Excluding services from Windows Discovery

[ald]

I couldn't find an answer to this. So, sorry in advance if I missed it.

I need to skip 4 services (RemoteRegistry, TrustedInstaller, sppsvc, ShellHWDetection) from detection as they run on demand in Windows 2012 R2. I went to Administration > General > Regular expressions and added them to 'Windows service names for discovery', but Zabbix is still reporting problems with those services.

Here is the updated regular expression:
Expression type:

Result is FALSE

Expression:

^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.50727_32|clr_optimization_v4.0.30319_32|RemoteRegistry|TrustedInstaller|sppsvc|ShellHWDetection)$

When I test the expression with one of the service names it comes back FALSE as the combined result. But, Zabbix keep triggering problems when the services stop.

Thanks,
Al

[charlie.gregorio]

I have this same problem. already put the services, but they continue to appear in the discovery.

[ivanhansson]

Not sure about my answer but just try this


MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.5072 7_32|clr_optimization_v4.0.30319_32|RemoteRegistry |TrustedInstaller|sppsvc|ShellHWDetection

skip the first part ^( and the last part )$

Don't see any reason for those to be there when you searching for just a part.

Keep in mind that I'm new on this

[charlie.gregorio]

This my configuration, in my language:

Windows service names for discovery

1 » ^(OneSyncSvc.*|TrustedInstaller|CDPSvc|VeeamVssSup port|MMCSS|gupdate|SysmonLog|clr_optimization_v2.0 .50727_32|clr_optimization_v4.0.30319_32)$ [Resultado é FALSO]

in my monitoring show this alert for example:
"TrustedInstaller" (Windows Modules Installer) is not running (startup type automatic)
"OneSyncSvc_60887" (Sync Host_60887) is not running (startup type automatic delayed)

[aib]

OK
When you updated your Discovery expression, it means that next time all listed services will be skipped during discovery and related items/triggers will not be created.
But it absolutely unrelated to existing Items/triggers which was discovered earlier.
Please, to be sure - delete all Discovered services" and "Discovered triggers" and give auto-discovery a try to recreate it.
Also, you can just manually disable triggers which you don't like and stop worrying about useless services.

[charlie.gregorio]

in the case of this OneSyncSvc_3d05d69c service "(Sync Host_3d05d69c) is not running (startup type automatic delayed) it always comes up with a new name. how do I resolve this issue?
I did so, but it does not solve OneSyncSvc. *