Start Windows Services with Remote Command

[bmg4357]

I have Zabbix 3.2 installed and am monitoring all Windows services that are set for Automatic or Automatic (delayed) startup, except for a few that I am filtering out in the discovery rule. We sometimes have several hundred services that are are stopped that need to be started. I can create a remote command to start these services if I specify them individually by name, but I was hoping that there would be a variable I could use instead. I noticed that the discovery rule uses {#SERVICE.NAME} but this does not seem to work.

I have tried the following remote commands:

sc start “{SERVICE.NAME}"
sc start “{servicename}"
sc start “{SERVICENAME}"
sc start “services.info[{SERVICE.NAME}]"
sc start “{DISCOVERY.SERVICE.NAME}"

None of these work. If I specify the name of the service, it works like a champ. Now, I know that I can create about 100 of these commands and catch all the services in our environment, but there has got to be a better way to do this. I've searched and searched, and can find nothing. Any help is greatly appreciated.

[doughall]

I have Zabbix 3.2 installed and am monitoring all Windows services that are set for Automatic or Automatic (delayed) startup, except for a few that I am filtering out in the discovery rule. We sometimes have several hundred services that are are stopped that need to be started. I can create a remote command to start these services if I specify them individually by name, but I was hoping that there would be a variable I could use instead. I noticed that the discovery rule uses {#SERVICE.NAME} but this does not seem to work.

I have tried the following remote commands:

sc start “{SERVICE.NAME}"
sc start “{servicename}"
sc start “{SERVICENAME}"
sc start “services.info[{SERVICE.NAME}]"
sc start “{DISCOVERY.SERVICE.NAME}"

None of these work. If I specify the name of the service, it works like a champ. Now, I know that I can create about 100 of these commands and catch all the services in our environment, but there has got to be a better way to do this. I've searched and searched, and can find nothing. Any help is greatly appreciated.

I've been trying the exact same thing!

964:20170518:101526.238 Executing command 'DC10:cmd /c "net start {DISCOVERY.SERVICE.NAME}"'
  7224:20170518:101741.285 Executing command 'DC10:cmd /c "net start {DISCOVERY.SERVICE.NAME}"'
  3964:20170518:102623.414 Executing command 'DC10:cmd /c "net start {#SERVICE.NAME}"'
  3964:20170518:103041.493 Executing command 'DC10:cmd /c "net start {SERVICE.NAME}"'

Looking forward to the response to this.. Just cant figure it out!

[ovas]

Hello!

I guess you will still be forced to use an item prototypes for this:
1. Make service discovery
2. Add item prototypes of External check with script running. Key may be like service.start[{#SERVICE.NAME}]
3. Place a service.start script with a parameter passing from item prototype. The script should execute your desired command and get the returned exit code.
This exit code will be the value that Zabbix keeps.

More information on external scripts: https://www.zabbix.com/documentation...types/external

[louis-m]

I got a little bit further with this and was thinking along the lines of what ovas mentioned above.
Basically, if you create a service discovery trigger rule (you can clone the existing one) and strip everything out of the trigger name and just have {#SERVICE.NAME}

The above is then the variable name in the trigger ie {TRIGGER.NAME} and then you can then use C:\Windows\System32\sc start {TRIGGER.NAME}

It's slightly messy but works. A better way would be able to parse the {TRIGGER.NAME} if you included {#SERVICE.NAME} within it

eg my trigger name is: {#SERVICE.DISPLAYNAME} ({#SERVICE.NAME}) {#SERVICE.STATENAME} on {HOST.NAME} and be able to extract {#SERVICE.NAME} from it

[Cruz]

Hello,
I am new to Zabbix, I have version 2.4.6 installed, I need to restart some services periodically, I was reading this post but I cannot understand how to make it work, they could help me with the process a little more in detail.

Thank you.

[louis-m]

The nearest I could get in the message notification was using {ITEM.KEY1} which returned "service.info[Spooler,state]" for the windows "Print Spooler" service.

So I started to look at macro's to see if I could extract "Spooler" from "service.info[Spooler,state]"

See here:

https://www.zabbix.com/documentation/3.4/manual/config/macros/macro_functions

But I don't think {ITEM.KEY} is supported as it only states {ITEM.VALUE} and {ITEM.LASTVALUE} is supported.

[louis-m]

Think I've cracked it.
You will zabbix 3.2 which comes with event tags.

In the discovery trigger prototype:
under tag name, enter {#SERVICE.NAME} <<< don't enter a value here, just a name

The above will carry the service name through to the trigger via the {EVENT.TAGS}

In the remote command:

C:\Windows\System32\net start {EVENT.TAGS}

It works. Be handy if you could get EVENT.TAG 1-9 working so I can use more than one event tag with this discovery prototype

[Malarvizhi]

Hi,
Could you please brief the part of configuring tag in frontend configuration and referring it in script. Because i tried after adding a Tag as mentioned but it didnt work. Zabbix version tried is 3.4. Thanks in advance.

[louis-m]

Sure.
Under templates > windows os > services discovery > trigger prototypes, I added {#SERVICE.NAME} under tags with nothing in value.

Then under actions, add a remote command with C:\Windows\System32\net start {EVENT.TAGS}

The {EVENT.TAGS} will get the service name from the {#SERVICE.NAME} in the trigger.

It works well for us but I'm sure there must be a more graceful way of doing it.

[Malarvizhi]

Thanks

Thanks Louis..
I tried the same way but no luck. Will check for other possible ways.

[louis-m]

Try adding {EVENT.TAGS} into the action message and when it triggers, it should show you what is being sent in the {EVENT.TAGS}

Alternatively, you could check the zabbix agent logs to see what remote command has been sent.

It does work on 3.4 and it works well. Just wish there was a better way to get the variable through eg TRIGGER.SERVICENAME or TRIGGER.TAG1 so we could use more tags for other things.

[Malarvizhi]

Thanks for the update. Will try and post you the results.

[mohit1993]

Use net command

Go to Administration > Scripts
Create one script with command

net start "<serviceName>"

to start service and select Execute on on Zabbix agent

to stop service

net stop "<serviceName>"

[Malarvizhi]

Thanks for the update.
Will check this as well

[louis-m]

The above script will only start one service and therefore you would have to have multiple scripts to do this.
You can try the above script to make sure that Zabbix can actually start the remote service and then concentrate on the at service with the trigger.
As mentioned, place {EVENT.TAGS} in your alert message and when the trigger fires, you should see the service name as long as you have {#SERVICE.NAME} under the services discovery tag name eg
In services discovery trigger alert message add text:
Service: {EVENT.TAGS} has stopped on {HOST.NAME}
That will show what is coming through on the trigger. {EVENT.TAGS} should have eg Spooler for the windows print spooler.
If that is showing, then you can add the remote command:
net start {EVENT.TAGS} which translates to net start Spooler.

But you need to ensure the prerequisites are in place first eg zabbix agent allow remote commands etc.

I can vouch that this works and it works well on 3.4.6. We have 100+ servers running with this and when an automatic service stops, we try and restart it every couple of minutes for 50 attempts and then we escalate the action to our IT support to manually intervene.
It's great for our patching too and we just run a script to reboot our servers in a certain order, sit back and watch Zabbix do it's thing on a 50 inch tv screen and over the course of 2 hours, our entire server estate is rebooted with any lagging services automatically restarted by Zabbix and everything reporting ok.

[tcilmo]

Make sure the ability to run remote commands is turned on in the agent configuration file. See below:

### Option: EnableRemoteCommands
EnableRemoteCommands=1