Exclude "Disk xx" and filesystems "C:\Users*" from discovery and monitoring

[goran.q]

Hi,

This is my first post here, so hi to entire Zabbix community. Zabbix is great monitoring tool and I use it alot.

Among others, I monitor some Windows RDP servers with Zabbix.
RDP server uses "User Profile Disks" to store user profiles on it. Those are basically virtual (vhdx) disks which are connected to server, same as physical disks.
Since there is some big number of those disks I would like to exclude them from discovery and monitoring.

Physical disk names are discovered as "Disk xx".
Filesystem names are discovered as "C:\Users\username"

My idea:
I cloned default "Template Module Windows filesystems by Zabbix agent active" and "Template Module Windows physical disks by Zabbix agent active" into new templates and attend to use new (cloned) templates to test.
Idea is to edit macros in new templates, but I am not sure how?

I guess, it would be possible to add regex to exclude:

"Disk xx" (xx is number, so I would like to exclude all disks with number higher than 2, so basically 3-999).
Filesystem "C:\Users\*"

but I am not sure how.

Here are macros I would like to adjust:

Template Module Windows physical disks by Zabbix agent active - {$VFS.DEV.DEVNAME.NOT_MATCHES}
Current value: _Total

Template Module Windows filesystems by Zabbix agent active - {$VFS.FS.FSNAME.NOT_MATCHES}
Current value: ^(/dev|/sys|/run|/proc|.+/shm$)

If someone can assist, I would appreciate any advice.
If there is some other, better way to accomplish my goal, please advise.

Thank you
Goran

[ISiroshtan]

Hi there.

You can try testing the following:

{$VFS.DEV.DEVNAME.NOT_MATCHES} - (_Total|Disk ([^12]$|[0-9]{2,}))
Should match any one digit disk that is not 1 or 2, and any 2 digit(or more) disk + keep preexisting condition for disks that have _Total in them.

{$VFS.FS.FSNAME.NOT_MATCHES} - ^(/dev|/sys|/run|/proc|.+/shm$|C:\\Users\\)
Should preserve pre-existing condition + match FS with C:\Users\ in it

Bit not sure about {$VFS.FS.FSNAME.NOT_MATCHES}, specifically: if we need to escape \ with another \ (if it should be C:\\Users\\ or C:\Users\) but would still go with double \ as 1st test..

[goran.q]

Hi,

thank you for reply.

{$VFS.FS.FSNAME.NOT_MATCHES} - ^(/dev|/sys|/run|/proc|.+/shm$|C:\\Users\\) - works with double backslashes
{$VFS.DEV.DEVNAME.NOT_MATCHES} - (_Total|Disk ([^12]$|[0-9]{2,})) - in general works, but I had to remove "Disk" from regex and I had some problems with showing disk when it have drive letter after drive number (when I put it like this: (_Total|([^012]$|[0-9]{2,}))) - drive "0 C::" would not be discovered . I ended with discovery only system disk (0) with MATCHES macro like this:
{$VFS.DEV.DEVNAME.MATCHES} - ^0.*

This discovers disk 0 and ignores all filesystems containing "C:\Users\*" which is OK for me.

Thank you again
Goran

[gabriele.daltoe]

Hi goran,
I have same issue with remote desktop session host with profile disk: I use this MACRO: {$VFS.DEV.DEVNAME.MATCHES} - \d [a-zA-Z]:
In this case drive "0 C::" or drive "1 D::" can be discovered

Bye

[rhartmann]

Hi,
i tried both version:
{$VFS.DEV.DEVNAME.MATCHES} - \d [a-zA-Z]:
{$VFS.DEV.DEVNAME.MATCHES} - ^0.*

but it doesn't work. Do I have to set the filter and if so, how?

Robert

[rhartmann]

ok. it was my bad. i use the wrong template