windows services monitoring with zabbix 2.x

[753713]

Hi all,

please test the services.exe with this command:
zabbix_agentd.exe -c "c:\Program Files\Zabbix Agent\zabbix_agentd.conf" -t "system.run[c:\Zabbix\Services.exe]"

and please vote for the feature request to exclude items in LLD.

https://support.zabbix.com/browse/ZBXNEXT-581

[storm]

Here is the output.

system.run[c:\Zabbix\Services.exe] [m|ZBX_NOTSUPPORTED]

What does that mean and what do I do now?

Mike

[heaje]

For those of you having troubles with the system.run[] key - remember that Zabbix does not support items with that key unless you enable Remote Commands in the zabbix_agentd.conf file. See these two pages in the documentation:

1. Search for "EnableRemoteCommands"

2. Search for "system.run"

[753713]

please run:
C:\ZABBIX>Services.exe > services.txt
and can you please post the output from the file services.txt

[storm]

I have enabled remote commands.
Im not getting any errors but no data either.
Under "Monitoring=>Latest Data" I go to the item "Windows Services" and "Last Value" reads "No such service (255)". It seems to be updating, "Last Check" stays current.

Also, I have attached services.txt, the output from "C:\ZABBIX>Services.exe > services.txt".

Mike

[753713]

Hi,

you must have 134 services on this host, please check this in -> hosts -> items

753713

[storm]

I only have 1 item related to the discovery.
Or, am I misunderstanding?

[753713]

Hi,

have you created the template in configuration ->templates -> your template in items or discovery?

[storm]

No, I created the item by going to Hosts => <serverName> => Items => Create items.

Was that the wrong place?

[753713]

yes, this is wrong.
please create a rule(step2) and in the rule please create the item (step 3)

[storm]

OK, I tried to do it thru a template.
The discovery rule seems right but I could not edit a couple of things when creating the item.
1. Host (grayed out)
2. Applications (none to choose from)

I must be really off track somewhere. Can you see anything?

[JPtheGeezer]

Hey guys, sorry to hijack this thread, I have successfully got Service Discovery working and it has found ALL services on my servers.

I noticed that there wasn't any mention of a trigger protocol and since I want to be alerted if a service stops I decided to build my own trigger protocol:

Expression: {Template_Windows_Baseline:service_state[{#FSSERVICE}].last(0)}#0

It seems that there are a couple of issues here:

1. I get a lot of alerts now telling me that services have stopped on each server, and I mean A LOT.

2. Services that are manual or disabled are alerted on.

3. Services that are actually started are being alerted as stopped.

So, is there a way to fine tune this Service Discovery so that it:

a) Stops alerting for services that are not supposed to be started;
b) Stops alerting for services that are in fact started (false positive instances)

Other than this I am very impressed with the Service Discovery and it has done alot of tedious work for me, I just need the process to monitor the services I only want monitored.

Thanks.

[skarllot]

Hey guys, sorry to hijack this thread, I have successfully got Service Discovery working and it has found ALL services on my servers.

I noticed that there wasn't any mention of a trigger protocol and since I want to be alerted if a service stops I decided to build my own trigger protocol:

Expression: {Template_Windows_Baseline:service_state[{#FSSERVICE}].last(0)}#0

It seems that there are a couple of issues here:

1. I get a lot of alerts now telling me that services have stopped on each server, and I mean A LOT.

2. Services that are manual or disabled are alerted on.

3. Services that are actually started are being alerted as stopped.

So, is there a way to fine tune this Service Discovery so that it:

a) Stops alerting for services that are not supposed to be started;
b) Stops alerting for services that are in fact started (false positive instances)

Other than this I am very impressed with the Service Discovery and it has done alot of tedious work for me, I just need the process to monitor the services I only want monitored.

Thanks.

You have two options:
- Discovery only auto start services (eg: zbxlld).
- Write a conditional trigger (eg: servicename.start=1 && service.status).

[syndeysider]

heads up

Just a heads up for anyone reading this. I find that stopping the zabbix agent causes orphaned Services.exe processes which lock TCP 10050 on the host. I have to manually RDP into the affected machine. Kill Services.exe and than restart the Agent.

300+ Windows Servers... not fun.

Looking into zbxlld

[753713]

please check your Virus scanner