Official templates and regular expressions

[zabbix_woc]

Hi all,

Have been experimenting with Zabbix (appliance ISO build, 4.4.4) over the last few months, and over that time have added multiple hosts, items, triggers etc, as well as used the included templates.

At some point during the build, we had an issue with templates - to resolve, we removed all currently loaded templates and then re-imported only the required "official" templates (along with any dependent / linked templates).

I have noticed a number of undesired services being monitored on our Windows hosts, using only the "Template OS Windows by Zabbix agent" template.

The Zabbix agent (version 4.4.4) is installed on these hosts, and I have only applied the mentioned template to them.

From what I know, I should be able to use Regular Expressions to exclude certain services from discovery - which I have done - but after deleting the items / triggers etc for the undesired services on these hosts, they return on the next discovery.

From my investigations, it appears that the "Template OS Windows by Zabbix agent" doesn't use Regular Expressions - could this be possible? This is the "Filters" section of the Windows Service discovery rule within the mentioned template:




How can I resolve this so I can exclude certain services from discovery on our Windows hosts?

Thanks in advance!

[zabbix_woc]

Notes on the template would seem to confirm the above:

https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/windows_agent

All help appreciated - thanks in advance!

[Markku]

Hi, from the screenshot above, and from the notes/instructions you linked, there already is the regexp support: just define the SERVICE.STARTUPNAME.XXX macros with the regexps as you wish, in the host level.

I think this is very flexible way of configuring those includes/excludes: the template provides some (hopefully sane) default values for the macros, and then you can define/override them at the host level as you wish.

For example, if you only want to include services containing string "Zabbix", then define the macro "{$SERVICE.STARTUPNAME.MATCHES} = Zabbix" in the host level.

Markku

[zabbix_woc]

Thanks Markku - I think from that I am now on the right track.

want to exclude services from ALL hosts that this template applies to, so I have found what I believe to be the settings to allow this.

"Template OS Windows by Zabbix agent" has a linked template called "Template Module Windows services by Zabbix agent" - within this, on the Macros tab, I have the "{$SERVICE.NAME.NOT_MATCHES}" macro - on this, I have added the undesired services, and deleted the previously discovered services, and this seems to have worked. The undesired services are no longer being discovered.

Is this the correct approach? I also note that there is a character limit on the field of {$SERVICE.NAME.NOT_MATCHES}. Should I be doing this elsewhere?

I am very much a Linux newbie, so any guidance on this would be appreciated!

[guilly]

I'm having similar issues although on version 4.0.17. I've attempted to do the following

• Administration --> General --> Regular Expressions
  • Expression type: Result is FALSE
  • Expression ^(RemoteRegistry|gupdate)$
• Added a new filter to Windows service discovery
  • {#SERIVCE.name} macthes @name of new expression

Linked Template OS Windows to my Host

Unfortunately the services are still being discovered. I've found several sources stating this is the accepted method but maybe I'm missing something ? Does the Template OS Windows in 4.0.17 not accept regex either ? I don't recall seeing this in the documentation anywhere.

[guilly]

Looks like I resolved the issue by cloning the default Template OS Windows and modifying the Discovery rules of the cloned template to include my custom regex. I guess the default 'Template OS Windows' template doesn't respect the regex filter.

[Markku]

Is this the correct approach? I also note that there is a character limit on the field of {$SERVICE.NAME.NOT_MATCHES}. Should I be doing this elsewhere?

I am very much a Linux newbie, so any guidance on this would be appreciated!

That is the correct approach, and if you reach the field limit, try to optimize your string somehow to match with fewer characters.

Markku

[zabbix_woc]

That is the correct approach, and if you reach the field limit, try to optimize your string somehow to match with fewer characters.

Markku

Thanks Markku,much appreciated

[Arcom]

I've been struggling with this myself for a couple of days on our new Zabbix environment running v.4.4.7. I modified the Global RegEx Windows service names for discovery, but until I read this post, I didn't realize it wasn't being used by the template.
After checking the <host> - Macros - Inherited and host macros, I discovered it only uses the following macro's from the Template Module Windows services by Zabbix agent in regards to service discoveries:

• {$SERVICE.NAME.MATCHES}
• {$SERVICE.NAME.NOT_MATCHES}
• {$SERVICE.STARTUPNAME.MATCHES}
• {$SERVICE.STARTUPNAME.NOT_MATCHES}

So I suppose if I add the regex in the template for {$SERVICE.NAME.NOT_MATCHES}, it should work. However I then have to add the same regular expression to the Template Module Windows services by Zabbix agent active, when using active checks. So a Global regex would make more sense.

[havoc2k10]

Is this the part that should put the windows services' reg exp to remove it from the alerts? From the box i highlighted should i add |Bits|OneSyncSvc_|TrustedInstaller. I would appreciate if can help with to filter out unwanted alerts from windows services.

[havoc2k10]

Thanks Markku - I think from that I am now on the right track.

want to exclude services from ALL hosts that this template applies to, so I have found what I believe to be the settings to allow this.

"Template OS Windows by Zabbix agent" has a linked template called "Template Module Windows services by Zabbix agent" - within this, on the Macros tab, I have the "{$SERVICE.NAME.NOT_MATCHES}" macro - on this, I have added the undesired services, and deleted the previously discovered services, and this seems to have worked. The undesired services are no longer being discovered.

Is this the correct approach? I also note that there is a character limit on the field of {$SERVICE.NAME.NOT_MATCHES}. Should I be doing this elsewhere?

I am very much a Linux newbie, so any guidance on this would be appreciated!

This also didnt worked for me. I added the "TrustedInstaller" but still alerting. How do i delete discovered services? Please see image.

[Markku]

This also didnt worked for me. I added the "TrustedInstaller" but still alerting. How do i delete discovered services? Please see image.

If you already had them discovered, go to the Items in the affected hosts and delete the unwanted items.

Markku

[chrisme]

Is the regular expression method for windows services deprecated?
The new 5.0 template "Template Module Windows services by Zabbix agent active" uses the macro method, the old "Template OS Windows" template uses the regular expression method.
Can i build a new 5.0 template with regular expression?

Chris

edit:
i have change the filter on the discovery rule and now it works again with regular expression.