Trigger condition

[dickinson]

Hi zabbix masters,

I'm struggling on find a solution for this, which seems simple but Im stuck :-(

A created a trigger which rises when a new service is installed on Windows Server machines, which works like a charm. Now I want that IF the service which was installed or created is called or starts with "MpKs" does nothing or even no notification be sent.

This because everytime Windows Defender updates, it created a so-called service called MpKsXXXXX (ramdom XXXX) so I dont want to be notified about this.

What'd be the best way to achieve it?

Appreciate your help

Eduardo from Colombia

[dickinson]

Team, appreciate your help :-)

[dickinson]

Dear splitek thanks for your replay. I have followed your 1st option, but no matter what I put the trigger still reports. I added this in the macro of the services template:

MpKs.*|MpKs*$|MpKs*

What other wildcards can I use here?

Thinking on your second option, I created a trigger which notifies when any services were created on the servers (based on the expression {Template OS Windows by Zabbix agent:eventlog[System,,"Information",,7045,,skip].logeventid()}=1). If I add the tag as
you recommended, wouldnt that affect all the other services as well?

Thanks in advance.

Eduardo

[dickinson]

splitek dont know exactly why, but the first solution doesn work for me, even I tested the expression and seems to work, but the trigger still reports this dammed service :-)

I followed the second option, and it somehow works, I dont receive notificacions, but the alerts still appear on the dashboard. I dont wanna bother you with this matter, so if you have any
final idea I'll be greatly thankful.

Eduardo