Preventing Service Discovery certain services - Windows

[furicle]

Fairly new Zabbix user - I'm sure this is a 'me-issue' - I have read similar threads in this forum but I've not figured it out yet.

Zabbix 7.4 on Alma 9 - monitoring Windows server core clients with agent2 active

There are some services I do not want to monitor - e.g. 'StateRepository' - even though they are marked as auto start up in Windows, as they generate false positive warnings.

If I delete either the item

Windows services discovery: State of service "StateRepository" (State Repository Service)

or the trigger on that item, it comes back, due to auto discovery.

What I thought was the fix, was to add a new template, populating the Macros tab like this


But that isn't over-riding the Windows by Zabbix agent active template

What's the correct fix here?
I'd rather not do it per host (haven't tried)
I'd rather not alter the built in template as I think it would get over-ridden on zabbix updates?

I don't understand that 'template macros' vs 'inherited and template macros' choice either...

Comments appreciated

[AlexeyBrizgalov]

Hi,

It should work if you create new template, link existing Windows by Zabbix agent active template to it, change the macro under inherited macros and afterwards link ONLY your new template to needed hosts.



Alternatively you can clone the existing Windows by Zabbix agent active template and afterwards change the clone however you want and link it to hosts.

'Template macros' tab displays only macros which exist on this specific template, 'Inherited and template macros' shows both macros which are inherited from above and macros which only exist on this template.
There are three levels of user macros in Zabbix by level of inheritance from top to bottom: Global -> Template -> Host. So all templates and hosts inherit global marcos, all hosts linked to specific template inherit macros from this template. In case of linked templates, new template also inherits macros from existing linked template. Macros can then be manually overridden on lower levels - so global macro can be overridden on template and host level, linked template macro can be overridden on new template and host level, it is done by either changing the value under inherited macros tab or by specifying the same exact macro under template/host macros.

[cyber]

I'd rather not alter the built in template as I think it would get over-ridden on zabbix updates?

No.. zabbix update will not update templates. This is something you need to do by yourself. Download a newer version, import it, see the changes during the import and then you can add your changes again to updated template... Unfortunately there is no option to choose during update, that part of it would be skipped, like turning macros back to default values..
New templates are only installed during fresh installation of Zabbix.

"Template macros" vs "inherited and template macros". One displays macros defined in this template, other dislplays also macros which are inherited from linked tempalte of global level. Same thing you can see on host level. Either "host macros" (which have scope of this host only) and "inherited", which come from different attached tempaltes You can also override tempalte macros locally on a host, which effectively creates a host level macro with different value and has higher precedencem, than template macro, thus host macro will be used.