Assistance Required for Process Name Mapping in Zabbix Front-End

[spsoni]

Hello Team,

I am currently working with a parent process named "AeServer.exe", which spawns multiple child processes. The goal is to create a Zabbix item that captures the Private Bytes for both the parent and its child processes.
To achieve this, I configured a Zabbix item using the following WMI query:

wmi.getall[root\cimv2,"SELECT IDProcess, Name, PrivateBytes FROM Win32_PerfRawData_PerfProc_Process WHERE Name LIKE '%AeServer%'"]

Please refer below screenshot for item created:


When retrieving the results for this item, the output is returned in JSON format. In this output, the parent process name is displayed correctly as "AeServer". However, the child process appears as "AeServer#1", whereas its actual name (as per the command line) should be "WorkflowService".

Please refer below screenshot for JSON obtained for item created as above:



Requirement:
We would like to display the child process as "WorkflowService" instead of "AeServer#1" in the front-end. Since this configuration will be deployed across multiple servers, we prefer not to modify the Zabbix Agent configuration file.
For reference, below are the command lines for both processes:

• Parent Process:
  C:\Program Files\Common Files\StayinFront\AeServer.exe
• Child Process:
  "C:\Program Files\Common Files\StayinFront\AeServer.exe" /private WorkflowService

Could you please advise if there is a way to perform this renaming or mapping from the Zabbix front-end itself? Let me know if you require any additional information to assist with this request.

Thank you,
Shivam

[cyber]

If that script cannot be altered to return what you need, then most probebly you need to do some JS preprocessing to it and replace things that you need...

[spsoni]

Screenshot_7.png shows the configuration of the item.



Screeshot_8 shows the results obtained from the item created above.

[spsoni]

Can't see any screenshots.

Hello,

I have uploaded attachments now. Could you please review and let me know if you require any additional information for the same?

Thanks,

[spsoni]

If that script cannot be altered to return what you need, then most probebly you need to do some JS preprocessing to it and replace things that you need...

Hello Cyber,

Thanks for your update. I did tried to replace the "AeServer#1" with the actual child process name, but the concern over here is I have same parent process name on all servers but the child process name is different on all servers. So, I need to replace or perform preprocessing for each server differently. I am in need of doing that dynamically.

For example: If we have Chrome running 20 times or process. We want to be able to have a discovery rule that pulls in all of the chrome executables, along with their command lines under separate items and that gives us CPU and memory counters just like just like task manager shows as shown in the below screenshot.



But, if their are some other ways to do, could you please suggest that as well? Because, this is the result that we are trying to accomplish. Please do let me know if you require any additional information for the same.

Thanks,
Shivam

[cyber]

ASI see, that Win32_PerfRawData_PerfProc_Process does not return anything else but name, then you need some other way to discover all required processes.. Unfortuantely I do not speak windows very well,
In general, I would look for a wmi query, that would return name, process id and that command line values, use that for a discovery and create correctly named items... and there query for those bytes based on process ID probably... that would be the common value in both queries..

[spsoni]

ASI see, that Win32_PerfRawData_PerfProc_Process does not return anything else but name, then you need some other way to discover all required processes.. Unfortuantely I do not speak windows very well,
In general, I would look for a wmi query, that would return name, process id and that command line values, use that for a discovery and create correctly named items... and there query for those bytes based on process ID probably... that would be the common value in both queries..

Hello Cyber,

Thanks for your update on this. I checked for other WMI classes that contains name, process id, command line and private bytes in single class, but am unable to get that class name. Also, I tried applying join between classes "Win32_PerfRawData_PerfProc_Process" and "Win32_Process", but the WMI query does not support the join same as SQL.

So, could you please guide me further or let me know if you require any additional information for the same?

Thanks,
Shivam

[cyber]

I never said, that there is a class, that would return ALL your required things... or that there is a join option... I said, find one, that returns name, ID, command line and use data from it to create items and queries to get your required info from other class...