Turn off alerting for specific services

[nazka]

Greetings Zabbix user!

I am trying to turn off alerting for the following services,

Problem name: Service "wuauserv" (Windows Update) is not running (startup type automatic)

Problem name: Service "WinHttpAutoProxySvc" (WinHTTP Web Proxy Auto-Discovery Service) is not running (startup type automatic)

I found some posts which describe that I can do it by going into Configuration --> Templates--> Discovery Rules --> Disable Windows Service discovery. We use zabbix for production and we don't want to disable this Service discovery completely. We want to have granular control and shut off alerting only for specific services such as mentioned above and/or alerting for the following checks:

Problem name: Service "RemoteRegistry" (Remote Registry) is not running (startup type automatic
Problem name: Service "sppsvc" (Software Protection) is not running (startup type automatic delayed)


How it can be done easily? Any help would be appreciated!

Thanks,

[m_d_c13]

Hi nazka,
Have you tried to disable the triggers in each host after discovery. Go to Monitoring - Problems and click on the problem name you want to disable. Then "configuration" and uncheck "Enabled"

[tcilmo]

If you have to discover all windows services, you will have to disabled the unwanted triggers on a host level. I would also able disable any unwanted items too to save database space. Another option is to define regular expressions to use along with your windows discover to exclude the unwanted services.

[nazka]

hi tcilmo,

Thanks for your reply, we have over 100 servers configured and doing it at host level is not an option. Do you happen to have regular expressions samples to use ?

[tcilmo]

I am going to base my answer assuming you are using the default Windows service discovery rule and have not changed any of the config.

If you look at the regular expression: Windows service names for discovery (Administration > General > Regular expressions)

You will see an example already. By default the discovery process excludes some services - each service is separated by a "|". You could add additional service names to that string or you can create additional expressions types. You could even create a whole new regular expression rule and tie it back into the discovery rule. To keep things simple, I would create an additional expression in the default "Windows service names for discovery" regular expression to avoid changing the default regular regular expression string.

The Expression type would be: Result is FALSE
The Expression would be: ^(serviceName)$ - for multiple services: ^(serviceName1|serviceName3|serviceName3)$

In other words, you would do this: ^(wuauserv|WinHttpAutoProxySvc)$




Hope this helps - good luck!

[nazka]

Hi tcilmo,

Thanks so much for your reply, it saved tons of time. I was able to use reg expressions and decrease the noise on our alerting side. Since we had lots of servers configured already we cleaned up items from the database. The query is as following if some one else needs in the future:

select * from items where name like '%wuauserv%';
delete from items where name like '%wuauserv%';

[adansbrow]

Hello guys,

Do you know if Wildcards are supported?
Like: ^(wuauserv|WinHttpAutoProxySvc|CDPUserSvc*|OneSync Svc*)$

Thanks!

[surfrock66]

I haven't tested it, but in Regex "." is wildcard, so you would do

^(wuauserv|WinHttpAutoProxySvc|CDPUserSvc.*|OneSyn c Svc.*)$

[zugac]

You could drive the operational status of the zabbix triggers externally, via curl.

It would then be a matter of scripting the functionality you need and integrating it via your change management system.

[SchylgeICT]

Bringing this post back up. I hope you do not mind. I have changed my regexp for discovering windows services. I want to remove the already discoverd sevrices from my hosts. Do i have to do that manually. Or does zabbix support a rediscovery of services. Or does it doe thia automatically, and do I just have to wait for the discovered services that i have added to my regexp to disappear?
Thanks.
Best regards.
Ruud.

[demoss]

I've found that if you actually use the regexp (it's not active by default, you have to turn it on in the Filters page of the discovery rule - put "@Windows service names for discovery" in the Regular expression field; I'm not sure off the top of my head what goes in the Macro field, but it's probably something like $1), it WILL eventually remove the items that are excluded by your regexp. That said, it won't remove them until the "Keep lost resources period" has expired. So keep that value short in your development environment.

[tgif]

May I know how to disable email notifications for the services which have been added under exclude list under Regular Expressions?

[dfisicaro]

I'm Done this on Zabbix 4.0.6 and for some reason the following services are not being ignored:

WindowsRegistry
sspsvc

Even though I created the rule like above to disable the services/not check for them with the Regular Expressions.

[dfisicaro]

I can't get some TRIGGERS to resolve on the SERVICES which are now set to MANUAL and I have added the expressions. Which is frustrating.

The only way it seems to work is by Removing and Re-adding the hosts which get re-added with AUTO-REGISTRATION, im just wondering if the data from the host gets lost if you remove and re-add.

Any suggestions?

[Wolvverine]

look here:

https://www.zabbix.com/forum/zabbix-help/403351-exclude-services-from-automatic-discovery-zabbix-5