Exclude some systemd services from Systemd Template in Zabbix 5.4

[limace255]

Hi everyone,

I switched to Zabbix 5.4 recently, and wanted to test Systemd Template.
Discovery is perfect, maybe too much indeed : some useless services (container-getty for an LXC container, for example) are seen as "not running".
I saw a variable called {$SYSTEMD.NAME.SERVICE.NOT_MATCHES}, with default value to CHANGE_IF_NEEDED --> pretty sure that it's what I want, but I have no idea of what to replace it by.
Tried service name, with/without ".service", makes no change.

If anyone has some feedback about this, it'll be very appreciated

[splitek]

https://www.zabbix.com/integrations/systemd

{$SYSTEMD.NAME.SERVICE.MATCHES}	Filter of systemd service units by name	.*
{$SYSTEMD.NAME.SERVICE.NOT_MATCHES}	Filter of systemd service units by name	CHANGE_IF_NEEDED

Just put your service names, it need to be regex

[darkobas]

limace255 did u get this working ?

[limace255]

Hi darkobas,
I deactivated it globally because of too much alerts, but today I will test again on a single container.
I'll let you know

[darkobas]

Yea it works as stated above. I was just filtering wrong in latest data and didn't see them

[limace255]

Ok, got it, the syntax is regex, following Zabbix examples I managed to avoid warnings for 2 services:

^([email protected]|rsync.service)$

Screenshot here :


Source for regex : https://www.zabbix.com/documentation...ar_expressions

[swefredde]

I have followed the instructions mentioned in the above post by limace255 but I still got "servcie not running" warnings in my Problems tab. It works if I only use the "${SYSTEMD.NAME.SERVICE.MATCHES}" Macro and add a few services. Then when I stop any of those I get a warning as expected. But when I try to exclude a handful of services by using the "${SYSTEMD.NAME.SERVICE.NOT_MATCHES}" and list a handful of services I still got warnings about these services not running. Even if I delete the warnings they are reoccuring at the default 30 minute inteval. I'm used to work with regular expressions and have tried all possible variants without success.

I have tried this on both Zabbix server/agent2 version 5.2 running on RHEL7/8 at work and Zabbix server/agent 6.2 running CentOS8/9-Stream in my home lab. I don't edit the template but add the Macro on the host level. That should trump the template setting I suppose?

In the docs it's stated that the zabbix-agent must be compiled "with systemd support" or similar. I assume the RPM's installed from RHEL7/8 and CentOS8/9-Stream have the support compiled in by default? How do I check that?

In my first googling attempts I ran into someone stating that the discovery might need to be rerun after the change of the Macros. Is that true and how do I do that. Problem persists through reboot of the server/clients.

[z0nk]

I have same problem, exported all to CSV, sort uniq, . to \., | as separator:

[...]dmesg\.service|e2scrub_reap\.service|grub-common\.service|grub-initrd-fallback\.service[...]

and still not working for *some* services that are in this regexp

[markfree]

The {$SYSTEMD.NAME.SERVICE.MATCHES} macro can be used to filter services using a regular expression that matches only the filtered service names. Tô do this, the value of the macro should be configured at the host level. By default it matches everything (.*).

On the other hand, the {$SYSTEMD.NAME.SERVICE.NOT_MATCHES} macro filters out the services. By default, this macro uses the CHANGE_IF_NEEDED value, so the user can change it if needed.

Depending on the monitoring target, similar to firewalls, I find that it is best to use use a white list for SystemD service discovery. Usually, there's no need to monitor all services, just the relevant ones.

The discovery rule is based on regular expressions and they must match the target services correctly.