Disabling services in Windows template fails

[dkoski]

The services events in the Windows Zabbix agent create an unnecessary load on the Zabbix system and we never actually used them. First I disabled the triggers and that helped. Then I disabled the item prototype. But still it is updating service status on tons of items that is loading the system down. I have deselected "Create enabled" and "Discover" in the item prototype as well as disabling "Enabled" in the discovery rule. All to no avail. How can I stop logging services without modifying the template definition?

Zabbix version 6.0.

[solution]

You can:

Disable all:
disable discovery services in the template or host.

Whitelist: Discovery specified only
Use the Macro {$SERVICE.NAME.MATCHES} in the Template or Host

Blacklist: Discovery everything except listed
Use the Macro {$SERVICE.NAME.NOT_MATCHES} in the Template or Host


Wellington

[dkoski]

I have disabled "Windows service discovery" in the template "Windows by Zabbix agent" to no avail. I have changed the regular expression "Windows service names for discovery" to exclude all with no change in outcome. Failing that, I created a new template clone of "Windows by Zabbix agent" to include only templates "Windows CPU by Zabbix agent", "Windows filesystems by Zabbix agent", "Windows generic by Zabbix agent", "Windows memory by Zabbix agent", "Windows network by Zabbix agent" and "Windows physical disks by Zabbix agent". That should eliminate all checks on all services. Nothing changed. I have yet to try the macro suggestion above and I will, but it seems redundant to all I have tried already.

[Edit] I also disabled the item prototype for the "Windows services discovery" rule.

[solution]

In my environment I do not monitor services.
So I disabled discovery in the template.

Note: Valid for new Hosts only.

For hosts that discovery has already identified services and is monitoring, you can:
- delete discovered items manually or
- remove the template from hosts (Unlike and Clear) and add the already modified template again.

Wellington

[dkoski]

Thank you soution,

Please explain "delete discovered items manually". I have modified the template to remove discovery of services altogether and saved it as another name, then did the Unlink and Clear, then added the modified template with no change in outcome.

[edit]

I found that when I copied the template, I ended up with duplicate UUIDs because I did not do a full clone. I have now done a full clone and imported to eliminate duplicate IDs. But after doing an Ullink and Clear, the items still persist and can be seen in Latest Data. Now I'm testing removing the host and adding the template without services and no duplicate UUIDs.