solution for network discovery filters

[novint]

hello everyone,
i am trying to work with network interfaces discovery and trigger them in order to have notifications to my mail.
the problem is that the discovery process discover many many fiction interfaces or duplicate ones that are not active or just give me multiple alarms for the same issue.

i made my research in order to check for it, to look for a solution but the only one i found in the web(and correct me if im wrong here) is {#IFNAME} which doesn't really do much for help here.
so the only thing i left with is letting the discovery rule discover it's best and then disable it and move to delete the interfaces i do not want.

but then i have new problem poped up in the info status for items - "The item is not discovered anymore and will be deleted in 8d 22h 45m (on 10/08/2019 at 09:35 AM)."

so im kinda sitting here, helpless,
what do i have to do? keep the discovery rule on in order to have the right items and triggers not automaticlly deleted after few days but having useless and annoying ones being created in the background
do i have to keep it disabled and enable it once everytime its getting deleted and let it recreate it and also recreate bunch of them useless items and triggers in the process?
i kinda lose all of the point having automated monitoring system.

is there any solution in a form of a new macro/filter to make the discovery rule discover only active interfaces?

[dimir]

If I understood you correctly, discovery rule supports filters ("Filters" tab on the discovery rule configuration page):

https://www.zabbix.com/documentation/current/manual/discovery/low_level_discovery#discovery_rule

[novint]

If I understood you correctly, discovery rule supports filters ("Filters" tab on the discovery rule configuration page):

https://www.zabbix.com/documentation...discovery_rule

yes, Dimir. you understood correctly.
my problem is that this article you attached covers only file system discovery macros and not network interfaces one,
if i read and and seek more info about network discovery this is all i find - https://www.zabbix.com/documentation...ork_interfaces

which as i said before, include only {#IFNAME} macro
i seek usage of additionaly macros to narrow down the results

[dimir]

If you use Zabbix key net.if.discovery then yes, it only has the {#IFNAME} macro in the output, e. g.:

zabbix_get -s 127.0.0.1 -k net.if.discovery
{"data":[{"{#IFNAME}":"lo"},{"{#IFNAME}":"docker0"},{"{#IFNAME}":"eth1"}]}

Please keep in mind that you can use complex regex expressions to filter out what you don't need by the interface name.
If that is still not enough for your case, is there a chance for you to generate the data in JSON format using a script? Besides {#IFNAME} you could include in it e. g. {#IFSTATUS} and filter out the ones with unsuitable status. En example can be seen here.

[novint]

If you use Zabbix key net.if.discovery then yes, it only has the {#IFNAME} macro in the output, e. g.:

zabbix_get -s 127.0.0.1 -k net.if.discovery
{"data":[{"{#IFNAME}":"lo"},{"{#IFNAME}":"docker0"},{"{#IFNAME}":"eth1"}]}

Please keep in mind that you can use complex regex expressions to filter out what you don't need by the interface name.
If that is still not enough for your case, is there a chance for you to generate the data in JSON format using a script? Besides {#IFNAME} you could include in it e. g. {#IFSTATUS} and filter out the ones with unsuitable status. En example can be seen here.

im not sure i get your reply quite right..
do you mean there are more keys rather than net.if.discovery which have additional macros?

also,
how do i use complex regex? do i need to be familiar with JSON to some degree?

[dimir]

Let me try to explain this a bit.

1. net.if.discovery. Zabbix does not have any other built-in mechanism to get the list of interfaces from Zabbix agent. But there are 2 other options:
   • use SNMP agent (https://www.zabbix.com/documentation...very/snmp_oids) if you want to monitor a network devise
   • create custom low level discovery rule and a script that will feed it the data you want (https://www.zabbix.com/documentation...stom_lld_rules)
2. complex regex. It has nothing to do with the JSON. I mean you can filter out what you don't need by matching the name of the devise by regex pattern, e. g.:

   lld macro	regex	input	result	comment
   {#IFNAME}	(eth|ens).*	eth1	match	is processed
   {#IFNAME}	(eth|ens).*	ens123	match	is processed
   {#IFNAME}	(eth|ens).*	lo	no match	is not processed

Or you can try available templates from our community on https://share.zabbix.com and tune their macros, e. g. https://share.zabbix.com/network_dev...face-discovery
If this is too complicated for you, please keep in mind that Zabbix offers commercial support where cases like this are easily solved by a team of professionals: https://zabbix.com/support

[novint]

you also mentioned {#IFSTATUS} macro.. how do i put this to use?

[dimir]

This comes from the example of creating custom low level discovery rule. You will have to create a script that provides it.