Proper way to exclude certain drives and volumes from being monitored

[eric859]

I have certain types of Windows servers that have drives that are full most of the time such as our CCTV servers. They continuously write to the drive removing the oldest video files as space is needed. Once I discover these hosts in Zabbix, they are added to the Windows Server group along with the general Windows by Zabbix Agent template. By default, it monitors all drives and volumes. What is the proper way of telling Zabbix to not monitor drive usage on certain drives and/or volumes on a per host basis?

[Markku]

It is the macros in the template, you can override them at the host level. Based on https://git.zabbix.com/projects/ZBX/.../windows_agent I believe the macros {$VFS.FS.FSNAME.MATCHES} and {$VFS.FS.FSNAME.NOT_MATCHES} are the ones that you can use.

I don't have a Windows host that I could use for testing, but if for example you want to exclude D: drive, I believe the correct syntax for {$VFS.FS.FSNAME.NOT_MATCHES} would be (without quotes) "^D$" (= matches only string that starts with D and ends right there).

Markku

[eric859]

I'm confused on how to do this on a per host basis. It looks like it's making a change to the template that applies to all windows hosts, not just the one.

[Markku]

Macros are configurable also on the host level. Go to the Macros tab in a host configuration, and click the "Inherited and host macros" button to show also the macros defined in used templates. Then you can click Change in a macro to make host-specific changes.

Markku

[eric859]

Let me restate this so I know we're on the same page. If I go to a Data Collection -> Hosts and click on a host, then select the Macros tab, I see "Host Macros" and "Inherited and host macros"(There is nothing under Host Macros). When I select "Inherited and host macros", any change I make to any visible macro's value is only changed on that one host?

Thank you for your help!

[eric859]

Also, it seems as though when you link a template to a host, all these macros are defined for the host and triggers automatically created for the drives/filesystems found with the macro. If I've already discovered the host, linked the template, and all the triggers created, would making this Macro change for those 2 macros on a single host immediately take effect and remove any triggers previously created for the filesystems or do I have to do another manual step to get rid of them?

[Markku]

Let me restate this so I know we're on the same page. If I go to a Data Collection -> Hosts and click on a host, then select the Macros tab, I see "Host Macros" and "Inherited and host macros"(There is nothing under Host Macros). When I select "Inherited and host macros", any change I make to any visible macro's value is only changed on that one host?

Thank you for your help!

Yes: whenever editing macros under a host, they affect that host only.

Markku

[Markku]

Also, it seems as though when you link a template to a host, all these macros are defined for the host and triggers automatically created for the drives/filesystems found with the macro. If I've already discovered the host, linked the template, and all the triggers created, would making this Macro change for those 2 macros on a single host immediately take effect and remove any triggers previously created for the filesystems or do I have to do another manual step to get rid of them?

The macros are evaluated when the trigger expression is evaluated, so the changes take effect immediately (= within a few seconds in practice).

Markku

[cyber]

The macros are evaluated when the trigger expression is evaluated, so the changes take effect immediately (= within a few seconds in practice).

Markku

Trigger is recalculated, when new values to any of used items come in and if time based functions are used (nodata etc), then also in every 30 sec...