service.info not retrieving all services

[klaauser]

Hi - running Zabbix 3.2.2 on CentOS here.

My problem is that I've added a host with a discovery rule (

service.discovery

) with no filters on it. The discovery rule then adds one Item for every service with the following key:

service.info[{#SERVICE.NAME},state]

The host has added 102 services.

My issue is that there are 180 services installed on that machine (Info gotten from PowerShell - (

gwmi win32_services).count

). If I filter that to only running services I get 99.

The even stranger thing is if I run a zabbix_get from my Zabbix server with an Item key I expect to be there but isn't, I get a proper response, so I know that Zabbix "sees" these lost services, but why isn't it creating Items for them??

Any assistance would be greatly appreciated,
Thanks.

EDIT: I just tried manually creating the Item and it successfully pulled data. This is definitely not a solution I just wanted to see what would happen... now what is stopping my Discovery rule from picking up these 78 services??

[Pada]

What version of the Zabbix Agent are you running on your Windows machine, because its the Zabbix Agent on that Windows machine that does the discovery, so the version is quite important.

Then also run the following zabbix_agentd command to output the discovered services to a text file, and then you can compare the amount of "{#SERVICE.NAME}" with the amount of items in Zabbix:

zabbix_agentd.exe -c <path to config> -t service.discovery > services.txt

[klaauser]

Running Zabbix Agent 3.2 across the board. When I run the code you suggested on the Host, the output that I get includes the service that is missing. So the agent is responding both on the agent and from the Zabbix server with the correct data, but for some reason the web client isn't displaying all of the data gathered. I just double checked and there is NO FILTER on the service.discovery rule that should be blocking these things out.

[Pada]

It is possible that the response that it's sending to the server is too big.

What is the file size of that services.txt that it created? Is it larger than 512KB?

I mentioned 512KB, because its the only thing that I could find by Google searching: https://support.zabbix.com/browse/ZBX-5863
Perhaps there is a different restriction on the server.

This may also be related to https://www.zabbix.com/forum/showthread.php?t=49259

Unfortunately I haven't worked on the C code of Zabbix yet, so I'm not sure where to look for this issue.

[klaauser]

The file is only 94KB... so it's not that. Thanks for your help/suggestions!

[Hoefi EWC]

zabbix_get.exe -k services and zabbix_agentd.exe -t services do not return the same

Good morning

Unfortunatelly I have the same problem. It seems, that zabbix_get doesn't return all services while zabbix_agentd does. Furthermore zabbix_get -k service.info does return 255 for all services that zabbix_get -k services doesn't list while zabbix_agentd -t service.info does return the correct state.

I did tests with zabbix 3.2 and 3.4 agents and had the same issue on both versions.

Is there a fix?

Thanks

Höfi

[Hoefi EWC]

[SOLVED] missing windows services in zabbix_get -k services

Hi

My problem was solved by applying additional security settings to all missing windows services.


How does it works:


1. Enumerate all security descriptors of all missing services

Use this commad on the Windows machine to get the actual security descriptor (SD) of a service:
sc sdshow SERVICENAME

Then you get a security descriptor like this:
DA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPW PDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

For the zabbix service user this SD has to be added:
DA;;CCLCSWLOCRRC;;;SU)
or
DA;;CCLCSWLOCRRC;;;SID_OF_THE_ZABBIXUSER)


2. Extend the security descriptor of all missing services

The above example SD had to be extended to:
DA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPW PDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Rewrite the security descriptor with this command:
sc sdset SERVICENAME DA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPW PDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Be carefull with this command as a mistake could lock you out from accessing the service.

This Web page may be helpful:

https://blogs.msmvps.com/erikr/2007/09/26/set-permissions-on-a-specific-service-windows/

3. Finished!

After changing the security descriptor Zabbix should have access to the service.

Have fun,

Höfi

[Hoefi EWC]

[SOLVED] missing windows services in zabbix_get -k services

My problem was solved by applying additional security settings to all missing windows services.

How does it works:

1. Enumerate all security descriptors of all missing services

Use this commad on the Windows machine to get the actual security descriptor (SD) of a service:
sc sdshow SERVICENAME

Then you get a security descriptor like this:
DA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPW PDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

For the zabbix service user this SD has to be added:
DA;;CCLCSWLOCRRC;;;SU)
or
DA;;CCLCSWLOCRRC;;;SID_OF_THE_ZABBIXUSER)

2. Extend the security descriptor of all missing services

The above example SD had to be extended to:
DA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPW PDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Rewrite the security descriptor with this command:
sc sdset SERVICENAME DA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPW PDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Be carefull with this command as a mistake could lock you out from accessing the service.

This Web page may be helpful:

https://blogs.msmvps.com/erikr/2007/09/26/set-permissions-on-a-specific-service-windows/

3. Finished!

After changing the security descriptor Zabbix should have access to the service.

Have fun,

Höfi