Agent2 Systemd Template Name Regex/Format?

[erasedhammer]

I've been switching all my old agents over to the new agent2, and the systemd keys work pretty well. So I decided to try and change the agent side systemd monitoring script to this new system.

Debian 11
zabbix_agent2 5.4.12
Zabbix Server 6.0.3

Using the following (seems official?) template:
https://git.zabbix.com/projects/ZBX/...temd/README.md

It works when I dont add any macros to a host, it comes back with every service on the box.

The problem is when I add the macro {$SYSTEMD.NAME.SERVICE.MATCHES} and try and use ANY value, suddenly the discovery item just doesn't do anything (no errors).
This leads me to believe that the format of this text is very specific, and to my surprise the README on the template says nothing about the format!

I've tried the following formats for the Macro {$SYSTEMD.NAME.SERVICE.MATCHES}
sshd.*,rsyslog.*
sshd.service,rsyslog.service
sshd.service
sshd|rsyslog
sshd.service rsyslog.service
sshd.service|rsyslog.service
sshd* rsyslog*

None of those came back with anything (no errors).

What the heck do I put in that text field to get it to filter??
Does this template just not support multiple service whitelist???

[erasedhammer]

Taking a look at the template, it appears that the Service Discovery rule is pulling the entire value from the user defined macro to search for on the system.
The problem is I don't see any way for the discovery rule to delimit the user macro into separated services. So that template appears that it can only handle whitelist/blacklist based on a single service (what a blunder!).

Just thinking out loud here...
I cant use a preprocessing filter for the item prototypes as that only applies to the data returned...
The filter rules on the discovery rule look like this:
{#UNIT.NAME} matches {$SYSTEMD.NAME.SERVICE.MATCHES}
It seems like it would be nice for zabbix to have a "contains" action here, not sure on that one. But the matches action certainly doesn't try to match on any value on there, and is just a dumb "move this value to this field in the item key" type of action.

Continuing with my thought to paper rant

Just found this page:

https://www.zabbix.com/documentation/current/en/manual/discovery/low_level_discovery/examples/systemd

The original template definitely does the discovery (although for some reason doesn't have any LLD rules in the discovery rule).
That may be the problem. But I think this all comes back to not knowing what format the filter for the macro is supposed to be in. I've probably tried dozens of different formats for listing specific services I want, but with no luck.

I am at the very bleeding edge of my own understanding of all this. I could really use some help here.

[erasedhammer]

I have solved the filter problem!
It turns out one of the formats I tried was the correct one, but the zabbix agent2 doesnt allow systemd unit alias's ("systemctl status sshd" is the same as "systemctl status ssh")

The correct filter for the {$SYSTEMD.NAME.SERVICE.MATCHES} macro: ssh.service|rsyslog.service

[bilal]

To monitor only special services with Systemd, I used the following: The Macro of the relevant host is {$SYSTEMD.NAME.SERVICE.MATCHES} and the corresponding value is: ^(mariadb|nginx|fail2ban|php8.3-fpm|ssh)\. service$.
Of course, you can change the service names according to your own situation.