----------
4       fe80::117d:8446:dbd5:d9fa%4                               64 WellKnown    Link         Preferred    ActiveStore
1       ::1                                                      128 WellKnown    WellKnown    Preferred    ActiveStore
4       192.168.13.85                                             24 Dhcp         Dhcp         Preferred    ActiveStore
1       127.0.0.1                                                  8 WellKnown    WellKnown    Preferred    ActiveStore

Not able to reproduce the issue.

Looks like execution time of the scripts you are using is changed and this scripts are not able to execute in time after the KB mentioned.

Could you check how much time required for the scripts to be executed and check Timeout options set inside Agent configuration file.

Regards,
Edgar

Generated at Wed Apr 30 06:50:03 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.