Monitor and discover services with spaces in the servicename

[RobinH]

Hello!

I have windows services in my windows server that contain spaces in their service name. After speaking with the developer of the software that contains the current services, they see a high risk of making changes as it affects all systems and management platforms, for which they also apologize.

But now I wonder if it is possible to get Zabbix and windows template to do a discovery on the current services anyway?

The service name is first a static part followed by a serial number and ends with "reporter" or "server".
Ex: Static Name 123 Reporter

Can I get the filter to catch it?

[RobinH]

I found a solution that made it work.
I added ^Service Name [0-9]{1,3} (Reporter|Server)$ which collected the specified services and serialnumbers. It now works with all my hostmyand a big range of serialnumbers.

Thank you for all help that lead me to this solution

[dimir]

Is there any particular reason you think Zabbix will have an issue with a Windows service name with white spaces in it? Because I don't think I heard of such, also seeing here: https://www.zabbix.com/documentation...ndows_services

[RobinH]

No Zabbix dont have problem to use them. But I have to add them manually to make it work because the Discovery does not find them.
It finds all other services that dont have spaces included in the servicename.

So what I'm looking for is to maybe change the discovery-filter or something to make it work.

[dimir]

To me the reason might be that your services are not automatically started (either manually or disabled). Our template only looks for the automatic or automatic delayed services.



If your service start is manual you can try to create 2 host macros:

{$SERVICE.STARTUPNAME.MATCHES}=^(?:automatic|automatic delayed|manual)$
{$SERVICE.STARTUPNAME.NOT_MATCHES}=^disabled$

Then wait till the next time discovery rule is run (or run it manually) and see if that changes things.

[RobinH]

Hey!

Seems right. But with this change, I get warning on all "manual-started" services that is'nt running, which are alot. So I think I need to specify som kind of rule for the actual services that im interested of.
Is there a way to filter on them.

[dimir]

First thing I would think of, your services, don't you wan't to make them automatic or automatic delayed?

[RobinH]

Yes, thats a good question, which I have'nt made that clear from the beginning, sorry.

The two services are monitored and controlled by a third "Controller-service" thats has the task to start, restart or stopp the services incase of issues.
So they need to be manual becuase of that.

[dimir]

One way to overcome this is to edit template Windows by Zabbix agent discovery rule Windows services discovery filters and add filter E and change logic to Custom expression:


Then either in template or host add macro:

[RobinH]

The services has a serialnumber that is included (number) Ex: "Service Name (0-999) Reporter"
How do I do the macros and filtering in that case?

[cyber]

The services has a serialnumber that is included (number) Ex: "Service Name (0-999) Reporter"
How do I do the macros and filtering in that case?

^(Service name \(\d+\) Reporter)$

[RobinH]

^(Service name \(\d+\) Reporter)$

Tried this out today and add to the filtering but it did no difference. Seems to just get the automatic started services and no manual.

[RobinH]

When I try it again from scratch, I cant combine them, setting macros to automatic/automatic delayed/manual and adding the macro "SERVICE.EXCEPTIONNAME.MATCHES" with the filtering rule "^(Service name \(\d+\) Reporter)$". It just adding all the manual services like before.

[dimir]

I never said to add "manual" to "automatic and automatic delayed"...

Please read this post very carefully, let me know if you have troubles understanding the logical AND/OR operators: https://www.zabbix.com/forum/zabbix-...962#post478962

[RobinH]

Oh okay... I think I missunderstood the posts earlier.

Well now it did only work if a specified the name of the service, but I would need it to work with the service-serialnumber that is different in my server-hosts.
I tried the "^(Service name \(\d+\) Reporter)$" from Cyber but that one did not work.

[solution]

try the expression:

^(Service name.+)$


Wellington