Windows services monitoring - multiple severities

[rsterenb]

We're using Zabbix 4.2.2.

In LLD I can discover Windows services using the service.discovery key. With that I can create an item prototype and a trigger prototype, and assign a severity to the trigger.
The item stores the state of a discovered service as an int, and no issues so far.

However, there are a couple of in-house developed services that are included in this discovery, but should have a higher trigger severity level.

- I tried to use regular expressions to filter the discovered services and have 2 different LLD rules for average and high severity, but that of course doesn't work because I cannot reuse service.discovery for the 2nd discovery rule.

- I was hoping to use a regexp match on the {#SERVICE.NAME} macro like this:
{Template OS Windows:service.info[{#SERVICE.NAME},state].min(#3)}<>0
and
{#SERVICE.NAME}.iregexp("^svc_name") = 0
This would have been my preferred solution, but it seems it's something that can't be done as it won't save.

- I wrote a service discovery script that can include/exclude services based on name and so can be used with multiple LLD rules, but maybe this is sub-optimal.

So.. What is the best way to do this?

[ITOMDave]

Hi, Did you ever get a solution to this question - I'm facing the exact same problem.

[Hamardaban]

I cannot reuse service.discovery for the 2nd discovery rule.

You can - use ALIAS parameter of agent https://www.zabbix.com/documentation...abbix_agentd?s[]=alias

[rsterenb]

We've never used the solution from Hamardaban, but reading the docs it seems like that would have done the trick.

[Semiadmin]

There is maybe a better trick in v5.0 - LLD overrides.

[ITOMDave]

As Semiadmin says, LLD overrides are a great feature in Zabbix 5 and address exactly this challenge.