Ad Widget

Collapse

Host services monitoring LLD

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • mmarkwitzz
    Senior Member
    • Jan 2011
    • 106

    #1

    Host services monitoring LLD

    This solution is based on zabbix 2.0 api and LLD which is only available in zabbix 2.0

    The template included uses active checks. Your zabbix agent must be configured for active checks otherwise the server won't receive any data..

    Description

    This solutions allows you to monitor status for services. No more manual creation of items for each service that you think is important, this template auto discovers all services that are set to start automatically and monitors their status.
    All services set to "manual" or "disabled" are excluded from discovery and are not monitored.
    If a service that is set to "automatic" is stopped and set to "disabled", you still get service status down alerts until the LLD item is deleted (1 day).

    Usage

    Download the archive, extract the XML template, import it into the frontend and link the hosts to it.

    Copy the vbs scripts to your zabbix agent folder and configure the following lines in your zabbix_agentd.conf file, replacing the path in the UserParameter with your zabbix agent installation path, restart the agent.

    Code:
    #system discovery
    UserParameter = system.discovery[*],cscript "C:\Program Files\Zabbix agent\zabbix_win_system_discovery.vbs" //Nologo "$1"
    #eventlog query
    UserParameter = eventlog.query[*],cscript "C:\Program Files\Zabbix agent\zabbix_win_eventlog.vbs" //Nologo "$1" "$2"
    # allow weird chars in userparameters arguments
    UnsafeUserParameters=1
    You also get monitoring for eventlog entries generated by service start errors or service unexpectedly terminated errors.

    Gotchas

    A few services that start and immediately stop are excluded from discovery by hard-coding in the discovery script:
    • Performance Logs and Alerts (2003) (Sysmonlog)
    • Windows Licensing Monitoring Service
    • Software Protection
    • NET Frametwork Optimization (clr_optimization.*)
    • SQL Agent (SQLAgent)
    • Windows Module Installer (TrustedInstaller)
    • Shell Hardware Detection (ShellHWDetection)


    A few services that have different names on Windows 2003 and Windows 2008 are detected and have their names (actually displayNames) unified by hard-coding in the script, to make them sit on the same row in zabbix overview:
    • Application Experience Lookup Service (AeLookupSvc)
    • Event Log/Windows Event Log (eventlog)
    • HID Input Service/Human Interface Device Access (HidServ)
    • Net Logon (netlogon)
    • IPsec Policy Agent/IPSEC Services (PolicyAgent)
    • System Event Notification Service (SENS)
    • Windows Firewall/Internet Connection Sharing (ICS) (SharedAccess)
    • Remote Desktop Services/Terminal Services (TermService)
    • Virtual Disk Service (vds)
    • Automatic Updates/Windows Updates (wuauserv)



    If you are using any other of my templates, make sure your hosts only have one active instance of the WIN Eventlog OOP item. If there is more than one, disable the extra items.
    The eventlog triggers send an alert containing information on the most recent events logged. For these to show up in the alert make sure you include the following macros in the alert message:

    Eventlog info: {ITEM.LASTVALUE}

    If you have any issues importing this template, please upgrade to zabbix 2.0.2 (not released at the date of this post) and php 5.3 or higher.

    Update 1

    I can confirm that importing templates with Discovery Rules is broken in zabbix 2.0.1 and will be fixed in zabbix 2.0.2.
    A partial fix for this, until zabbix 2.0.2 is released, can be achieved by SSH to your zabbix server and making the following changes to these files:
    • Edit /var/www/html/include/classes/import/formatters/C20ImportFormatter.php
    • Search for getDiscoveryRules function
    • Modify the line:
    • if (!empty[$host['discovery_rules'])) {
    • with:
    • if (!empty[$template['discovery_rules'])) {


    This will fix importing Discovery rules, item prototypes and trigger prototypes. Graph prototypes importing will still be broken, as they will get imported directly into the template, not in the discovery rules.

    Update 2

    Decreased eventlog query time to 300s.

    Update 3

    Added exceptions for Windows Module Installer and Shell Hardware Detection services.
    Added exception for _all_ NET Framework Optimization services, no matter the version.
    Exceptions are now implemented as an array of regex strings for easier editing in the script (edit zabbix_win_system_discovery.vbs, search for "GET SERVICES").
    Attached Files
    Last edited by mmarkwitzz; 11-07-2012, 09:15.
  • tchjts1
    Senior Member
    • May 2008
    • 1605

    #2
    having difficulty importing this template, even with the temporary fix in place for the import. Starting at line #302 in the template... looks kind of funky. is this an embedded table in the template? The import error shows this for details:

    Created: Item "WIN Eventlog service terminated unexpectedly" on "Template_WIN_Services".
    Created: Item "Win System status nodata" on "Template_WIN_Services".
    Created: Item "WIN System uptime sec" on "Template_WIN_Services".
    Incorrect trigger expression. Host "WIN Services" does not exist or you have no access to this host.

    Code:
                                <name>WIN Service &quot;{#SVCDISPNAME}&quot; status down</name>
                                <url/>
                                <status>0</status>
                                <priority>5</priority>
                                <description>Service &lt;b&gt;&quot;{#SVCDISPNAME} ({#SVCNAME})&quot;&lt;/b&gt; on host has been &lt;b&gt;down&lt;/b&gt; for up to &lt;b&gt;5 minutes&lt;/b&gt;.&lt;br&gt;
    &lt;br&gt;
    &lt;table&gt;
    &lt;thead&gt;
    	&lt;tr&gt;
    		&lt;th&gt;Value&lt;/th&gt;
    		&lt;th&gt;Meaning&lt;/th&gt;		
    	&lt;/tr&gt;	
    &lt;/thead&gt;
    	&lt;tr&gt;
    		&lt;td&gt;0&lt;/td&gt;
    		&lt;td&gt;Running&lt;/td&gt;		
    	&lt;/tr&gt;	
    	&lt;tr&gt;
    		&lt;td&gt;1&lt;/td&gt;
    		&lt;td&gt;Paused&lt;/td&gt;		
    	&lt;/tr&gt;		
    	&lt;tr&gt;
    		&lt;td&gt;2&lt;/td&gt;
    		&lt;td&gt;Start pending&lt;/td&gt;		
    	&lt;/tr&gt;			
    	&lt;tr&gt;
    		&lt;td&gt;3&lt;/td&gt;
    		&lt;td&gt;Pause pending&lt;/td&gt;		
    	&lt;/tr&gt;				
    	&lt;tr&gt;
    		&lt;td&gt;4&lt;/td&gt;
    		&lt;td&gt;Continue pending&lt;/td&gt;		
    	&lt;/tr&gt;	
    	&lt;tr&gt;
    		&lt;td&gt;5&lt;/td&gt;
    		&lt;td&gt;Stop pending&lt;/td&gt;		
    	&lt;/tr&gt;		
    	&lt;tr&gt;
    		&lt;td&gt;6&lt;/td&gt;
    		&lt;td&gt;Stopped&lt;/td&gt;		
    	&lt;/tr&gt;		
    	&lt;tr&gt;
    		&lt;td&gt;7&lt;/td&gt;
    		&lt;td&gt;Unknown&lt;/td&gt;		
    	&lt;/tr&gt;		
    	&lt;tr&gt;
    		&lt;td&gt;255&lt;/td&gt;
    		&lt;td&gt;Service not found&lt;/td&gt;		
    	&lt;/tr&gt;													
    &lt;/table&gt;</description>
                                <type>0</type>
                            </trigger_prototype>
                        </trigger_prototypes>
                        <graph_prototypes/>
                    </discovery_rule>
                </discovery_rules>
    Last edited by tchjts1; 10-07-2012, 18:32.

    Comment

    • mmarkwitzz
      Senior Member
      • Jan 2011
      • 106

      #3
      That's not funkyness
      The trigger description is in html and what you see in the template is the way xml escapes html tags.

      Zabbix 2.0.0 and php 5.1.6 has some problems importing these. Works with zabbix 2.0.1 and php 5.3 and the import fix in the top post.

      Edit: re-tested with 2.0.1/5.3 and works ok. What is your configuration?

      Edit: the html should look something like this in your alert email (the top half, the values table is implemented in all my alerts). you can see the {#SVCDISPNAME} and {#SVCNAME} LLD macros. these are included in the hopes that one day zabbix will translate them to actual values or someone will figure out a hack for this..

      Last edited by mmarkwitzz; 10-07-2012, 18:51.

      Comment

      • tchjts1
        Senior Member
        • May 2008
        • 1605

        #4
        Originally posted by mmarkwitzz
        Edit: re-tested with 2.0.1/5.3 and works ok. What is your configuration?
        PHP 5.3.3
        Zabbix 2.01

        Comment

        • mmarkwitzz
          Senior Member
          • Jan 2011
          • 106

          #5
          Redownload, delete the template in zabbix (if exists) and import. I just downloaded and tested the import with the same config and it works.

          Edit: Re-uploaded, re-tested, everything works ok.
          Last edited by mmarkwitzz; 11-07-2012, 09:19.

          Comment

          • emmanux
            Member
            Zabbix Certified Specialist
            • Mar 2013
            • 47

            #6
            Too complicated, from my point of view.
            This simpler method could be improved to achieve that complexity level:

            Comment

            Working...