A template to disable alerting on certain services? Is that possible?

[tommyketchup]

Hi folks,

I hope someone can help me with this. I am a newbie to Zabbix, but have managed to get it installed and working in our environment, and have rolled it out to some of our estate for monitoring, approx. 5%.

What I have noticed is that when ever I roll it out to a new server, the service discovery triggers go out and do their job for about 98% of the time successfully, and miss out a few things. ( I will raise another topic for this, but I will try to unlink and clear first and see if it picks up the services again first, but I digress )

So when I have added a new server, and all the services have been discovered, I then have to go through the process of disabling the alerts on certain services, that I don't want monitored, or that have a tendency to stop/start, which are constantly throwing up errors.

Services like :

Service "BITS" (Background Intelligent Transfer Service)
Service "clr_optimization_v4.0.30319_64" (Microsoft .NET Framework NGEN v4.0.30319_X64)
Service "wuauserv" (Windows Update)
Service "sppsvc" (Software Protection)

So is it possible to have a template in which I can populate a list of services that I want disabling the alerts on, and apply this to the host, as well as the autodiscovery template.

Regards
TK

[aigars.kadikis]

Hi, tommyketchup!

There are some excludining list by default already available. You have to append some new unwanted service names in:


Once you have master your list you can do "instant clean up trick" by opening "Windows service discovery" rule and set "Keep lost resources period" to 0:


Please set this number back to some x days once you have achieved a clear service list.
Leaving "keep lost resource period" as 0 is not recommended in production environment. In case if your "important" service somehow gets to the state "unsupported" then the service by itself will be removed prety much instantly from zabbix host and all his related history and trends will be removed from database.

Regards,
Aigars

[tommyketchup]

Hi Aigars,
Thanks for the response, but lets pretend I am stupid, (which isn't a long stretch of the imagination :P ), and can you knock up what it would look like for the following service : "wuauserv" (Windows Update).
Regards
TK

[adam.cormany]

I'm having a similar issue. I'm using Zabbix 5.0.3. Zabbix continues to alert me on services that aren't running, then running, and repeat continuously for BITS, wuauserv, and OneSyncSvc. I've tried adding a new expression to the Windows service names for discovery regex as shown below (only wuauserv and BITS to test against currently) but I continue to be alerted on services stopping and starting.



Is there something else I need to do to disable the check and alerting on Windows services I wish to ignore?

Thanks,
Adam

[adam.cormany]

Thanks cyber. I moved wuauserv, BITS, and OneSyncSvc to the existing regex. Unfortunately I'm still getting alerts that the services stop and start regularly. Is anyone else seeing this and have a solution?

As far as creating a JS preprocessing as another route to ignore these services, can you elaborate on how I can accomplish this? I've not done that yet in Zabbix.



Thanks,
Adam

[adam.cormany]

I did remove all previously discovered wrong services as you mentioned but no luck.

I tried the JS preprocessing approach but that didn't work. I found the underlying issue through this effort though:

$ zabbix_get -s <IP> -p 10050 -k service.discovery | wc -c
118312

When testing the JS, I noticed the output is getting cut off at 65535... I read in the Zabbix documentation for agent and agent 2, the BufferSize is 65535 unfortunately. Because of this, the JSON is incomplete on the returned data from the agent and is instead interpreted as a string as it's cut off and missing possible combinations of ", }, or ].

My followup questions now are:
1) Is there a way to increase the BufferSize beyond the maximum in the documentation? I'm guessing not but wanted to ask.
2) Is there a way for me to modify service.discovery somehow to not return {#SERVICE.DESCRIPTION} to reduce the dataset size sent? Or possibly create a copy of service.discovery and modify it to return smaller segments?


Thanks,
Adam

[adam.cormany]

Thanks for the clarification cyber. I was thinking that was the limitation but misunderstood the setting.

This morning I tried service.discovery against another Windows server that isn't going through a proxy and was able to get the full JSON data. Is there a limitation on data being sent through a proxy? I've tried all Windows servers behind the proxy and the data is being cut off at 65535. Not behind a proxy I get all data.

Thanks,
Adam

[cyber]

Adding exceptions in this way will never succeed. Have you tried that "Test" section there?
Your "value" has to pass BOTH regex lines for this regex to return TRUE and cause ignoring of that service during discovery. Whatever you feed to it right now, it will match max one line and whole result will be false, thus that service is still discovered. Add your wuauserv and BITS to same line as all others and it should work. That line used to be ~255 characters, so you may run out of space. I do not know if it has been increased for v5 or not...
Other way would be create JS preprocessing, which would handle all the ignoring of services and which does not have such stupid field length restriction...
EDIT: My posts here are out of sequence due to human error and restoring of posts, try to fit them between other posts in thread, you should get a bit more clear picture.

[cyber]

Did you clean up also, removed all those previously discovered "wrong" services? They may be marked as "not discovered any more", but IIRC it will continue to monitor those until removed...

About JS preprocessing. In discovery rule, navigate to "preprocessing" tab, select "javascript" from dropdown and add script to other field. Some JSON parsing functions should help you out (define a blacklist, if blacklisted service is found by preprocessing, drop it out from json and continue). Use testing there to make sure it works. You can take full "service.discovery" output from command line and use it for testing and verify that everything, what should be ignored, is ignored...

[cyber]

BufferSize defines how many items it sends at once, not the amount of bytes... https://www.zabbix.com/documentation.../zabbix_agentd
There must be somethng else, that breaks your json.

[cyber]

I cannot answer that. There should not be any such restriction.

[JanIgaard]

I have a new installation of zabbix ver. 5.2 running, seems like I don't have the default "Windows service names for discovery", I'm not sure if it was deleted or never been there, as i have overtaken this task from another consultant who isn't here any more...

What I have is like the below picture, and I don't see any place where i can set the "keep lost resource period" to zero, can you help me pointing this out in version 5.2?

[cyber]

If it is a completely new instance, then you should modify macros in templates and not look for global regexes...
"Keep lost resources" is setting in discovery config.