GoogleUpdateService - helpppp

[gilur]

Hi, It was suppose to be a simple one, but I'm struggling with this one for a week now and decided to reach for some help:
Google installs two update services on some of my machines. I'm monitoring these machines with the "Windows by zabbix agent active". While their startup is "automatic" - I really couldn't care less if they are running or not.
Instead of disabling them, I decided to add them to the "{$SERVICE.NAME.NOT_MATCHES}" list in the macro.
Since the service adds a version number to it's name (i.e. GoogleUpdaterService125.0.6386.0" (GoogleUpdater Service 125.0.6386.0 (GoogleUpdaterService125.0.6386.0)) )
I wanted to add it as a wildcard and so I started trying all kinds of variations.
GoogleUpdater* GoogleUpdater.+ GoogleUpdater.* GoogleUpdater. GoogleUpdater[0-9.]*
and .... None of the above works. I had some quite in one of these variations and then when the service updated itself alerts started popping up again.

How can I add it so it will be ignored once and for all ?
Thanks
Gil

[cyber]

service name is not actually GoogleUpdater... it is "gupdate" and "gupdatem"

  {
    "{#SERVICE.NAME}": "gupdate",
    "{#SERVICE.DISPLAYNAME}": "Google Update Service (gupdate)",
    "{#SERVICE.DESCRIPTION}": "Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.",
    "{#SERVICE.STATE}": 6,
    "{#SERVICE.STATENAME}": "stopped",
    "{#SERVICE.PATH}": "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc",
    "{#SERVICE.USER}": "LocalSystem",
    "{#SERVICE.STARTUPTRIGGER}": 0,
    "{#SERVICE.STARTUP}": 2,
    "{#SERVICE.STARTUPNAME}": "manual"
  },
  {
    "{#SERVICE.NAME}": "gupdatem",
    "{#SERVICE.DISPLAYNAME}": "Google Update Service (gupdatem)",
    "{#SERVICE.DESCRIPTION}": "Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.",
    "{#SERVICE.STATE}": 6,
    "{#SERVICE.STATENAME}": "stopped",
    "{#SERVICE.PATH}": "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /medsvc",
    "{#SERVICE.USER}": "LocalSystem",
    "{#SERVICE.STARTUPTRIGGER}": 0,
    "{#SERVICE.STARTUP}": 2,
    "{#SERVICE.STARTUPNAME}": "manual"
  },

So using "gupdate.*" there in regex might help you.

only one matching "Google.*" is

  {
    "{#SERVICE.NAME}": "GoogleChromeElevationService",
    "{#SERVICE.DISPLAYNAME}": "Google Chrome Elevation Service (GoogleChromeElevationService)",
    "{#SERVICE.DESCRIPTION}": "",
    "{#SERVICE.STATE}": 6,
    "{#SERVICE.STATENAME}": "stopped",
    "{#SERVICE.PATH}": "\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\123.0.6312.106\\elevation_service.exe\"",
    "{#SERVICE.USER}": "LocalSystem",
    "{#SERVICE.STARTUPTRIGGER}": 0,
    "{#SERVICE.STARTUP}": 2,
    "{#SERVICE.STARTUPNAME}": "manual"
  },

Data gathered from command line "zabbix_get -s <your windows host> -k service.discovery | jq ."


EDIT: it may depend on windows version also?? Above was gathered from windows server 2022, but for win11 it shows what OP states... :/

[gjuarez]

Guys,
I'm getting the following error:


I've already created a template so that it doesn't detect it, but it keeps doing it:

[dharam]

I am having same issue , any update/solution on this?

[Be4rfoce0ne]

This worked for me:

- Click on the Template you currently using for monitoring / don't create a new template.
- go to Macros
- edit it like in the following picture












i had to edit it like: |GoogleUpdate.+|, because there were two services (GoogleUpdateService.... and GoogleUpdate"r"Service....) and i wanted to get rid of both here.