Start Windows Services with Remote Command

[singk]

The above script will only start one service and therefore you would have to have multiple scripts to do this.
You can try the above script to make sure that Zabbix can actually start the remote service and then concentrate on the at service with the trigger.
As mentioned, place {EVENT.TAGS} in your alert message and when the trigger fires, you should see the service name as long as you have {#SERVICE.NAME} under the services discovery tag name eg
In services discovery trigger alert message add text:
Service: {EVENT.TAGS} has stopped on {HOST.NAME}
That will show what is coming through on the trigger. {EVENT.TAGS} should have eg Spooler for the windows print spooler.
If that is showing, then you can add the remote command:
net start {EVENT.TAGS} which translates to net start Spooler.

Finally I understand the use of {EVENT.TAGS} after days of trying to parse the {Event.NAME} with no luck.

So I concur that adding the {#SERVICE.NAME} in the Tag field of the Windows Service Discovery template is working for me on Zabbix 3.4.7.

[Malarvizhi]

Thanks

Thanks Louis and singk

[mendez]

Hi all,
here I am in the same trouble and I think that I have missed some point.

I have a LLD for windows service discovery and inside it's Trigger protype for service stopped I have added {#SERVICE.NAME} as Tag-Key property.

Into Administration panel I have created a Service/Start script that run "net start {EVENT.TAGS}" but when I go to run this script over a stopped service in dashboard I get this output inside the detached window:

net start {EVENT.TAGS}
The service name is invalid. More help is available by typing NET HELPMSG 2185.

It seems to me that the {EVENT.TAGS} is not expaned to {#SERVICE.NAME} but is treated like a string.


What am I doing wrong ?

Thank you

[louis-m]

Under Monitoring > Problems
Can you see anything under Tags (far right hand side)
For this to work, you should be seeing the service name under there eg spooler

[louis-m]

I've not got it working in a script yet. It works if you include it in a remote command but not in a script. The {EVENT.TAGS} don't seem to come through on a script. Maybe it needs a macro eg {TRIGGER.TAG.NAME1} or {TRIGGER.TAG.VALUE1} which would work a treat if possible but don't think Zabbix does that at this time?
Ultimately, it would be better without using this at all and using something like {TRIGGER.SERVICENAME}

[davydov_d]

Thx guys for help! It works great!
- {#SERVICE.NAME}
- C:\Windows\System32\sc.exe start {EVENT.TAGS}

And run zabbix_agent under windows admin to have rights for restart service!

[MaxHeadroom]

Can you provide the complete solution ---- please?

[zerocool]

Hi all,
i have the same problem of mendez and louis-m.. :

net start {EVENT.TAGS}
The service name is invalid. More help is available by typing NET HELPMSG 2185.

It seems to me that the {EVENT.TAGS} is not expaned to {#SERVICE.NAME} but is treated like a string.

who can give me a hand please?

Regards,
Claudio

[Jaco]

Hi all,

I would like to revive this thread and maybe get some clarity on the steps required to expand {EVENT.TAGS} in a script that can be run from the alert.

I am using Zabbix 4.0.

Added {#SERVICE.NAME} as a tag on the Trigger Prototype without any Value
Added the script under Administration/Scripts
I can see the Tag Value under Monitoring/Problems and it does expand to the {#SERVICE.NAME} as expected

When I run the script from the alert it shows that {EVENT.TAGS} was actually not expanded but interpreted as a literal string.

Is this actually the correct Macro to use for the Tag value field and is it available in 4.0 as previous versions seems to not experience this issue?

Any help and final clarity on this subject would be appreciated.

[JamiSusijarvi]

This {#SERVICE.NAME} -> {EVENT.TAGS} seems to work ok, if you have only one tag. How about when i need to use multiple tags to different uses? {EVENT.TAGS} is returning full list of comma separated tags.

[harmonica]

Hi all,

I have the same problem and I am using Zabbix 3.4.14.

1 - Added {#SERVICE.NAME} as a tag on the Trigger Prototype without any value.
2 - Added the script under Administration/Scripts > C:\Windows\System32\net start {EVENT.TAGS}
3 - I also can see the Tag Value under Monitoring/Problems and it does expand to the {#SERVICE.NAME} as expected
4 - EnableRemoteCommands=1 in zabbix agent configuration

When I run the script this is the output

C:\Windows\System32\net start {EVENT.TAGS}

The service name is invalid.

More help is available by typing NET HELPMSG 2185.


From zabbix agent log

2728:20190516:104305.194 Requested [system.run[C:\Windows\System32\net start {EVENT.TAGS},wait]]
2728:20190516:104305.194 Executing command 'C:\Windows\System32\net start {EVENT.TAGS}'
2820:20190516:104305.229 In collect_perfstat()
2820:20190516:104305.229 End of collect_perfstat()
2728:20190516:104305.249 EXECUTE_STR() command:'C:\Windows\System32\net start {EVENT.TAGS}' len:82 cmd_result:'The service name is '
2728:20190516:104305.249 Sending back [The service name is invalid.

Any help and final clarity on this subject would be very appreciated.

Regards

[Semiadmin]

This {#SERVICE.NAME} -> {EVENT.TAGS} seems to work ok, if you have only one tag. How about when i need to use multiple tags to different uses? {EVENT.TAGS} is returning full list of comma separated tags.

Let's vote: https://support.zabbix.com/browse/ZBXNEXT-5025

[stevemc]

Hi all,

I have the same problem and I am using Zabbix 3.4.14.

1 - Added {#SERVICE.NAME} as a tag on the Trigger Prototype without any value.
2 - Added the script under Administration/Scripts > C:\Windows\System32\net start {EVENT.TAGS}
3 - I also can see the Tag Value under Monitoring/Problems and it does expand to the {#SERVICE.NAME} as expected
4 - EnableRemoteCommands=1 in zabbix agent configuration

When I run the script this is the output

C:\Windows\System32\net start {EVENT.TAGS}

The service name is invalid.

More help is available by typing NET HELPMSG 2185.

At present the EVENT.TAGS macro is not available for use within scripts - there's a comprehensive list of which macros are available in which places at https://www.zabbix.com/documentation...ed_by_location.
Essentially your only option is to use the remote command feature (which will fire whenever a service is detected as stopped - not a good idea for our systems, as services may be temporarily stopped for a good reason).

I've added my vote to https://support.zabbix.com/browse/ZBXNEXT-5255 - but it's not exactly got a lot of traction at the moment.

[harmonica]

At present the EVENT.TAGS macro is not available for use within scripts - there's a comprehensive list of which macros are available in which places at https://www.zabbix.com/documentation...ed_by_location.
Essentially your only option is to use the remote command feature (which will fire whenever a service is detected as stopped - not a good idea for our systems, as services may be temporarily stopped for a good reason).

I've added my vote to https://support.zabbix.com/browse/ZBXNEXT-5255 - but it's not exactly got a lot of traction at the moment.

Hi stevemc,

Yes, I checked the documentation and EVENT.TAGS macro is not available for use within scripts.
I also added my vote to https://support.zabbix.com/browse/ZBXNEXT-5255

Thanks

[lou1z]

At present the EVENT.TAGS macro is not available for use within scripts - there's a comprehensive list of which macros are available in which places at https://www.zabbix.com/documentation...ed_by_location.
Essentially your only option is to use the remote command feature (which will fire whenever a service is detected as stopped - not a good idea for our systems, as services may be temporarily stopped for a good reason).

I've added my vote to https://support.zabbix.com/browse/ZBXNEXT-5255 - but it's not exactly got a lot of traction at the moment.

You can add an exception for those particular services under regular expressions to prevent Zabbix discovering those services and therefore the remote command not firing. If you already have the service discovered, add the service name exception in regular expression under "Windows service names for discovery" and delete the discovered service so that Zabbix doesn't have it anymore and will ignore it in the discovery. Its been a little while since I initially did this so not sure if the latest versions of Zabbix have improved this or taken automatically starting windows services further?

One caveat of the above is if you are doing manual upgrades and you need to ensure the service remains stopped whilst doing an upgrade of some sort. We get round this by stopping the service and then manually changing it to disabled. That way Zabbix won't fire the remote command every x minutes as its only looking for services that are set to automatic. Just ensure you remember to change the service back to automatic once you are done and then Zabbix will try to restart the stopped automatic service.