No data timeout for active agents. Consider to keep it relatively high.

Timeout after which agent is considered unavailable.

The critical threshold of the CPU utilization expressed in %.

The critical threshold of the % Interrupt Time counter.

The threshold of the % Privileged Time counter.

The threshold of the Processor Queue Length counter.

The warning threshold of the Memory util item.

The warning threshold of the minimum free swap.

The warning threshold of the Free System Page Table Entries counter.

The warning threshold of the Memory Pages/sec counter.

Macro for the filesystem space triggers. Can be used with the filesystem name as context.

The warning threshold of the filesystem utilization.

The critical threshold of the filesystem utilization.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

The warning threshold of disk time utilization in percent.

Disk read average response time (in s) before the trigger fires.

Disk write average response time (in s) before the trigger fires.

Used in physical disk discovery. Can be overridden on the host or linked template level.

Used in physical disk discovery. Can be overridden on the host or linked template level.

Macro for the interface operational state for the "link down" trigger. Can be used with interface name as context.

Used as a threshold in the interface utilization trigger.

Warning threshold of error packet rate. Can be used with interface name as context.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery to list the services that must not be running. Can be overridden on the host or linked template level.

The grace period after a system boot during which the service state is not checked. Can be used with the service name as context.

Used in Windows scheduled tasks discovery. Can be overridden on the host or linked template level.

Used in Windows scheduled tasks discovery. Can be overridden on the host or linked template level.

Used in Windows scheduled tasks discovery. Can be overridden on the host or linked template level.

Used in Windows scheduled tasks discovery. Can be overridden on the host or linked template level.

Macro for the scheduled task state trigger. Can be used with the task name as context.

Set to "1" to suppress the "SecureBoot is disabled" trigger on hosts that legitimately run without UEFI Secure Boot (e.g. legacy BIOS/CSM).

The minimum remaining Windows activation grace period before the trigger fires.

The maximum age of Microsoft Defender signatures before the trigger fires.

The maximum age of the last Microsoft Defender full scan before the trigger fires.

The maximum number of days since the last installed update (KB) before the trigger fires.

The maximum number of days since the last installed security update (KB) before the trigger fires.

Filter for the Windows Firewall profiles to discover, by profile name.

Used in Windows Firewall profiles discovery. Can be overridden on the host or linked template level.

Filter for the volumes to discover for BitLocker, by drive letter (e.g. "C:").

Used in BitLocker volume discovery. Can be overridden on the host or linked template level.

Volumes (by drive letter, e.g. "C:") on which BitLocker is enforced. The "BitLocker is not enabled" trigger fires only for matching volumes.

Availability of active checks on the host. The value of this item corresponds to availability icons in the host list.

Possible values:

0 - unknown

1 - available

2 - not available

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is sustained, there may be a processor bottleneck or an application or hardware related issue that can significantly diminish overall system performance.

The processor information % Interrupt Time counter indicates how much time the processor spends handling hardware interrupts during sample intervals. It reflects the activity of devices like the system clock, mouse, disk drivers, and network cards. A value above 20% suggests possible hardware issues.

The processor information % Privileged Time counter shows the percent of time that the processor is spent executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode functions of the Windows Operating System.

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue and are waiting to be executed.

The processor information % User Time counter shows the percent of time that the processor(s) is spent executing in User mode.

CPU utilization expressed in %.

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes, Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average.

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

Preprocessing

• JavaScript: return (100 - value)

This indicates the number of page table entries not currently in use by the system. If the number is less than 5,000, there may be a memory leak or you running out of memory.

Preprocessing

• Discard unchanged with heartbeat: 1d

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays.

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). Consequently, Event ID 2019 is recorded in the system event log.

Memory utilization in %.

The number of logical processors available on the computer.

Preprocessing

• Regular expression: (\d+) \1

  ⛔️Custom on fail: Discard value

The number of processes.

The number of threads used by all running processes.

Preprocessing

• Discard unchanged with heartbeat: 1d

The architecture of the operating system.

Preprocessing

• Discard unchanged with heartbeat: 1d

System description of the host.

Preprocessing

• Discard unchanged with heartbeat: 1d

The local system time of the host.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

Total memory expressed in bytes.

The total space of the swap volume/file expressed in bytes.

The system uptime expressed in the following format: "N days, hh:mm:ss".

Used memory in bytes.

The used space of swap volume/file in percent.

Preprocessing

• Discard unchanged with heartbeat: 1d

Raw data of win32_networkadapter.

Preprocessing

• Discard unchanged with heartbeat: 1h

The agent always returns "1" for this item. May be used in combination with nodata() for the availability check.

Raw TPM (Trusted Platform Module) data from the Win32_Tpm WMI class.

The classic Windows agent does not invoke WMI methods, so the current state is read from the *_InitialValue properties captured at the most recent provisioning/clear event; on a stable system this matches the actual state.

Preprocessing

• Discard unchanged with heartbeat: 1d

Whether a TPM chip is present on the host (derived from the number of Win32_Tpm instances returned by the master item).

Preprocessing

• JavaScript: The text is too long. Please see the template.

Whether the TPM is enabled (from IsEnabled_InitialValue).

Preprocessing

• JSON Path: $[0].IsEnabled_InitialValue

  ⛔️Custom on fail: Set value to: False

• Boolean to decimal

Whether the TPM is activated (from IsActivated_InitialValue).

Preprocessing

• JSON Path: $[0].IsActivated_InitialValue

  ⛔️Custom on fail: Set value to: False

• Boolean to decimal

Whether the TPM is owned (from IsOwned_InitialValue).

Preprocessing

• JSON Path: $[0].IsOwned_InitialValue

  ⛔️Custom on fail: Set value to: False

• Boolean to decimal

The TPM specification version (the leading part of SpecVersion, e.g. "2.0").

Preprocessing

• JavaScript: The text is too long. Please see the template.

The TPM firmware (manufacturer) version (from ManufacturerVersion).

Preprocessing

• JSON Path: $[0].ManufacturerVersion

  ⛔️Custom on fail: Set value to: ``

The UEFI Secure Boot state (0 - disabled, 1 - enabled).

On legacy BIOS/CSM hosts the registry key does not exist and the item becomes NOTSUPPORTED; set {$WINDOWS.SECURITY.SECUREBOOT.IGNORE}=1 on such hosts.

Raw Windows licensing product data from the SoftwareLicensingProduct WMI class (filtered to the active Windows OS product).

Preprocessing

• Discard unchanged with heartbeat: 1d

Raw Windows licensing service data from the SoftwareLicensingService WMI class (KMS configuration).

Preprocessing

• Discard unchanged with heartbeat: 1d

The Windows license status (0 - Unlicensed, 1 - Licensed, 2 - OOB grace, 3 - OOT grace, 4 - Non-genuine grace, 5 - Notification, 6 - Extended grace).

Preprocessing

• JSON Path: $[0].LicenseStatus

  ⛔️Custom on fail: Set value to: 0

The time remaining in the current licensing grace period.

Preprocessing

• JSON Path: $[0].GracePeriodRemaining

  ⛔️Custom on fail: Set value to: 0

• Custom multiplier: 60

The licensed product name (from Name).

Preprocessing

• JSON Path: $[0].Name

  ⛔️Custom on fail: Set value to: ``

The last five characters of the installed product key (from PartialProductKey).

Preprocessing

• JSON Path: $[0].PartialProductKey

  ⛔️Custom on fail: Set value to: ``

The licensing status reason code (from LicenseStatusReason).

Preprocessing

• JSON Path: $[0].LicenseStatusReason

  ⛔️Custom on fail: Set value to: 0

The Key Management Service (KMS) host name used for activation (from KeyManagementServiceMachine).

Preprocessing

• JSON Path: $[0].KeyManagementServiceMachine

  ⛔️Custom on fail: Set value to: ``

The Key Management Service (KMS) port (from KeyManagementServicePort).

Preprocessing

• JSON Path: $[0].KeyManagementServicePort

  ⛔️Custom on fail: Set value to: 0

The KMS client machine identifier (from ClientMachineID).

Preprocessing

• JSON Path: $[0].ClientMachineID

  ⛔️Custom on fail: Set value to: ``

Whether this machine is a KMS host (from IsKeyManagementServiceMachine).

Preprocessing

• JSON Path: $[0].IsKeyManagementServiceMachine

  ⛔️Custom on fail: Set value to: 0

Raw Microsoft Defender antimalware status from the MSFT_MpComputerStatus WMI class.

Preprocessing

• Discard unchanged with heartbeat: 1d

Whether the Defender antimalware service is running (from AMServiceEnabled).

Preprocessing

• JSON Path: $[0].AMServiceEnabled

  ⛔️Custom on fail: Set value to: False

• Boolean to decimal

Whether real-time protection is enabled (from RealTimeProtectionEnabled).

Preprocessing

• JSON Path: $[0].RealTimeProtectionEnabled

  ⛔️Custom on fail: Set value to: False

• Boolean to decimal

Whether antivirus protection is enabled (from AntivirusEnabled).

Preprocessing

• JSON Path: $[0].AntivirusEnabled

  ⛔️Custom on fail: Set value to: False

• Boolean to decimal

Whether antispyware protection is enabled (from AntispywareEnabled).

Preprocessing

• JSON Path: $[0].AntispywareEnabled

  ⛔️Custom on fail: Set value to: False

• Boolean to decimal

Time since the antivirus signatures were last updated.

Preprocessing

• JavaScript: The text is too long. Please see the template.

Time since the antispyware signatures were last updated.

Preprocessing

• JavaScript: The text is too long. Please see the template.

Time since the last quick scan. Reads as "Never scanned" if no quick scan has ever run.

Preprocessing

• JavaScript: The text is too long. Please see the template.

Time since the last full scan. Reads as "Never scanned" if no full scan has ever run.

Preprocessing

• JavaScript: The text is too long. Please see the template.

The antivirus signature package version (from AntivirusSignatureVersion).

Preprocessing

• JSON Path: $[0].AntivirusSignatureVersion

  ⛔️Custom on fail: Set value to: ``

Raw list of installed Windows updates (hotfixes) from the Win32_QuickFixEngineering WMI class.

Preprocessing

• Discard unchanged with heartbeat: 1d

The total number of installed updates (KBs).

Preprocessing

• JavaScript: The text is too long. Please see the template.

The number of installed updates whose description is "Security Update".

Preprocessing

• JavaScript: The text is too long. Please see the template.

The HotFixID of the most recently installed update.

Preprocessing

• JavaScript: The text is too long. Please see the template.

The install date of the most recently installed update.

Preprocessing

• JavaScript: The text is too long. Please see the template.

The number of whole days since the most recently installed update.

Preprocessing

• JavaScript: The text is too long. Please see the template.

The install date of the most recently installed "Security Update".

Preprocessing

• JavaScript: The text is too long. Please see the template.

The number of whole days since the most recently installed "Security Update".

Preprocessing

• JavaScript: The text is too long. Please see the template.

Raw Windows Firewall profile data from the MSFT_NetFirewallProfile WMI class.

Preprocessing

• Discard unchanged with heartbeat: 1d

Raw BitLocker volume data from the Win32_EncryptableVolume WMI class.

Preprocessing

• Check for not supported value: any error

  ⛔️Custom on fail: Set value to: []

• Discard unchanged with heartbeat: 1d

Raw Windows scheduled task data from the MSFT_ScheduledTask WMI class.

Preprocessing

• Check for not supported value: any error

  ⛔️Custom on fail: Set value to: []

• Discard unchanged with heartbeat: 1d

Active checks are considered unavailable. Agent has not sent a heartbeat for a prolonged time.

The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%.

• Windows: High CPU utilization

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

• Windows: CPU interrupt time is too high
• Windows: High CPU utilization

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.

• Windows: High CPU utilization

CPU utilization is too high. The system might be slow to respond.

Memory\Free System Page Table Entries has been less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may be a memory leak.

• Windows: High memory utilization

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

• Windows: High memory utilization

The system is running out of free memory.

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually.

• Windows: System name has changed

The name of the system has changed. Acknowledge to close the problem manually.

This trigger is ignored, if there is no swap configured

• Windows: High memory utilization

The device uptime is less than 10 minutes.

For active agents, nodata() with agent.ping is used with {$AGENT.NODATA_TIMEOUT} as a time threshold.

No TPM chip was detected on the host. A TPM is required for some security features (BitLocker, virtualization-based security, Windows 11 readiness).

UEFI Secure Boot is disabled. It helps prevent malicious software from loading during the boot process. If this host legitimately runs without Secure Boot (e.g. legacy BIOS/CSM), set {$WINDOWS.SECURITY.SECUREBOOT.IGNORE}=1.

The Windows license status is not "Licensed". The system may be unlicensed, in a grace period, or in notification mode.

The Windows activation grace period is about to expire. Activate Windows before the grace period ends.

Microsoft Defender real-time protection is disabled. The system is not actively protected against malware.

The Microsoft Defender antivirus signatures have not been updated within the expected interval.

A full Microsoft Defender scan has not been completed within the expected interval.

No Windows update (KB) has been installed within the configured number of days.

No Windows security update (KB) has been installed within the configured number of days.

Discovery of Windows scheduled tasks. No task is discovered until {$WINDOWS.TASK.NAME.MATCHES} is set, because a stock Windows installation carries about 200 tasks.

On hosts where the Task Scheduler WMI namespace is unavailable the master item returns an empty list, so no items are created instead of becoming unsupported.

Preprocessing

• Discard unchanged with heartbeat: 1h

The current state of the "{#TASK.NAME}" scheduled task.

Preprocessing

• JSON Path: $[?(@.URI == "{#TASK.URI}")].State.first()

  ⛔️Custom on fail: Set value to: 0

• Discard unchanged with heartbeat: 1d

The "{#TASK.NAME}" scheduled task is disabled and will not run.

Discovery of Windows Firewall profiles.

Preprocessing

• Discard unchanged with heartbeat: 1h

Whether the "{#FW.PROFILE}" firewall profile is enabled.

Preprocessing

• JSON Path: $[?(@.Name == "{#FW.PROFILE}")].Enabled.first()

  ⛔️Custom on fail: Set value to: 0

The default inbound action of the "{#FW.PROFILE}" firewall profile.

Preprocessing

• JSON Path: $[?(@.Name == "{#FW.PROFILE}")].DefaultInboundAction.first()

  ⛔️Custom on fail: Set value to: 0

The default outbound action of the "{#FW.PROFILE}" firewall profile.

Preprocessing

• JSON Path: The text is too long. Please see the template.

  ⛔️Custom on fail: Set value to: 0

The "{#FW.PROFILE}" Windows Firewall profile is not enabled.

Discovery of filesystems of different types.

Preprocessing

• Discard unchanged with heartbeat: 6h

The vfs.fs.get[full,{#FSNAME}] key acquires disk space and inode statistics for the {#FSNAME} filesystem only. Later to be extracted by preprocessing in dependent items.

Preprocessing

• JSON Path: $[0]

Available storage space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.free

Total space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.total

Used storage expressed in bytes.

Preprocessing

• JSON Path: $.bytes.used

Calculated as the percentage of currently used space compared to the maximum available space.

Preprocessing

• JSON Path: $.bytes.pused

Calculated as the percentage of currently available space compared to the maximum available space.

Preprocessing

• JSON Path: $.bytes.pfree

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}% limit.

The trigger expression is based on the current used and maximum available spaces.

Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}% limit.

The trigger expression is based on the current used and maximum available spaces.

Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

• Windows: FS [{#FSLABEL}({#FSNAME})]: Space is critically low

Discovery of BitLocker encryptable volumes. On hosts where BitLocker is unavailable it returns no volumes, so the per-volume items are not created instead of becoming unsupported.

Preprocessing

• Discard unchanged with heartbeat: 1h

The BitLocker protection status of volume "{#FSNAME}".

Preprocessing

• JSON Path: $[?(@.DriveLetter == "{#FSNAME}")].ProtectionStatus.first()

  ⛔️Custom on fail: Set value to: 2

The BitLocker encryption method of volume "{#FSNAME}".

Preprocessing

• JSON Path: $[?(@.DriveLetter == "{#FSNAME}")].EncryptionMethod.first()

  ⛔️Custom on fail: Set value to: 0

The BitLocker conversion (encryption/decryption progress) status of volume "{#FSNAME}".

Preprocessing

• JSON Path: $[?(@.DriveLetter == "{#FSNAME}")].ConversionStatus.first()

  ⛔️Custom on fail: Set value to: 0

BitLocker protection is not enabled on volume "{#FSNAME}", which is required by {$WINDOWS.SECURITY.BITLOCKER.ENFORCE.MATCHES}.

Discovery of installed network interfaces.

Preprocessing

• Discard unchanged with heartbeat: 1h

Incoming traffic on the network interface.

Preprocessing

• Change per second:

• Custom multiplier: 8

Outgoing traffic on the network interface.

Preprocessing

• Change per second:

• Custom multiplier: 8

The number of incoming packets dropped on the network interface.

Preprocessing

• Change per second:

The number of incoming packets with errors on the network interface.

Preprocessing

• Change per second:

The type of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()

• Discard unchanged with heartbeat: 1d

The operational status of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()

• Discard unchanged with heartbeat: 1d

The number of outgoing packets dropped on the network interface.

Preprocessing

• Change per second:

The number of outgoing packets with errors on the network interface.

Preprocessing

• Change per second:

Estimated bandwidth of the network interface if any.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].Speed.first()

  ⛔️Custom on fail: Set value to: 0

• JavaScript: return (value=='9223372036854775807' ? 0 : value)

• Discard unchanged with heartbeat: 1h

The utilization of the network interface is close to its estimated maximum bandwidth.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:

1. It can be triggered if the operations status is down.

2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine the context macro to "0", marking this interface as not important.

No new trigger will be fired if this interface is down.

3. last(/TEMPLATE_NAME/METRIC,#1)<>last(/TEMPLATE_NAME/METRIC,#2) - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for "eternal off" interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

Discovery of installed physical disks.

Preprocessing

• Replace: {#INSTANCE} -> {#DEVNAME}

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

Rate of read operations on the disk.

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

Preprocessing

• JavaScript: return (100 - value)

Rate of write operations on the disk.

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

This trigger might indicate the disk {#DEVNAME} saturation.

The disk appears to be under heavy load.

• Windows: {#DEVNAME}: Disk read request responses are too high
• Windows: {#DEVNAME}: Disk write request responses are too high

This trigger might indicate the disk {#DEVNAME} saturation.

Used for the discovery of Windows services of different types as defined in the template's macros.

Services matching {$SERVICE.FORBIDDEN.MATCHES} are discovered regardless of their startup type, so that a service which must stay stopped can be watched as well.

{#SERVICE.DESCRIPTION}

The service has a state other than "Running" for the last three times.

The check is suppressed until the system uptime exceeds {$SERVICE.STARTUP.GRACE}, so that services with the "automatic delayed" startup type are given time to start after a reboot.

The service matches {$SERVICE.FORBIDDEN.MATCHES} and is expected to stay stopped, but it has been running for the last three times.

The trigger is discovered only for the services listed in that macro.