How to disable alert on certain services in zabbix 5.0

[jolalla]

Hello everybody,

I have zabbix 5.0 installed on centos 7. I would like to know how I can disable some alerts that do not seem useful to me, for example alerts like:


"BITS" (Background Intelligent Transfer Service) is not running (startup type automatic delayed)

"Retrospect Helper" (Retrospect Helper) is not running (startup type automatic)

"WAPCUpdaterSvc" (Microsoft AAD Application Proxy Connector Updater) is not running (startup type automatic delayed)

"WAPCSvc" (Microsoft AAD Application Proxy Connector) is not running (startup type automatic delayed)


I would like to disable all these alerts on all my windows servers. Is there a quick or easy way to disable them all?
I am monitoring only windows servers and the templates that I am using for it are these two:

Template OS Windows by Zabbix agent
Template Module ICMP Ping

I am not an expert in linux or zabbix, I am in the process of learning. Thank you very much for your help.

[Markku]

Hi, please check this: https://git.zabbix.com/projects/ZBX/...Frelease%2F5.0

There are the {$SERVICE.xxxx} macros that can be used for matching the service names with regular expressions.

Markku

[jolalla]

Thanks for answering Markku now I have to see how those changes are made there. Because the truth is I am not an expert in linux or zabbix. Not as easy as enabling or disabling something? is that I'm not very good with lines of code : (

[jolalla]

For example now I have these alerts on my board. I would like to disable those that I highlight in yellow. the template to which the VMs are associated is Windows OS by Zabbix Agent.
I went to that template and I see that it has other associated templates, which of those should I disable to remove those alerts? or should I do something else?

Thanks

[Markku]

Please see this existing post: https://www.zabbix.com/forum/zabbix-...ar-expressions

Markku

[jolalla]

Hello Markku

I really went and saw the post you indicate but I'm not very good with this about linux or expressions, I don't understand much, sorry.
For example, here I annex where I could get the discovery rules by seeing the post that you indicated, but I don't know how to eliminate or deactivate those alerts from here.

For example if I want to remove this alert:


"BITS" (Background Intelligent Transfer Service) is not running (startup type automatic delayed)

"Retrospect Helper" (Retrospect Helper) is not running (startup type automatic)


What would be the procedure to follow? how should I do it. And excuse my lack of knowledge but I am new to Linux and also to zabbix. Maybe already learning how to exclude that pair of alerts I can do the others


Thanks again

[Markku]

On your host configuration, create a macro {$SERVICE.NAME.NOT_MATCHES} with value ^(BITS|Retrospect Helper)$

That will exclude those services in the discovery.

Note that if/when those services have been discovered already, they are maybe not removed immediately, so go to the items and delete them manually.

Markku

[jolalla]

Thank you Markku very much for your help! it worked perfect for me!
You could help me with the following, I get many alerts like this:

Problem started at 09:40:29 on 2021.06.24 Problem name: Zabbix agent is not available (for 3m)

I would like to know how to make sure that this check is not done every 3 min, I would like it to be done every 10 min so that I don't get alerts so often.
How can I do it?

Thank you very much for your help

[Markku]

See the trigger configuration, there is most probably some macro name that is used in the trigger expression. Copy the macro name, you can then go to the host (or template) configuration and add/edit the macro with whatever value you like, like 10m.

Markku

[jolalla]

Thanks Markku I'm using the windows template for the zabbix agent and I got to the associated templates section and there I found the section for the zabbix agent module, but I don't see that there are macros created there.
How can I create it? or what should I modify? so that this check-up is done every 10 min instead of every 3 min
Here I attach the image.
Thank you.

[Markku]

So there is your macro (in the screenshot), just modify 3m -> 10m. That will then affect all hosts that are using this template.

If you only want to modify the behaviour in specific hosts, then go to the host configuration and add the same macro there, it will then override the template-level value.

Markku

[jolalla]

Thank you Markku I'm sorry. I'm a fool. I hadn't seen it.

I have this alert:

C :: Disk space is critically low (used> 90%)

and I would like you not to warn me so often so that those notifications to the telegram do not reach me so often. Can the time that the disk check is done be extended? so you don't do the disk check so often. Get to this template that I attach in the image in the macro section, I don't know if there should be any changes to extend that period of time.