Windows Service Discovery

[Ben488]

Hello all,

Zabbix v3.4

I'm trying to figure out how to turn off and also create specific service alerts from the Windows service discovery (Defauls Template OS Windows).

I think this thread has pointed me in the right direction with the following, however I do not want to disable all, only a select few. ( https://www.zabbix.com/forum/showthread.php?t=59372 )

"To disable the discovery of services you'll need to do the following:

1. Go to Zabbix web page>Configuration>Templates.
2. Click on the "Template OS Windows" template
3. Click on Discovery rules at the lower sub-heading area
4. On the Windows service discovery item, click the Enabled linked word under the status column"

There is a Filter section in this discovery rule, If this is the area I need to use, could anyone advise on how to build the expressions I should use?

Example services that I want to remove alerts for -

Service "TrustedInstaller" (Windows Modules Installer) is not running (startup type automatic)
Service "VeeamVssSupport" (VeeamVssSupport) is not running (startup type automatic)
Service "VeeamVssSupport" (VeeamVssSupport) is not running (startup type automatic)
Service "VeeamVssSupport" (VeeamVssSupport) is not running (startup type automatic)
Service "CDPSvc" (Connected Devices Platform Service) is not running (startup type automatic delayed)
Service "OneSyncSvc_615a0" (Sync Host_615a0) is not running (startup type automatic delayed)
Service "TrustedInstaller" (Windows Modules Installer) is not running (startup type automatic)

[kaspars.mednis]

There is already global regular expression named Windows service names for discovery in

Administration -> General -> Regular Expressions (dropdown on top right)

You can just extend it with your uneeded services, then use it as a filter in LLD rule

Regards,
Kaspars

[Ben488]

Thank you Kaspers.

Could you advise on how the structure of building Expressions here work and how to specify a service here?

The current expressions are

"^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.5 0727_32|clr_optimization_v4.0.30319_32)$"

[kaspars.mednis]

Just add another service name after the | sign inside the brackets ( )

You can also add other expressions here with the add link, and then test the result in the Test tab (combined result must be false for excluded service name)

https://www.zabbix.com/documentation/3.4/manual/regular_expressions

Regards
Kaspars

[Ben488]

Perfect, thank you Kaspers.

[gherbstman]

I would also recommend removing the $ at the end. That way is will match services that begin with rather than an exact match. You can have then have (clr_optimization) that will match all the versions and variants.

^(sppsvc|wsbexchange|ShellHWDetection|WbioSrvc|Map sBroker|CDPSvc|TrustedInstaller|UI0Detect|MMCSS|gu pdate|SysmonLog|clr_optimization)

[glardz]

i tested that
^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.50 727_32|clr_optimization_v4.0.30319_32|Cb*)[Result is FALSE]

but not work

[daohai]

it's not working . do you have another way ?

[doum]

The problem of tihs method is that it disable service from discovery...It will be better I think to discover them, but automatically disable the trigger based on service name.

[thetinkergnome]

For me, adding all the services I want to filter out to a single regular expression can get a little hard to manage and troubleshoot. Instead, I add a new expression to the "Windows service names for discovery" expression each time. I set the type to "Result is FALSE" and then enter in the service name I want to filter out.

It's important to note that if you already have a trigger in the Problem state, and you add an expression to ignore this service, the trigger will not go away for 30 days (I think). If you want it to go away from the Problems screen immediately, you need to go to the item and the trigger on the host and disable them.

Dave

[doum]

For me, adding all the services I want to filter out to a single regular expression can get a little hard to manage and troubleshoot. Instead, I add a new expression to the "Windows service names for discovery" expression each time. I set the type to "Result is FALSE" and then enter in the service name I want to filter out.

It's important to note that if you already have a trigger in the Problem state, and you add an expression to ignore this service, the trigger will not go away for 30 days (I think). If you want it to go away from the Problems screen immediately, you need to go to the item and the trigger on the host and disable them.

Dave

can you explain more what you do with example ?

[thetinkergnome]

By default, Zabbix has a global regular expression called "Windows service names for discovery". It contains an expression where the type is "Result is FALSE" and has an expression like this (not including the quotes) "^(sppsvc|MMCSS|gupdate|SysmonLog)$". What I do is click the "Add" link just below that in the expression editor and create a new expression. I set it to "Result is FALSE" and set the value to whatever service I do not want to create an item and trigger for. You can just put in a substring here and it will catch anything that matches.

For example, on a 2016 Remote Desktop server, for every user that logs in a dynamic service called "CDPUserSvc_xxxxxxx" is created and set to Automatic. When they log out, the service is deleted. This makes Zabbix very unhappy. So, if you add an expression to the "Windows service names for discovery" expression, set it to "Result Is False" and set its value to "CDPIserSvc" all of these services will be ignored by Zabbix.

You could just add the services you want to ignore to the existing expression that comes with Zabbix, but I have found it harder to get to work as expected. The way I outlined above works every time for me

Dave

[doum]

oh ok it's just more readable but it's the same

personnaly I prefer if the template import all the service, but if we could have a way to easely disable trigger (based on a macro or regular expression like this)

but for the moment I do this too, for lack of anything better.

[thetinkergnome]

So you would prefer that Zabbix imports some items/triggers as disabled? I'm curious - what is your reasoning behind that?

[doum]

So you would prefer that Zabbix imports some items/triggers as disabled? I'm curious - what is your reasoning behind that?

Don't know
be able to know how many server have this service, or maybe because a service one day can be "not wanted to monitor because not always running" on 95% of server, but not on all.

currently the exclusion is global.

but it's not a massive problem. currently i have disable the import for these services.