Help Expression to exclude Service in Administration > General > Regular Expressions

[greavette]

Hello Forum,

I've been reading up on how to exclude alerting/monitoring of some windows services. I want to exclude monitoring of the edgeupdate service on Windows computers I monitor.

've read that I can add to the 'Windows service names for discover' in Administration > General > Regular Expressions a result of false for my service. What I can't figure out is what is the expression I use? Here is the expression I see in my Zabbix 6 LTS:




Here is the expression from the above screenshot:

^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.50727_32|clr_optimization_v4.0.30319_32)$

Do I Add a new line with an Expression Type of False for my service? If yes how do I form the expression for my service?

Or do I add my service to the existing line and surround my service by

|

?


Thank you in advance for any help or direction you can provide me.

[cyber]

If your Zabbix install is fresh and all the templates also are of latest version, then you do not need to change this global regex at all. It is not used any more by templates. I assume, it is there only because of some backward compatibility through upgrades.
You need to look into template and in Macros tab you should see {$SERVICES_NOT_MATCHING} macro (or similar). You need to change that value.

[dimir]

To add to what cyber said, yes, "changing" means adding your new entry to the list that is separated by pipe (|). By the way, that list contains the full service names, so you need to make sure what you add is also complete name (not part of it). Otherwise either the regular expression need to be changed or you need to add another one.

[jhboricua]

I find the use of the {$SERVICES_NOT_MATCHING} to be less flexible than defining the excluded services in the Zabbix 'Regular Expressions' page because with the former it seems you have to define everything you want excluded in a single regex line, while the later allows you to define multiple regex statements to be evaluated. IHMO, the later is easier to manage.