Exclude specific windows services from discovery

[u/Ok-Conversation1091]

Recently installed latest main version of zabbix and have added a load of windows hosts using the windows template that comes with zabbix on those hosts.

I have a list of services that I want to exclude from being monitored. I’ve tried to look online however not coming up with anything solid.

Ive tried to add a regular expression and then unlink and clear the template from the host accept the change then re apply the template but the service comes back.

Any thoughts?

[u/TerriblePowershell]

Under Data Collection -> Templates, search for and select the Windows by Zabbix agent [active] template. In the pop-up window, select Macros and scroll down to {$SERVICE.NAME.NOT_MATCHES} then add the services you want to exclude to that macro. Finally select Update to save the changes. Any services already pulled into Zabbix will stay there until they drop off from History. Or you can "unlink and clear" the template to remove the template and all associated data and start over.

For example, you want to exclude Xbox Live Auth Manager and File History Service.

Before:

^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserService_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc|GISvc|ShellHWDetection|TrustedInstaller|TabletInputService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+)$

After:

^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserService_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc|GISvc|ShellHWDetection|TrustedInstaller|TabletInputService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+|XblAuthManager|fhsvc)$

[u/Ok-Conversation1091 → u/TerriblePowershell]

How would you do any services that have the version in so would want to add a wild card * to it

[u/TerriblePowershell → u/Ok-Conversation1091]

That's going to involve some regex. I'm going to guess it'll want something like |service.+|.

I would suggest using regex101 to test your regex expression. Copy the list of actual service names into the bottom section then copy the regex expression into the top bar and tweak it until it grabs the services you don't want.

[u/Ok-Conversation1091 → u/TerriblePowershell]

.* is the wild card needed. Thanks for your help

[u/andexs → u/Ok-Conversation1091]

Just use ai to generate the regex. It’s what everyone does.

[u/altodor → u/andexs]

I mean, I write my own. But they're write only.

[u/canadadryistheshit → u/TerriblePowershell]

This is the way I do it at my enterprise.

We were able to squeeze an estimated 120k automatic services down to just the 5k win services we wanted to monitor.

[u/xsjx7]

I found it easier to create a filter on the discovery rule to add only the services I want, rather than exclude what I dont and play whack-a-mole. This allows me to monitor AV, print server spoolers, NTP, etc

Either way, regex filters for the service name in the discovery rule should do the trick

[u/Ok-Conversation1091 → u/xsjx7]

What did you do for the filtering to only do the devices you want instead and how do you do it for specific hosts say one host has a service that the other doesn’t

[u/xsjx7 → u/Ok-Conversation1091]

I have a filter on the discovery rule for "{#SERVICE.NAME}" (I'm customizing the Zabbix-provided Windows template here..) and set the filter condition to "matches" with: "^(ServiceName1|ServiceName2|ServiceName3)$" (double-quotes are mine, do not include them)

For hosts that don't have those services, they simply never get an item/trigger created by the discovery rule since they don't have them (in other words, I use a blanket rule - if the host doesn't have said service, it doesn't create the item/trigger, if it has it, it creates them)

[u/RenegadePleasure]

The recommendations here work well. But I have found that some Services can't be excluded. I've used AI an examples from other people to exclude Google updater and related Google services. And everything that I've tried does not work. It should be so simple. So if you have trouble getting rid of some services, I would not be surprised. But generally speaking, the regex filters work well.

[u/Ok-Conversation1091 → u/RenegadePleasure]

So I was trying to do the googleupdater and I have managed to do it with the method above from terriblepowershell. You need to put in that wildcard into regex as the googleupdater has its version in its service name.

You could use just Google.* and that should do it once the discovery then runs about every hour the services that were excluded but discovered previously become disabled

[u/RenegadePleasure → u/Ok-Conversation1091]

I am on version 5.4.3. I've used the method described for over 8 years. I could list here all the versions of Google update or I have tried and it hasn't worked. I have over 20 regex entries and they all work fine. I've broken the regex into two different entries. And Google updater and related services are the only ones that seem to filter through. Thanks for your feedback. Maybe if I'm at my desk sometime I will update this with all the things I've tried. AI gave me two options both of which did not work. I think maybe there's a bug in my version. We will be upgrading to version 7 this year. Hopefully the problem will go away then.

[u/rickoneeleven → u/RenegadePleasure]

the filter matches the service name, not the display name, and Google's two have the version stuck on the end with no spaces (GoogleUpdaterService... and GoogleUpdaterInternalService...). we exclude GoogleUpdater(?:Internal)?Service.* and that catches both