Windows services messages

[Ton]

Zabbix seems to be bothered a lot by services that to up and down. Even the ones that do it by default. As in it is the way they fucntion. Here are a few examples:

• Service "sppsvc" (Software Protection) is not running (startup type automatic delayed)
• Service "Pml Driver HPZ12" (Pml Driver HPZ12) is not running (startup type automatic)
• Service "Net Driver HPZ12" (Net Driver HPZ12) is not running (startup type automatic)
• Service "sppsvc" (Software Protection) is not running (startup type automatic delayed)
• Service "gpsvc" (Group Policy Client) is not running (startup type automatic)

They keep going up and down and this is alone with my 2 tests hosts that are running the agent. I can't image what this will give me when i add additional hosts that run way more then these two desktops.......

Any proper way to handle this or to add exceptions to this query? Thank in advance.

[kaspars.mednis]

Hello !

I assume you are using Windows Service LowLevelDiscovery (LLD) ? Is there some template

the problem is that all services are discovered, but some services are flapping up/down and triggers are fired constantly ?

Regards,
Kaspars

[Ton]

Hello !

I assume you are using Windows Service LowLevelDiscovery (LLD) ? Is there some template

the problem is that all services are discovered, but some services are flapping up/down and triggers are fired constantly ?

Regards,
Kaspars

Hi Kaspars,

Sorry if i was unclear but it does seem: "Windows service discovery" detecs all those services and then reports them flapping...

[kaspars.mednis]

Maybe you can exclude and not detect some unimportant services ?

If you have the Zabbix built in template Template OS Linux, there is a perfect example

go to this template->discovery rules->Network interface discovery

there is a second tab named filters, with filter {#IFNAME} = @Network interfaces for discovery

This is global regular expression, which can be found in Administration->General->Regular expressions (dropdownbox on the right)

expression Network interfaces for discovery defines all interfaces NOT TO DISCOVER

So you can create your own regular expression with your own rules for windows services

P.S.
Here is similar topic https://www.zabbix.com/forum/showthread.php?t=59567

Regards,
Kaspars

[Pitons]

Exclusions for windows service discovery

Which version of zabbix do you use?
In 3.4 if you are using:
Template OS Windows for those hosts:
Open that template and go to -> Discovery rules -> Windows service discovery
On the Filters tab you will see macro:
{#SERVICE.NAME} matches: "@Windows service names for discovery"
Meaning that rule is used as filter

If you wan't to exclude those flapping ones, as I did, go to:
Administration -> General and on the right in a dropdown find:
Regular expressions section.
Find "Windows service discovery" in the list
Just add antother Expression that results in false
Expression: ^(<SERVICE1>|<SERVICE2>)$

See original one as example

[Ton]

Thanks to both of you!

I added "^(sppsvc|gpsv|Pml Driver HPZ12)$" with "[Result is FALSE]" for now in the Regulair expression option of "Windows service names for discovery". I assume the alarm will fade after a while.

[kaspars.mednis]

Already discovered services will stay Keep lost resources period specified in discovery rule, even if they are no longer discovered. So triggers will fire up for 30 more days, if the default period is set.

ways to speed up things

- delete not discovered items manually (they are marked with yellow !sign), they will not reappear
- shorten for a while this period in template to 1 day (not 100% sure it will work, not tested by myself but must work)
- unlink and relink template (fastest way, but you will loose all historical data for valid items)

Regards,
Kaspars

[Ton]

Already discovered services will stay Keep lost resources period specified in discovery rule, even if they are no longer discovered. So triggers will fire up for 30 more days, if the default period is set.

ways to speed up things

- delete not discovered items manually (they are marked with yellow !sign), they will not reappear
- shorten for a while this period in template to 1 day (not 100% sure it will work, not tested by myself but must work)
- unlink and relink template (fastest way, but you will loose all historical data for valid items)

Regards,
Kaspars

I deleted the two tests hosts. I assume zabbix should readd them after a while. If not i'll see for tomorrow since my time is almost up for today Thanks!

[Pitons]

Hi Ton
Glad it helped, re added hosts shouldn't have those services any more.

Good luck then!