Disabling alerts for certain services

[paulhazo]

Hi, I have recently set up a Zabbix server (6.2.1) in our environment to monitor a couple of hundred workstations using the Windows by Zabbix agent active. Also, I have configured a user to receive the notifications to a Slack channel.

I know this has been asked multiple times, as I was searching for a solution for it. But, it doesn't seem to be working for me.

I want to stop receiving alerts for a couple of services that are not running: (below are 2 as an example)

Problem: "dmwappushservice" (Device Management Wireless Application Protocol (WAP) Push message Routing Service) is not running (startup type automatic delayed)
Problem: "edgeupdate" (Microsoft Edge Update Service (edgeupdate)) is not running (startup type automatic delayed)

I tried the following: (each alone and not together)

1. Configuration -> Templates -> Windows by Zabbix agent active -> Macros -> adding the service names in {$SERVICE.NAME.NOT_MATCHES} or creating a new macro and adding it to the Discovery Rules filters. Both didn't solve my problem.
2. Administration -> General -> Regular Expressions -> Windows service names for discovery -> adding the service names in the already existing expression or creating a new one with Return is FALSE type. Both didn't work for me.

Is there something I'm missing that's not solving my problem? Or is there any other way to go about fixing this?

I appreciate your help and sorry if I'm sounding like a n00b, that's because I am!

Thanks!

[cyber]

That number 2, regex in Admin/General... that shoudl not be touched, your templtes do not use it.

I think your logic in that filter is wrong, if you want to use 2 separate exclude macros... (A and B and C) ... it will never become true, if you think a little here.
I think it should be (A and (B or C)) .

[paulhazo]

Thanks for the response cyber. I have joined them all under the same macro now to make it easier but I'm still getting alerted.

[zpsgpm]

Hi paulhazo

Did you solve your problem? I've the same and also tried adding "edgeupdate" to $SERVICE.NAME.NOT_MATCHES, but had no luck.

So far I couldn't find another solution...

[jhboricua]

For managing my exclusions, I use the 'Windows Services names for discovery' regex under Administration -> General -> Regular Expressions rather than {$SERVICE.NAME.NOT_MATCHES} as I found the former to be more flexible and easier to manage. This is what my 'Windows services discovery' Filters section looks like:



And the regex:



This works well for me and excludes the services I don't wan't discovered. And IMHO, it is easier to read and manage.

[cyber]

So "matches everything that does not match another rule"... my brain does not work that way..
Having such a long list to ignore, I would go already opposite way... match only those, what are needed and ignore everything else..

[jhboricua]

Having such a long list to ignore, I would go already opposite way... match only those, what are needed and ignore everything else..

I'd love to go that route, but unfortunately on large windows deployments that list becomes even worse IHMO.

[Yarin Levy]

Does it take time to remove the alerts? I set up mine as you guys said but alerts are still there...

[jhboricua]

By default the discovery keeps lost items for 30 days before they are removed from the monitored host:


You can temporarily change the 'Keep lost resources period' value to 0 and manually execute a discovery on the hosts so they immediately drop the excluded services and alerts.

[Yarin Levy]

Ohh thanks!