Extending service.discovery on for adding perf_counter item prototypes

[Daniel4711]

Hello everyone,

In addition to the status of a service, you often want to know how much CPU and RAM a service requires.
For example, we had a service that gradually took up more RAM and then stopped working - even though the process was still active.

Previously, I used a manual template for this - which was quite unwieldy to use if I wanted to monitor several services on one system.

During a consulting session, the supporter (thanks to Mr. Matzek from Intellitrend.de) came up with the idea that the service.discovery could be extended.
The idea here was that a preprocessing step could be added to Windows Service Discovery.

This could add a {#SERVICE.BINARY} to the JSON Output - Inclund the program name without .exe.

A Javascript was created here which I had ChatGPT (I can't do Javascript) adapt again today.
The background was that a Trendmicro service contained several .exe files in the SERVICE.PATH.

try {
    var services = JSON.parse(value); // 'value' is the input from the preprocessing step

    for (var i = 0; i < services.length; i++) {
        var path = services[i]['{#SERVICE.PATH}'].replace(/\"/g, ''); // Remove double quotes from the path
        var regex = /([^\\ ]+)\.exe/; // Extracts the first .exe file in the path without the extension
        var match = regex.exec(path);

        if (match && match[1]) {
            services[i]['{#SERVICE.BINARY}'] = match[1]; // Adds the binary name without .exe extension
        } else {
            services[i]['{#SERVICE.BINARY}'] = 'Unknown'; // Fallback if no suitable name is found
        }
    }

    return JSON.stringify(services, null, 4); // Returns the modified JSON
} catch (e) {
    return 'Error parsing JSON: ' + e.message + '\nInput: ' + value; // Error handling for invalid JSON with debugging information
}

The discovery result with Javascript preprocessing adds the SERVICE.BINARY and returns the following result:

   {
        "{#SERVICE.NAME}": "Trend Micro Service xyz",
        "{#SERVICE.DISPLAYNAME}": "Trend Micro Service - was created manual for testing - I forgot the real description",
        "{#SERVICE.DESCRIPTION}": "",
        "{#SERVICE.STATE}": 6,
        "{#SERVICE.STATENAME}": "stopped",
        "{#SERVICE.PATH}": "\"C:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe\" coreFrameworkHost.exe -m=nb -dt=180000 -ad -bt=0",
        "{#SERVICE.USER}": "LocalSystem",
        "{#SERVICE.STARTUPTRIGGER}": 0,
        "{#SERVICE.STARTUP}": 2,
        "{#SERVICE.STARTUPNAME}": "manual",
        "{#SERVICE.BINARY}": "coreServiceShell"
    }​

This #SERVICE.BINARY entry can be used to create perf_counter item prototypes.
These counters require the name of the program name.exe without .exe


Now you only have to enter the {$SERVICE.NAME.MATCHES} for each host (or assigned template). macro to monitor the necessary services.
Incidentally, I do not find the default value of the macro useful and replace it directly with a dummy value at the beginning.
Who wants to monitor all services?

[PeterZielony]

Nice one !

similarly, you can get a perf counter using proc.get:

https://www.zabbix.com/documentation/current/en/manual/appendix/items/proc_get#windows

proc.get as master item and proc.get that points at exe file to get more info from a process

{#SERVICE.PATH} comes from original template


there are macro functions too (regex) if you want to extract value from macro (either LLD or HOST macros) which makes it a bit easier than writing js

https://www.zabbix.com/documentation/current/en/manual/config/macros/macro_functions

[Daniel4711]

That also looks very interesting.
I didn't know proc.get yet.

I will have a look at it!

Thank you very much!

[markfree]

Really nice addition to the service discovery. This should be added to the default "OOTB" template.
Thank you.