Exclude filesystem by mount name from discovery

[jahlives]

Hi

first of all I googled a lot (literally hours) and found many descriptions which indicate that it should work. No matter what I try on our Zabbix Server I cannot achieve to filter out some FS based on mountpoint name.

In the template under discovery rules I chose the rule "mounted filesystem discovery" and under filter add my regex so that the result looks like

{#FSNAME} does not match ^(/usr|/usr/local/sepp)$
{#FSTYPE} matches @File systems for discovery
Type of calculation: A and B

But the filtered FS still show up in result. I ensured that the rule's key is vfs.fs.discovery (therefore the LLD macros ex {#FSNAME} should be available). But I also tried key vfs.fs.get and created the LLD macros manually like this "{#FSNAME} $.fsname" and "{#FSTYPE} $.fstype"
Makes no difference: the filtered FS still shows up in results. I also tried it with the global regex feature in zabbix but this as well does not work in my case

But from what I read here in forum and in other pages related to this it should be possible. Using "zabbix_server (Zabbix) 5.4.4" on a Debian 11 if that is important. The agent where I get the result from is running "zabbix_agentd (daemon) (Zabbix) 5.0.8" also on Debian 11

Any idea what I'm doing wrong? Or does it just not work?

Thank you && Cheers

tobi

[tim.mooney]

What you're trying should definitely be possible. It's almost directly out of the example from the LLD docs.

The examples in the LLD docs don't capture the match using parens (although that should work, and I've seen it used in some regexes elsewhere in Zabbix). Instead, they anchor each possible match. In other words, this:

^/usr$|^/usr/local/sepp$

Does it make a difference if you try that?

I guess another thing I always recommend, when there's a weird "why isn't this working?!" issue, is to make sure you're using a recent version of the software. Does it make a difference if you update the agent to the latest version in the 5.0 series (something like 5.0.14 or 5.0.15, I haven't checked in a while so I'm not sure what latest 5.0.x is)? I don't expect this to make a difference, but in a lot of cases it's an easy thing to rule out.

If those two things don't do it, I would probably use the "--runtime-control" option with your Zabbix server and then increase the logging for, the "discoverer", "lld manager", and (probably most importantly) "lld worker". See the man page for the "zabbix_server" for more information on increasing (at runtime) logging for just those subsystems. It may also help to enable debug logging on one of the agents you're going to discover too, to see if the agent logs anything interesting, but I think the stuff you're going to want to look at will be on the server.

Once you've increased logging for just those components, either delete one of your existing discovered clients or do something to cause Zabbix to discover a new host with one or both of those mounts. Hopefully there will be enough info in the logs to see why your exclusion isn't working.

[jahlives]

Once you've increased logging for just those components, either delete one of your existing discovered clients or do something to cause Zabbix to discover a new host with one or both of those mounts. Hopefully there will be enough info in the logs to see why your exclusion isn't working.

That gave me the right way :-) Not the debug but your remark about deleting an existing host. I actually only disabled/enabled the client to test if regex works. You made me remove the template from host, waiting a couple of seconds and re-add it again (discovery rule is on 60s refresh for this test) --> regex works :-) Thank you so much for your help

Have a good one

tobi