"VeeamVssSupport" (VeeamVssSupport) is not running

[eglyn]

Hello !

I have this warning message since today, from a Windows 2019 Server where I monitor Windows services: "VeeamVssSupport" (VeeamVssSupport) is not running
And it is very weird because there is no Veeam service on this VM, neither Veeam software installed ^^'

Where Zabbix check Windows Service ? How it can see a service that does not exist ?

Thx !

[cyber]

Has that software ever been on that host? Maybe it has been discovered and not yet removed after software removal (should have yellow ! behind such items)
And lets not forget changed IP-s. Maybe data comes in from some other host, which now has the IP of this host? I have had this in several cases...

[eglyn]

Host has always same IP. But, we use Veeam Backup for Vsphere, wich seems setup a service on VMs wich is deleted after backup (I contacted Veeam support).
But, now, there is no Veeam Service, and Zabbix keep seeing a Veeam service :/ Where does Zabbix look to find services ?

[Spoon]

To perform guest processing tasks, Veeam Backup & Replication does not deploy persistent agents inside VMs. Instead, it uses non-persistent services which are deployed on every VM added to the job when the job starts and removed as soon as the job finishes. It helps avoid agent-related drawbacks such as pre-installing, troubleshooting and updating.
VeeamVssSupport Service installing every time a backup runs - Veeam R&D Forums

The service is not always present with Veeam - it is added on the fly each time

[[email protected]]

And how to disable this trigger in zabbix add some exception? I have many hosts whose backups go through veeam and every time every day after the backup I get this message. And I can't turn it off because it is part of Windows services discovery - Windows by Zabbix agent active- "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running if I turn it off it will refer to all monitored services in Windows and I don't want that

[SkilledAlpaca]

And how to disable this trigger in zabbix add some exception? I have many hosts whose backups go through veeam and every time every day after the backup I get this message. And I can't turn it off because it is part of Windows services discovery - Windows by Zabbix agent active- "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running if I turn it off it will refer to all monitored services in Windows and I don't want that

So I ran into this issue with my primary Veeam Backup and Replication server nightly as well. I was also running into an issue with the ephemeral Windows "Clipboard User Service" doing the same thing. The "cbdhsvc_322a90ea0" (Clipboard User Service_322a90ea0) alerts. As the value after the underscore is randomly generated.

I ended up finding that you can update the regex under General > Regular expressions > Windows service names for discovery. I ended up adding in the following parameters to fix the clipboard and Veeam services, shown below. I tested the below regex using https://regex101.com/ to make sure it wouldn't break anything else and it seems to be working fine after several days.

^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.50727_32|clr_optimization_v4.0.30319_32|cbdhsvc_.{0,}|VeeamVssSupport)$

Note, this won't remove any active alerts or currently discovered services. Once they alert, you will need to delete the item and then it will no longer be queried after that. Anything put in the regex will be excluded from discovery and data collection I've observed.

[SkilledAlpaca]

As crox mentioned below, you also need to modify the below Macro and add the excluded services.

Data Collection > Templates > Windows by Zabbix agent > Macros > {$SERVICE.NAME.NOT_MATCHES}

[HendrixJax]

Could there be any external factors or configurations within the Windows 2019 Server itself that might be generating the false warning message about the "VeeamVssSupport" service, even though Veeam software is not installed and there are no third-party monitoring tools interacting with the Zabbix monitoring system?

[crox]

And how to disable this trigger in zabbix add some exception? I have many hosts whose backups go through veeam and every time every day after the backup I get this message. And I can't turn it off because it is part of Windows services discovery - Windows by Zabbix agent active- "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running if I turn it off it will refer to all monitored services in Windows and I don't want that

You can modify the Macro of the template {$SERVICE.NAME.NOT_MATCHES} and add the VeeamVssSupport, delete the actual item and trigger that the discovery created and when zabbix will start the new discovery, the service will not be added again