Change the default discovery of windows services

[wuppi]

Hi ComputerHabit,
thank you. I noticed this or a similar post already during my research. Thank you. My problem (shame on me) was, though, that I didn't exactly know where to add this.
however, I finally got this solved by the following procedure.
I went to "Configuration" "Hosts" and selected the relevant server. I selected "triggers" on the top menue. From the list on the bottom of the page I selected the relevant trigger for the BITS-service and simply disabled it.
Well, it may be that this is basically what you tried to tell, I don't know. My way in the end was simply clickyclick for me as a newbie.
Thank you
Best regards
wuppi

[Roger.VanErp]

I am new to Zabbix and I have the same issue wit BITS, but I am afraid I I am confused and to what is needed to exclude that alert, does anyone have a screen shot of what needs to be set?

Thank you

[WebGreg]

Hmmm... did you read the previous posts?

You can do it in two ways.

1. Configuration > Hosts > select a host > Triggers tab > find all entries about the service you want to disable it > in column status click on status to disable it.
In Items tab find the service and disable checking for it.

2. Configuration > Hosts > select a host > Discovery rules tab > find correct rule (ex. Windows services discovery) > Go to filters tab > add new filter ex.:
{#SERVICE.NAME} does not much ^(CDPSvc|TrustedInstaller|BITS|OneSyncSvc.*|CDPUse rSvc.*)$

If the name of service is BITS you can write "BITS" or ex. "BI.*"

[Roger.VanErp]

WebGreg, thank you for the response. I added the suggested filter (option 2) last night, but today I seem to still be getting the "BITS" Problem coming back. I am new to Zabbix so any recommendations would be appreciated.

I am sure that it's documented but there did you come up with the expression ^(CDPSvc|TrustedInstaller|BITS|OneSyncSvc.*|CDPUse rSvc.*)$

[WebGreg]

You added exclude to the discovery rule. But your discovery is already done. The BITS has already been detected so how is the exclusion filter supposed to work? If you add this template to the new host - this service will not be discover,

If you change something in template already implementet - you have to clear all data on this host and discovery it again. Or go to items (and triggers) and delete item already discovered manualy. I suppose on items tab you will see an annotation that this service has not been detected and will be deleted ... in a month.

[Roger.VanErp]

Ok that makes sense. Thanks again for your assistance

[gwynll]

I'm new to Zabbix and, same as others in this thread, I'm having trouble getting these Windows service alerts to stop. Of course this feature is very useful for 95% of the services, but there's a few services that don't behave in the same way. Here's what I have in my 'Regular expressions' section.

Result is FALSE

^(MMCSS|gupdate|SysmonLog|clr_optimization_v.*|BIT S|WpnUserService_.*|CDPUserSvc_.*|CDPSvc|WbioSrvc| OneSyncSvc_.*|tiledatamodelsvc)$

After setting that, I then went to Configuration > Hosts and deleted all my hosts. I then rebooted those machines so that they would re-add themselves to the Zabbix server.

But unfortunately I'm still getting the same errors as before - even with BITS, which has no wildcards that could cause confusion.

What am I doing wrong?

As an alternative method, wuppi said this above...

I went to "Configuration" "Hosts" and selected the relevant server. I selected "triggers" on the top menue. From the list on the bottom of the page I selected the relevant trigger for the BITS-service and simply disabled it.

But does this need to be done for each host individually?

I'm very surprised that, within a few seconds of adding my first host to Zabbix, I've run into something so difficult to fix and is so poorly documented. I've had to completely pause my proof of concept of this product until this is fixed because it giving me too much noise at the moment.

Thanks.

[gwynll]

Hi cyber,

Yes, using the latest 5.2.6 - a fresh 'out of the box' install.

Aha, I see this now! Thanks I'll give that a go.

Just to make sure that my syntax is correct - for wildcard I'm using "dot asterisk". Is that correct for "zero or more characters"?

Thanks

[SebaFR74]

Hi, i would like to know, if this is possible to excluse those service, bits, biometric and truedinstaller, for 2 server and not all ? what do we need to do ?
thanks

[cyber]

https://www.zabbix.com/documentation/current/manual/config/items/userparameters

You assume that symbol asterisk "*" in regex has the same meaning that in Windows command line
It is wrong.
Check

https://www.zabbix.com/documentation/4.0/manual/discovery/low_level_discovery#discovery_rule_filter

- especially Filters description
Remove all "*" and try to discover again

Filters are used after discovery is done and it has nothing to do with how windows treats *-s. .. Just to save some room in that global regex (theres just 256 characters, IIRC), I woudl go and put clr_optimization_.* there...
Agent does not do any selection, what it discovers or not... it will pull full list, sends it back and only then preprocessing and filters are applied.