Windows SNMP Network Interfaces

[codechurn]

I am running Zabbix 7.2.7. I have added a Host and configured it with the Windows SNMP template as follows



This is what I am seeing data wise, clearly there are a number of virtual and/or invalid interfaces.

These are the NICs in the VM:

I want to *just* see the Name="Ethernet" adapter.

I am at wits end trying to filter out all of the bogus network interfaces. Clearly I must be missing somethings and/or not understanding how this works.

• I've tried adding and setting the {$NET.IF.IFNAME.MATCHES} macro on the host to ^Ethernet$ .
• I've tried going into the Host's Network Interface Discovery, Filters and explicitly adding a filter for {#IFNAME} matches ^Ethernet$

I've tried other values and other fields, waited, clicked Execute on the host after I made these changes (not sure if need to do this) and none of it seems to have any impact on the data. I'm clearly missing something basic here.

HELP!!?!

[SanMonitor]

Hello codechurn,

adding the regex to {$NET.IF.IFNAME.MATCHES} seems to be the logical decision here and should work.

Just to check, maybe you already knew this, but even after changing the discovery rule, Zabbix will keep the items it doesn't discover anymore for a set period. Could it be that these 'bogus' network interfaces were just in that state?
You can check the period in the network interfaces discovery item next to the 'Delete lost recources', I think the default is 30 days.
You can also see this if you go to the item list for the host, items that aren't discovered anymore have a orange warning telling you when they'll be deleted.

Again, maybe not the problem here but just to be safe.

[codechurn]

Hello codechurn,
Just to check, maybe you already knew this, but even after changing the discovery rule, Zabbix will keep the items it doesn't discover anymore for a set period. Could it be that these 'bogus' network interfaces were just in that state?

Is there a more effective way to test your filter rule changes without force deleting the data? I have no problem if the historical stuff sticks around, but I want to be able to iterate on my filter rules and get them tuned to my liking. It would be ideal if I could see these changes immediately reflected in some manner. Actually, come to think of it the historical data stuck around along with a read only copy of my rule definition that would be quite helpful to work things out.