GoogleUpdaterService alerts

[Jonathan2260]

I'm running Zabbix 6.0.25 on AlmaLinux 9.
I have Zabbix Agents 2 running on several servers.
They keep giving me alerts about Google services not running.
I disable them but they keep happening. I think the problem is that the version keeps changing so the name of the service changes.
I would like to know how to exclude these so that it stop warning me. Can someone explain to me how to do it?

Thank you.

[cyber]

You need to edit a macro in template, which regulates, what services are monitored and which are not... by default it accepts all services. {SERVICE.NAME.NOT.MATCHES} or something like that... add regex there so number in name doesn't matter... delete existing items and triggers, they should not reappear.
There is ton of topics here with the same question, how to configure services monitoring in windows... try some searching.

[Antivilff]

i have the same problem
and problem with the service name, because i dont want to disable checking for this service
i already set up checking for that kind of services, when service start type is "Automatic", but it is stopped 90% of time. but i need static service name for this
i cant monitor service with changeable name and the main question is how to ignore version in service name, or how to disable this service update and return to the old service naming(gupdate & gupdatem)

[Zuzuka]

I have the same problem with the Zabbix Agent (not 2). There is an item in Zabbix which is checking services that are stopped but set to "automatic" startup mode:
services[automatic,stopped,"{$IGNOREDSERVICESLIST}"]

I use the macro {$IGNOREDSERVICESLIST} that have a list of services which statuses I want to ignore (exclude list). The main problem is that this Zabbix item (services[...]) should include in 3rd parameter an explicitly assigned services names. But there is no way to use wildcard for the service names and Google has started to use different service names for every new release of their product (added version number to the service name). As a result I need to update the list with new services every time when they appeared. And it is very annoying - for sure.

I created feature request to add wildcard to that Zabbix item:

https://support.zabbix.com/browse/ZBXNEXT-9001

As many people will vote for that feature then faster the developers will develop this new feature.

[cyber]

What exactly do you do with that list of services? Just being curious here...

[Zuzuka]

Some services are stopping from time to time due to different types of failure. And we need to be informed of that events accordingly to be able to catch and to discover the reason why they are stopping.
I don't want to use services discovery because it creates separate item for every service. In case of big amount of monitoring hosts it created significant load on server and hosts itself.
services[...] key is perfectly matching our needs. But this new innovation from Google is creating annoying effort because of constant maintaining of this exclusion services list:

[cyber]

OK.. so you pull a list of automatic and stopped and if there is something, then consider those to be dead... clear...

I seriously doubt that "significant load" part..

EDIT: damn .. I almost suggested something, but then started to doubt myself, have to test it first..:P
EDIT2: of course... overworked and talking BS here..:P Mixing up things...

[Zuzuka]

Lets just calculate. We have about 2.5K VMs in our environment. In general every VM is having about 70 automatic services (I don't calculate other metrics that we are monitoring except the services).
Instead of only one item for services[...] key on 2.5K hosts (2'500 items) I'll need to monitor additional 70 x 2.5K = 175'000 items. So, it is 172'500 additional monitoring items. Do you see the difference (2500 against 172500)? What about to store and processing all of this additional data?
And mostly all of those services will return "running" status that isn't useful for us. We just need an info when and what service is stopped and then to find the way how to prevent this in future (if possible).

I'll appreciate if you provide us an alternative way using Zabbix tools how to catch the event when the service is stopping (plus to ignore non-important services). Because I'm already thinking in direction of PowerShell script to workaround this problem if Zabbix services key will not be improved.

[cyber]

Its already way off topic here.. but
1) Why do even care about each automatic service there... I think our windows baseline contains only 5-6 services, like antivirus, SCCM client etc. The amount of crap, that windows manages to start, is ... a lot.. Who cares, if "Themes" service is running? If that particular server has some important service to run, monitoring via different template is added. It is not usually a platform teams responsibility to start those things anyway, so notifications are directed towards the "user".
2) Amount of items is no big deal, if we look on the DB size needs. Its the data, that they gather, that takes up the space. There is preprocessing (discard with heartbeat), which drastically reduces the amount of data you save to DB. You do not need to save each value, you need to save the changes only.

I agree 2500 items vs for example 250000 seems a lot, but the amount of data, that those items save, is not actually x100, probably not even x10, if configured properly. Your agent only checks for short list (no extra load), your server receives a bit more data, but it does not have to store it...

[Antivilff]

Cyber, for example, our internal developed services. About 20+ DB servers, about 50 DB/server and 4 services per DB. Failure of any of them is a big issue and we need to know about it ASAP. And i do not want to waste time reacting on triggers, because someone decided that add version in service name is a good idea.

[Zuzuka]

Its already way off topic here.. but
1) Why do even care about each automatic service there... I think our windows baseline contains only 5-6 services, like antivirus, SCCM client etc....

For all of these "custom" cases we need to create a separate templates. For example, in my env. there are about 200 different types of servers (service purpose). In this case we need:

1. to create about 50-100 different templates to cover all important service sets on that hosts
2. to apply those templates to the hosts with proper type
3. maintain this list in current state

Do you realize the scope of this effort? And all of those "haemorrhoids" just instead of single item in general template which will report about stopped "automatic" service (exclude non-important - "themes,gupdate,GoogleUpdaterInternalService12 4.0. 6315.2,GoogleUpdaterService124.0.6315.2,GoogleUpda terInternalService124.0.6337.0,GoogleUpdaterServic e124.0.6337.0,...")? I think it is too much for this particular case. If this feature request is not the case for Zabbix at all then just send us a note. I'll better spend some time to create a PowerShell script (which will do the same) instead of asking to improve Zabbix functionality. In this case it will be my custom solution of general problem, but Zabbix support will receive similar requests like this one again and again.

Amount of additional items (for all automatic services) for all VMs in the env. I even don't want to discuss. I have provided above my opinion about that.

And the last one thing: Zabbix is having the "services[]" item key designed for this purpose. It was good enough and was working perfectly until some "nice" software developers invented to add a custom version numbers to the services name. It is required slightly to improve this item according to the last "nice" changes.

[cyber]

In my country, there is a proverb, something like "for some the mother, for some the daughter"... meaning some ways work for some people and other ways work for other people...
Our ways of working are different, our environments are different. I totally understand what you are saying... I just tried to explain some other ways, no need to get so agitated about it..
I even added my upvote for your zbxnext :P

[Zuzuka]

The fix using the PowerShell is below. It is full replacement of standard Zabbix Agent (and Zabbix Agent 2) services key.
It uses the same parameters and values like Zabbix Agent "services" item key. The script "Zbx-Services.ps1":

param(
  [validateSet("automatic","manual","disabled")]
  $type
 ,[validateSet("stopped","started","start_pending","stop_pending","running","continue_pending","pause_pending","paused")]
  $state
 ,[string] $exclude = ""
)
if ($exclude -eq "") {
  $resultList = (Get-Service | Where-Object {$_.Status -eq $state -and $_.StartType -eq $type}).Name
}
else {
  $excludeArray = $exclude.Split(",")
  $resultList = (Get-Service -Exclude $excludeArray | Where-Object {$_.Status -eq $state -and $_.StartType -eq $type}).Name
}
if ($resultList.count -eq 0) { return "0" } else { return $resultList }

Zbx-Services.ps1 -type automatic -state stopped
will return the whole list of stopped services

Zbx-Services.ps1 -type automatic -state stopped -exclude "edgeupdate*,GoogleUpdater*,gupdate*"
will return the list of stopped services except matched with wildcard (*) above

[AJGA]

Hi, Thank you for sharing, where would you go about to apply this to be valid for all windows servers in Zabbix?

[CyberMage256]

Some services are stopping from time to time due to different types of failure. And we need to be informed of that events accordingly to be able to catch and to discover the reason why they are stopping.
I don't want to use services discovery because it creates separate item for every service. In case of big amount of monitoring hosts it created significant load on server and hosts itself.
services[...] key is perfectly matching our needs. But this new innovation from Google is creating annoying effort because of constant maintaining of this exclusion services list:

Why in the world would you not use regex the way it's designed instead of trying to create a "crazy nightmare list"? Just tell it to ignore anything with "GoogleUpdater" in the name.

For instance:

^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_opt imization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserServic e_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc| GISvc|ShellHWDetection|edgeupdate|TrustedInstaller |GoogleUpdater.*|TabletInputService|CDPSvc|wuauser v)$

[cyber]

Why in the world would you not use regex the way it's designed instead of trying to create a "crazy nightmare list"? Just tell it to ignore anything with "GoogleUpdater" in the name.

For instance:

^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_opt imization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserServic e_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc| GISvc|ShellHWDetection|edgeupdate|TrustedInstaller |GoogleUpdater.*|TabletInputService|CDPSvc|wuauser v)$

Because where he uses that usermacro... That place (services[<type>,<state>,<exclude>] does not take regex...
Lets read whole topic before answering...

[MrB]

I had this same issue and believe I resolved it using an Override in the Windows service discovery rule:



We can use regex here, so can create a filter rule for any service that contains GoogleUpdater:


Then in the condition, we can get the object we want the override to apply to, which in this case can be item prototype. Just need to state which item prototype to apply to using the condition, then override the Discover option and set to No:


So when the discovery rule runs, it will evaluate against the Override and should not create an item for any service containing GoogleUpdater. You could also override the Create enabled option and set that to No as well, just as an extra catch, however it's probably not required.

You could also do the same theory but against a Trigger prototype, in the case where you do want the item to be discovered and collect the data but don't want the alerts to be enabled etc.

Seems to be working for me so far. Hope this helps!