Discussion thread for official Zabbix Template for Windows

[AlexDiamantopulo]

Filesystem discovery rule has a problem. "{#FSNAME}: Total space" Creates items such as "C:: Total space". Please remove " : ". It should be "{#FSNAME} Total space" instead.

[BlueBull]

First of all thanks for creating and supporting this Windows template. I've been working at noob level ever since Zabbix 4 and had a Russian Windows Active template, but that wasn't updated in a while. Now I'm using this one.

The problem I'm having is with a OpenVPN Network adapter. If it triggers because is is offline, the alert on the dashboard doesn't go away after the connection is restored. If I look at the raw data when the adapter is online I get this:

{"AdapterType":"Ethernet 802.3","AdapterTypeId":0,"Availability":3,"Caption ":"[00000010] TAP-Windows Adapter V9","ConfigManagerErrorCode":0,"ConfigManagerUse rC onfig":"False","CreationClassName":"Win32_NetworkA dapter","Description":"TAP-Windows Adapter V9","DeviceID":"10","GUID":"{04E59E64-25B5-40E0-AB3B-C87A768C597B}","Index":10,"Installed":"True","Inte rfaceIndex":2,"MACAddress":"00:FF:04:E5:9E:64","Ma nufacturer":"TAP-Windows Provider V9","MaxNumberControlled":0,"Name":"TAP-Windows Adapter V9","NetConnectionID":"Ethernet 5","NetConnectionStatus":2,"NetEnabled":"True", "Ph ysicalAdapter":"True","PNPDeviceID":"ROOT\\\\NET\\ \\0000","PowerManagementSupported":"False","Produc tName":"TAP-Windows Adapter V9","ServiceName":"tap0901","Speed":"100000000", "S ystemCreationClassName":"Win32_ComputerSystem","Sy stemName":"DEMO037","TimeOfLastReset":"20200819142 921.494101+120"}

The recovery expression is {DEMO037:net.if.status["TAP-Windows Adapter V9"].last()}<>2 or {$IFCONTROL:"TAP-Windows Adapter V9"}=0

As you can see from the raw data the connection state is correct: "NetConnectionStatus":2. But still alert on the dashboard keeps active. So it must be the {$IFCONTROL:"TAP-Windows Adapter V9"}=0 part. But I don't get that. Can somebody help me?

Ps. I don't get warning messages if the service is started automatic. But the service needs to be started automatic (delayed). That seems to be the culprit. I (however) don't know how to fix this.

Sorry for reviving this discussion but I'm experiencing the same issue, on zabbix 5.0 (Template tooling version used: 0.34). The trigger fires and then stays in the problem state. I see that the problem expression is with a connection status of "net.if.status = 2" and recovery expression "net.if.status <> 2", however according to what I'm seeing the connection status "2" means "connected", not "disconnected", so I think this template is using the wrong values for problem and recovery expression and the problem expression should be "net.if.status <> 2". I also see that in the new template for version 5.4 they have reversed this and now are using "net.if.status <> 2" in problem statement and "net.if.status = 2" in recovery statement. Also, I noticed in the value mappings that 2 is also mapped to "connected". So, template error?

See: https://git.zabbix.com/projects/ZBX/.../windows_agent where they are using the reverse values and so seem to have corrected this. I noticed that even on Windows server 2003, value "2" means "connected" so it appears to have always been that way

And on this page they are using the reverse values than on the above link, with problem expression "net.if.status = 2" and recovery expression "net.if.status <> 2", this is also the case in the included template, which I think is the one from the following link: https://www.zabbix.com/integrations/windows

See here for microsoft documentation on WMI network status, section "NetConnectionStatus" which also mentions "2" = "Connected" : https://docs.microsoft.com/en-us/win...networkadapter

This would explain what eVal is experiencing as well as what I'm experiencing. I really hope I'm not missing something here of course, could be, apologies if that is the case

[applehc]

Hello,

I have monitorized one host but in Graph I only can see Network traffic, CPU jumps, CPU usage, CPU utilization, SWAP usage and Memory utilization.

I need monitorized hard disks and see used and free space, is possible?

Thanks

[vcnt]

Dude, i have the same problem just right now

[Roxo92]

Hi,

I am using the version 4.4.4 updated to 4.4.6 of Zabbix appliance.
Monitoring a Windows server 2019 with Zabbix agent
I use "Template OS Windows by zabbix agent"
The windows is a virtual machine running under esxi 6

I am encounterring some troubles:

1- Services false positives

each time i reboot it, i got thoose problems:


as you can see the service exists into Windows services and they are up, but the service name change at each reboot



Should i do something to prevent this trouble ?


2- Windows network

The template "Template OS Windows by zabbix agent" include "Template Module Windows network by Zabbix agent"
but i dont have any network informations.



Here is my network configuration:



Is there something i am missing to get it work ?

Thanks.

Hi Frogg,
For question 1, you can do this:

• Menù - Configuration - Templates
• If you use Tempalte OS Windows by Zabbix agent activeselect it - Discovery rules - Windows services discovery
• In the tab FIlters, enter this string
  • {#SERVICE.NAME} - does non match - OneSyncSvc_(.*)
  • {#SERVICE.NAME} - does non match - CDPUserSvc_(.*)
  • {#SERVICE.NAME} - does non match - WpnUserService_(.*)
  • {#SERVICE.NAME} - does non match - BITS
  • {#SERVICE.NAME} - does non match - TrustedInstaller

Andrea

[arjangoos]

When I try to import an new version of the windows template, there is an waiting circle that keeps spinning. There are more than 200 hosts with this template

[thomashohm]

Can you please add "VeeamVssSupport" to the pre-defined values of the macro "{$SERVICE.NAME.NOT_MATCHES}"?
As I understand this service, it is only triggered during veeam creating a backup and it is normal that it is not running all the time even as it is setup as startup automatically by default. Seeams a bit weird, but that's the information I found about it.

[HackIT]

To begin with I'm pretty much a noob with Zabbix. I'm running Zabbix 6.2 and am having trouble getting drive utilization alerts working on the Windows by Zabbix agent template.

I set {$VFS.FS.PUSED.MAX.CRIT} to 80% and {$VFS.FS.PUSED.MAX.WARN} to 70% on the template and I have one server running at 86% utilization with no alerts - I see other alerts fine.

When I look at the triggers for the Windows by Zabbix template the triggers for the drive utilization aren't there. I've imported the latest template with no change. I see the trigger prototypes under the discovery rules for the Template Module Windows filesystems by Zabbix agent so I tried linking that template to the Windows template and that didn't seem to work either.

It's been running for several weeks like this so I know I've waited long enough. I just can't figure out what it is that I'm missing, any help is greatly appreciated.

[cyrus96]

Hi everyone! After updating zabbix server to 6.2 from 6.0 windows template is no longer compatible with server 2003 R2, although zabbix manual states that Windows xp is still supported.
Can you update manual https://www.zabbix.com/documentation...n/requirements and write that only Windows Vista and higher supported, or fix agent to support Windows XP?
Agent log after fresh install:

   3736:20220831:125652.131 Starting Zabbix Agent [c02]. Zabbix 6.2.1 (revision 2c382976146).
  3736:20220831:125652.131 **** Enabled features ****
  3736:20220831:125652.131 IPv6 support:          YES
  3736:20220831:125652.131 TLS support:           YES
  3736:20220831:125652.131 **************************
  3736:20220831:125652.131 using configuration file: C:\Program Files\Zabbix Agent\zabbix_agentd.conf
  3736:20220831:125653.037 agent #0 started [main process]
  4988:20220831:125653.037 agent #1 started [collector]
  4128:20220831:125653.037 agent #2 started[listener #1]
  5020:20220831:125653.037 agent #3 started[listener #2]
  5352:20220831:125653.037 agent #4 started[listener #3]
  3696:20220831:125653.084 agent #5 started [active checks #1]
  5352:20220831:125746.319 PdhAddEnglishCounter() is not available, perf_counter_en[] is not supported
  4128:20220831:125746.319 PdhAddEnglishCounter() is not available, perf_counter_en[] is not supported
  5020:20220831:125746.334 Unhandled exception c0000005 detected at 0x00020005. Crashing ...
  5020:20220831:125746.334 ====== Fatal information: ======
  5020:20220831:125746.334 Program counter: 0x20005
  5020:20220831:125746.334 === Registers: ===
  5020:20220831:125746.334 edi     =                1 =                    1 =                    1
  5020:20220831:125746.334 esi     =          2f7e86c =             49801324 =             49801324
  5020:20220831:125746.334 ebp     =          2f7e7fc =             49801212 =             49801212
  5020:20220831:125746.350 ebx     =                0 =                    0 =                    0
  5020:20220831:125746.350 edx     =          2a00001 =             44040193 =             44040193
  5020:20220831:125746.350 eax     =           1edf28 =              2023208 =              2023208
  5020:20220831:125746.350 ecx     =           1ea410 =              2008080 =              2008080
  5020:20220831:125746.350 esp     =          2f7e7bc =             49801148 =             49801148
  5020:20220831:125746.350 efl     =            10202 =                66050 =                66050
  5020:20220831:125746.350 csgsfs  =         1b003b00 =            452999936 =            452999936
  5020:20220831:125746.350 === Backtrace: ===
  5020:20220831:125746.584 3: C:\Program Files\Zabbix Agent\zabbix_agentd.exe() [0x20005]
  5020:20220831:125746.584 2: C:\Program Files\Zabbix Agent\zabbix_agentd.exe() [0x4676a5]
  5020:20220831:125746.584 1: C:\Program Files\Zabbix Agent\zabbix_agentd.exe() [0x46842d]
  5020:20220831:125746.584 0: C:\Program Files\Zabbix Agent\zabbix_agentd.exe() [0x4e207463]
  5020:20220831:125746.584 ================================
  4988:20220831:125747.178 PdhAddEnglishCounter() is not available, perf_counter_en[] is not supported​

Tried LTS 6 and LTS 5 agent as well, same output.

As stated in microsoft documentation, PdhAddEnglishCounter() requires Windows Vista or Server 2008 https://docs.microsoft.com/en-us/win...nglishcountera

[Akraz]

To begin with I'm pretty much a noob with Zabbix. I'm running Zabbix 6.2 and am having trouble getting drive utilization alerts working on the Windows by Zabbix agent template.

I set {$VFS.FS.PUSED.MAX.CRIT} to 80% and {$VFS.FS.PUSED.MAX.WARN} to 70% on the template and I have one server running at 86% utilization with no alerts - I see other alerts fine.

When I look at the triggers for the Windows by Zabbix template the triggers for the drive utilization aren't there. I've imported the latest template with no change. I see the trigger prototypes under the discovery rules for the Template Module Windows filesystems by Zabbix agent so I tried linking that template to the Windows template and that didn't seem to work either.

It's been running for several weeks like this so I know I've waited long enough. I just can't figure out what it is that I'm missing, any help is greatly appreciated.

How did you change the percentage? Our issue is we have the template on large file servers and 90% utilization is still ~600GB free which is a false alert. i would like to change it to either a numbered value (<100gb) or 99%

[aydeisen]

How did you change the percentage? Our issue is we have the template on large file servers and 90% utilization is still ~600GB free which is a false alert. i would like to change it to either a numbered value (<100gb) or 99%

The default Zabbix template (my experience is with v5.4+, and with templates with tooling versions 0.38+) has two trigger expressions in the filesystem module with the following criteria:

• Disk Used Space is greater than X % (default 80% for the "low" trigger and 90% for the "very low" triggers) AND EITHER
  • Free Space is less than Y (default 10GB for the "low" trigger and 5GB for the "very low" trigger) OR
  • based on the last 1 hour of Zabbix recorded metrics, Zabbix projects that, should the trend continue at that pace, the disk will be full within 24 hours.

So, based on that: HackIT is most likely not getting an alert at 86% because one of the secondary criteria is not being met. Akraz situation should qualify: 90% Used with 600GB free would NOT generate a problem event based on that criteria, unless someone starts copying a huge file that would make Zabbix think the volume is about to run out of space.

Akraz: in your situation, I would ask what version of the template you're using, or whether someone decided to change the expression for those triggers.

To answer your question though: the values for the Used Space percentage and Free Space value are MACROS in the Windows filesystem by Zabbix / Zabbix Agent templates. They're the ones that start with $VFS.FS.FREE.MIN and $VFS.FS.PUSED.MAX

[Maxburn]

I was a little surprised that I can't seem to get a report of windows version with this template. That's a pretty important item for asset inventory. Is there some way I can get that info out of zabbix?

[aydeisen]

I was a little surprised that I can't seem to get a report of windows version with this template. That's a pretty important item for asset inventory. Is there some way I can get that info out of zabbix?

It exists as part of the System Description Item included in the default tempate; that item just doesn't have 'Populates host inventory field' configured. If that's set in the template, that value will start populating in the Inventory tab

[oriator]

I´ve just switched from Zabbix 4.0.12 to 4.4 by doing a fresh install just because of switching from appliance to a self installed system. The installation worked fine and all hosts are imported to zabbix but after finding the new templates and trying them one important thing is missing for me: The new template doesn´t monitor Windows Services which was always the most important benefit for me to use Zabbix.

[oriator]

I have monitorized one host but in Graph I only can see Network traffic, CPU jumps, CPU usage, CPU utilization, SWAP usage and Memory utilization.
tea tv apk
hellodear.in

[RadicalEd]

The most recent (6.4.0) Template misses a LLD macro, because of this no Labels are shown within the Filesystems Items or Triggers.