Windows Service Discovery not honouring regular expression result

[JePr]

Hello,

Not sure if I am doing something wrong here, but I have followed the same process as for a Zabbix server I built at a previous company. The new server is running 6.4.6.

I am using the Windows by Zabbix Agent template.

I am attempting to mask out some of the Windows services which are set to automatic, or delayed, but which do not run all the time. I have editted the regular expression in Administration > General > Regular Expressions > Windows service names for discovery. However, I am getting alerts for these services, even on new hosts which have been added to Zabbix since this was configured.

This is currently set as below:



When I run a test for one of the service names, it shows correctliy that it matches one of the lines, so returns FALSE, which should mean that this is not added during discovery process:



Has the behaviour been changeds, am I missing something?

Any help and advice greatfully received.

JePr

[cyber]

I am pretty sure your template does not use global regexes (those that start with @)... so you can edit those as much as you want, you still wont get any results... But one can never know... Just in case worth checking..

[JePr]

Has that behaviour changed? I am sure that is all I needed to do when I set this up previously. This was using the included Zabbix templates.

But, thank you for the pointer. That gave me the hint I needed. Checking back on the documentation, led me to https://www.zabbix.com/documentation...evel-discovery which described the usage of macros to filter items to be discovered. Searching the forum for this I found https://www.zabbix.com/forum/zabbix-...eing-monitored

Just in case anyone stumbles across this in the future, this is what worked for me:

I added a new macro in Data Collection / Templates / Windows by Zabbix Agent / Macros:

Name: {$SERVICE.NAME.NOT_MATCHES2}
Value: ^(edgeupdate|gpupdate|WinDefend|SUTService|WpnUser Service.*|CDPUserSvc.*|cbdhsvc.*)$

Then edited the filters in Data Collection / Templates / Windows by Zabbix Agent / Discovery Rules / Windows Services Discovery / FIlters:
New filter:
Macro {#SERVICE.NAME}
Rule: does not match
Regular expression: {$SERVICE.NAME.NOT_MATCHES2}

Dropping update interval to 10m and the keep lost resources period to 0d on the discovery rule tab then cleared all of the warnings.