remove monitoring for google chrome service

[bloodyskullz]

Hi All,

I have a domain controller that has google chrome installed and I get alerts saying:

"Windows: "GoogleUpdaterInternalService138.0.7194.0" (Google Updater Internal Service (GoogleUpdaterInternalService138.0.7194.0)) is not running (startup type automatic)"

I have already made this automatic but it's still throwing these alerts. Is it possible to not monitor google chrome? I don't care for chrome.

[kyus]

i modified it to this output:

^(?:RemoteRegistry|MMCSS|gupdate|gupdatem|chrome|S ysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserServic e_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc| GISvc|ShellHWDetection|TrustedInstaller|TabletInpu tService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+)$

Bold is the chrome parts, will this work? I made the change for the windows agent template so that all windows machine get hit with this. Surprised zabbix isn't ignoring chrome by default.

The name of the service is that GoogleUpdater... that shower up in your trigger. I usually filter it using GoogleUpdater.* in the macro.

I Recently changed the approach a bit... Filtered out all services and allowed only the ones that were relevant for me (it was easier than blocking a bunch of services).

But, for your case, using GoogleUpdater.* will work. Maybe consider adding cbdhsvc_.+ aswell (it's a clipboard related service that can get annoying some times)

[bloodyskullz]

Yea this ended up working without issues, never got notified of anything chrome related again.

For those who are wondering what it looks like:

^(?:RemoteRegistry|MMCSS|GoogleUpdate.*|SysmonLog| clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserServic e_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc| GISvc|ShellHWDetection|TrustedInstaller|TabletInpu tService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+)$

Does the trick.

[PavelZ]

You need to set the macro {$SERVICE.NAME.NOT_MATCHES}
For some reason, the default template ignores many services, but not chrome update.

https://github.com/zabbix/zabbix/blob/617dfb89aa294eb1359761dbd42e802899e21f3a/templates/os/windows_agent/template_os_windows_agent.yaml#L1481

[pyritejoe]

I like that way better than how I did it, but you can also Goto Data Collection -> Hosts > Click on a hosts triggers. If you have your stuff setup like I do with Host groups for Window/Linux ect you can select that host group and in the Name field put the trigger name. Once the comes up it will show you it for all the Windows host and you can just disable that trigger on them all from there.

[bloodyskullz]

i modified it to this output:

^(?:RemoteRegistry|MMCSS|gupdate|gupdatem|chrome|S ysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserServic e_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc| GISvc|ShellHWDetection|TrustedInstaller|TabletInpu tService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+)$

Bold is the chrome parts, will this work? I made the change for the windows agent template so that all windows machine get hit with this. Surprised zabbix isn't ignoring chrome by default.

[PavelZ]

There is a zabbix issue about this https://support.zabbix.com/browse/ZBX-24192
.Give them a signal by pressing the button

[kyus]

i modified it to this output:

^(?:RemoteRegistry|MMCSS|gupdate|gupdatem|chrome|S ysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserServic e_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc| GISvc|ShellHWDetection|TrustedInstaller|TabletInpu tService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+)$

Bold is the chrome parts, will this work? I made the change for the windows agent template so that all windows machine get hit with this. Surprised zabbix isn't ignoring chrome by default.

The name of the service is that GoogleUpdater... that shower up in your trigger. I usually filter it using GoogleUpdater.* in the macro.

I Recently changed the approach a bit... Filtered out all services and allowed only the ones that were relevant for me (it was easier than blocking a bunch of services).

But, for your case, using GoogleUpdater.* will work. Maybe consider adding cbdhsvc_.+ aswell (it's a clipboard related service that can get annoying some times)

[bloodyskullz]

Yea this ended up working without issues, never got notified of anything chrome related again.

For those who are wondering what it looks like:

^(?:RemoteRegistry|MMCSS|GoogleUpdate.*|SysmonLog| clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserServic e_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc| GISvc|ShellHWDetection|TrustedInstaller|TabletInpu tService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+)$

Does the trick.

[jtnfoley]

I just added two to the {$SERVICE.NAME.NOT_MATCHES} macro: WpnUserService and CDPUserSvc. Thanks for this!!
Both started firing alerts after a recent Windows agent install, BUT... In my case these (and potentially others in the future?!?!?) had an underscore and UID suffix. For example, "CDPUserSvc_337104e15" and "WpnUserService_337104e15"
I believe the same UID suffix means these are temporary services from a single user, possibly an orphaned service name?

Would it be possible to match the _HexStr (ANY HexStr) suffix and suppress all of this (and potential future) noise? My regex is weak, but I believe it'll be possible:

https://gist.github.com/daxburatto/307e8365c41fd5401f9ac315676490bf

[kyus]

I just added two to the {$SERVICE.NAME.NOT_MATCHES} macro: WpnUserService and CDPUserSvc. Thanks for this!!
Both started firing alerts after a recent Windows agent install, BUT... In my case these (and potentially others in the future?!?!?) had an underscore and UID suffix. For example, "CDPUserSvc_337104e15" and "WpnUserService_337104e15"
I believe the same UID suffix means these are temporary services from a single user, possibly an orphaned service name?

Would it be possible to match the _HexStr (ANY HexStr) suffix and suppress all of this (and potential future) noise? My regex is weak, but I believe it'll be possible:

https://gist.github.com/daxburatto/307e8365c41fd5401f9ac315676490bf

CDPUserSvc.*
WpnUserService.*

[jtnfoley]

CDPUserSvc.*
WpnUserService.*

30 years in IT - I think I'm long overdue to learn regex!
Single * wildcard? <eldergeek hangs head in shame>