This solution is based on zabbix 2.0 api and LLD which is only available in zabbix 2.0
The template included uses active checks. Your zabbix agent must be configured for active checks otherwise the server won't receive any data..
Description
This solutions allows you to monitor status for services. No more manual creation of items for each service that you think is important, this template auto discovers all services that are set to start automatically and monitors their status.
All services set to "manual" or "disabled" are excluded from discovery and are not monitored.
If a service that is set to "automatic" is stopped and set to "disabled", you still get service status down alerts until the LLD item is deleted (1 day).
Usage
Download the archive, extract the XML template, import it into the frontend and link the hosts to it.
Copy the vbs scripts to your zabbix agent folder and configure the following lines in your zabbix_agentd.conf file, replacing the path in the UserParameter with your zabbix agent installation path, restart the agent.
You also get monitoring for eventlog entries generated by service start errors or service unexpectedly terminated errors.
Gotchas
A few services that start and immediately stop are excluded from discovery by hard-coding in the discovery script:
A few services that have different names on Windows 2003 and Windows 2008 are detected and have their names (actually displayNames) unified by hard-coding in the script, to make them sit on the same row in zabbix overview:
If you are using any other of my templates, make sure your hosts only have one active instance of the WIN Eventlog OOP item. If there is more than one, disable the extra items.
The eventlog triggers send an alert containing information on the most recent events logged. For these to show up in the alert make sure you include the following macros in the alert message:
Eventlog info: {ITEM.LASTVALUE}
If you have any issues importing this template, please upgrade to zabbix 2.0.2 (not released at the date of this post) and php 5.3 or higher.
Update 1
I can confirm that importing templates with Discovery Rules is broken in zabbix 2.0.1 and will be fixed in zabbix 2.0.2.
A partial fix for this, until zabbix 2.0.2 is released, can be achieved by SSH to your zabbix server and making the following changes to these files:
This will fix importing Discovery rules, item prototypes and trigger prototypes. Graph prototypes importing will still be broken, as they will get imported directly into the template, not in the discovery rules.
Update 2
Decreased eventlog query time to 300s.
Update 3
Added exceptions for Windows Module Installer and Shell Hardware Detection services.
Added exception for _all_ NET Framework Optimization services, no matter the version.
Exceptions are now implemented as an array of regex strings for easier editing in the script (edit zabbix_win_system_discovery.vbs, search for "GET SERVICES").
The template included uses active checks. Your zabbix agent must be configured for active checks otherwise the server won't receive any data..
Description
This solutions allows you to monitor status for services. No more manual creation of items for each service that you think is important, this template auto discovers all services that are set to start automatically and monitors their status.
All services set to "manual" or "disabled" are excluded from discovery and are not monitored.
If a service that is set to "automatic" is stopped and set to "disabled", you still get service status down alerts until the LLD item is deleted (1 day).
Usage
Download the archive, extract the XML template, import it into the frontend and link the hosts to it.
Copy the vbs scripts to your zabbix agent folder and configure the following lines in your zabbix_agentd.conf file, replacing the path in the UserParameter with your zabbix agent installation path, restart the agent.
Code:
#system discovery UserParameter = system.discovery[*],cscript "C:\Program Files\Zabbix agent\zabbix_win_system_discovery.vbs" //Nologo "$1" #eventlog query UserParameter = eventlog.query[*],cscript "C:\Program Files\Zabbix agent\zabbix_win_eventlog.vbs" //Nologo "$1" "$2" # allow weird chars in userparameters arguments UnsafeUserParameters=1
Gotchas
A few services that start and immediately stop are excluded from discovery by hard-coding in the discovery script:
- Performance Logs and Alerts (2003) (Sysmonlog)
- Windows Licensing Monitoring Service
- Software Protection
- NET Frametwork Optimization (clr_optimization.*)
- SQL Agent (SQLAgent)
- Windows Module Installer (TrustedInstaller)
- Shell Hardware Detection (ShellHWDetection)
A few services that have different names on Windows 2003 and Windows 2008 are detected and have their names (actually displayNames) unified by hard-coding in the script, to make them sit on the same row in zabbix overview:
- Application Experience Lookup Service (AeLookupSvc)
- Event Log/Windows Event Log (eventlog)
- HID Input Service/Human Interface Device Access (HidServ)
- Net Logon (netlogon)
- IPsec Policy Agent/IPSEC Services (PolicyAgent)
- System Event Notification Service (SENS)
- Windows Firewall/Internet Connection Sharing (ICS) (SharedAccess)
- Remote Desktop Services/Terminal Services (TermService)
- Virtual Disk Service (vds)
- Automatic Updates/Windows Updates (wuauserv)
If you are using any other of my templates, make sure your hosts only have one active instance of the WIN Eventlog OOP item. If there is more than one, disable the extra items.
The eventlog triggers send an alert containing information on the most recent events logged. For these to show up in the alert make sure you include the following macros in the alert message:
Eventlog info: {ITEM.LASTVALUE}
If you have any issues importing this template, please upgrade to zabbix 2.0.2 (not released at the date of this post) and php 5.3 or higher.
Update 1
I can confirm that importing templates with Discovery Rules is broken in zabbix 2.0.1 and will be fixed in zabbix 2.0.2.
A partial fix for this, until zabbix 2.0.2 is released, can be achieved by SSH to your zabbix server and making the following changes to these files:
- Edit /var/www/html/include/classes/import/formatters/C20ImportFormatter.php
- Search for getDiscoveryRules function
- Modify the line:
- if (!empty[$host['discovery_rules'])) {
- with:
- if (!empty[$template['discovery_rules'])) {
This will fix importing Discovery rules, item prototypes and trigger prototypes. Graph prototypes importing will still be broken, as they will get imported directly into the template, not in the discovery rules.
Update 2
Decreased eventlog query time to 300s.
Update 3
Added exceptions for Windows Module Installer and Shell Hardware Detection services.
Added exception for _all_ NET Framework Optimization services, no matter the version.
Exceptions are now implemented as an array of regex strings for easier editing in the script (edit zabbix_win_system_discovery.vbs, search for "GET SERVICES").

Comment