Zabbix ローレベルディスカバリ（LLD）の拡張①
Zabbix ローレベルディスカバリ（LLD）の拡張②
Zabbix ローレベルディスカバリ（LLD）の拡張③
Zabbix ローレベルディスカバリ（LLD）の拡張④
Zabbix ローレベルディスカバリ（LLD）の拡張⑤

追記
　Zabbix3.0ではLLDアイテムキー「service.discovery」がサポートされるため、本対応は不要になります。
■ 3.6 Discovery of Windows services
https://www.zabbix.com/documentation/3.0/manual/discovery/low_level_discovery

#Windowsサービスの自動登録

windowsサービスの監視には以下の2つのアイテムが用意されています。

　service_state[*]
　services[<type>,<state>,<exclude>]

【自動起動に設定されているものを全て監視対象としたい】場合、アイテムのキーにservices[automatic,stopped] とすれば一つのアイテムとトリガーだけで済むので登録は楽ですが、2点問題があります。

一つのサービスが停止状態になりトリガーが「異常」状態になっている場合に、2つ目のサービスが停止してもアラートを上げることが出来ない。
servicesアイテムで得られるのはサービスの実名であり、表示名とは異なるため分かりづらい。例）表示名「Trend ServerProtect」⇒　実名「SpntSvc」

もう一つのservice_stateを使う場合、サービス別に登録が必要であり非常に手間です。
上記を解決するためにローレベルディスカバリを使い、サービス個別に登録しつつ表示名でアラート通知されるようにしたいと思います。

zabbix_agnetd.conf(エージェント側)での設定

UserParameter=services.discovery,cscript /nologo "C:\Program Files\zabbix\services.discovery.vbs" | "C:\Program Files\zabbix\nkf32.exe" -w

※2バイトのサービス名がある場合、文字化けしてしまうので、nkfツールを使って変換します。
nkf.exe nkf32.dll Windows用（Vector）

WebGUIでの設定

ディスカバリルール
名前	win32サービスのディスカバリ
タイプ	Zabbixエージェント
キー	services.discovery

アイテムのプロトタイプ
名前	Windowsサービス[{#SERVICE_NAME}]
タイプ	Zabbixエージェント
キー	service_state[{#SERVICE_NAME}]

WMIでの取得スクリプト

　StartMode = "Auto" のものを列挙

services.discovery.vbs

computerName = "\\."
sql = "select * from Win32_Service"

FIRST= "1"
 
Set obj = GetObject("winmgmts:{impersonationLevel=impersonate}!" & computerName & "\root\cimv2").ExecQuery(sql)

WScript.Echo "{"
WScript.Echo "     ""data"":["

For Each serviceName In obj
  If serviceName.StartMode = "Auto" Then
     If FIRST = 1 Then
          WScript.Echo ""
          FIRST= "0"
     Else
          WScript.Echo  ","
     End If

     WScript.StdOut.Write "          { ""{#SERVICE_NAME}"":""" & serviceName.Name &""" , ""{#SERVICE_DISPLAYNAME}"":""" & serviceName.DisplayName & """ }"

  End If
Next

WScript.Echo ""
WScript.Echo "     ]"
WScript.Echo "}"

出力結果

# zabbix_get -s 192.168.0.1 -p 10050 -k services.discovery		
{		
     "data":[		
		
          { "{#SERVICE_NAME}":"AeLookupSvc" , "{#SERVICE_DISPLAYNAME}":"Application Experience Lookup Service" },		
          { "{#SERVICE_NAME}":"CryptSvc" , "{#SERVICE_DISPLAYNAME}":"Cryptographic Services" },		
          { "{#SERVICE_NAME}":"DcomLaunch" , "{#SERVICE_DISPLAYNAME}":"DCOM Server Process Launcher" },		
          { "{#SERVICE_NAME}":"Dhcp" , "{#SERVICE_DISPLAYNAME}":"DHCP Client" },		
          { "{#SERVICE_NAME}":"dmserver" , "{#SERVICE_DISPLAYNAME}":"Logical Disk Manager" },		
          { "{#SERVICE_NAME}":"Dnscache" , "{#SERVICE_DISPLAYNAME}":"DNS Client" },		
          { "{#SERVICE_NAME}":"ERSvc" , "{#SERVICE_DISPLAYNAME}":"Error Reporting Service" },		
          { "{#SERVICE_NAME}":"Eventlog" , "{#SERVICE_DISPLAYNAME}":"Event Log" },		
          { "{#SERVICE_NAME}":"EventSystem" , "{#SERVICE_DISPLAYNAME}":"COM+ Event System" },		
          { "{#SERVICE_NAME}":"helpsvc" , "{#SERVICE_DISPLAYNAME}":"Help and Support" },		
          { "{#SERVICE_NAME}":"ImeDictUpdateService" , "{#SERVICE_DISPLAYNAME}":"Microsoft IME Dictionary Update" },		
          { "{#SERVICE_NAME}":"lanmanserver" , "{#SERVICE_DISPLAYNAME}":"Server" },		
          { "{#SERVICE_NAME}":"lanmanworkstation" , "{#SERVICE_DISPLAYNAME}":"Workstation" },		
          { "{#SERVICE_NAME}":"LmHosts" , "{#SERVICE_DISPLAYNAME}":"TCP/IP NetBIOS Helper" },		
          { "{#SERVICE_NAME}":"MDM" , "{#SERVICE_DISPLAYNAME}":"Machine Debug Manager" },		
          { "{#SERVICE_NAME}":"MSDTC" , "{#SERVICE_DISPLAYNAME}":"Distributed Transaction Coordinator" },		
          { "{#SERVICE_NAME}":"Netlogon" , "{#SERVICE_DISPLAYNAME}":"Net Logon" },		
          { "{#SERVICE_NAME}":"PlugPlay" , "{#SERVICE_DISPLAYNAME}":"Plug and Play" },		
          { "{#SERVICE_NAME}":"PolicyAgent" , "{#SERVICE_DISPLAYNAME}":"IPSEC Services" },		
          { "{#SERVICE_NAME}":"ProtectedStorage" , "{#SERVICE_DISPLAYNAME}":"Protected Storage" },		
          { "{#SERVICE_NAME}":"RemoteRegistry" , "{#SERVICE_DISPLAYNAME}":"Remote Registry" },		
          { "{#SERVICE_NAME}":"RpcSs" , "{#SERVICE_DISPLAYNAME}":"Remote Procedure Call (RPC)" },		
          { "{#SERVICE_NAME}":"SamSs" , "{#SERVICE_DISPLAYNAME}":"Security Accounts Manager" },		
          { "{#SERVICE_NAME}":"Schedule" , "{#SERVICE_DISPLAYNAME}":"Task Scheduler" },		
          { "{#SERVICE_NAME}":"seclogon" , "{#SERVICE_DISPLAYNAME}":"Secondary Logon" },		
          { "{#SERVICE_NAME}":"SENS" , "{#SERVICE_DISPLAYNAME}":"System Event Notification" },		
          { "{#SERVICE_NAME}":"SharedAccess" , "{#SERVICE_DISPLAYNAME}":"Windows Firewall/Internet Connection Sharing (ICS)" },		
          { "{#SERVICE_NAME}":"ShellHWDetection" , "{#SERVICE_DISPLAYNAME}":"Shell Hardware Detection" },		
          { "{#SERVICE_NAME}":"SpntSvc" , "{#SERVICE_DISPLAYNAME}":"Trend ServerProtect" },		
          { "{#SERVICE_NAME}":"Spooler" , "{#SERVICE_DISPLAYNAME}":"Print Spooler" },		
          { "{#SERVICE_NAME}":"SysmonLog" , "{#SERVICE_DISPLAYNAME}":"Performance Logs and Alerts" },		
          { "{#SERVICE_NAME}":"TrkWks" , "{#SERVICE_DISPLAYNAME}":"Distributed Link Tracking Client" },		
          { "{#SERVICE_NAME}":"W32Time" , "{#SERVICE_DISPLAYNAME}":"Windows Time" },		
          { "{#SERVICE_NAME}":"winmgmt" , "{#SERVICE_DISPLAYNAME}":"Windows Management Instrumentation" },		
          { "{#SERVICE_NAME}":"WZCSVC" , "{#SERVICE_DISPLAYNAME}":"Wireless Configuration" },		
          { "{#SERVICE_NAME}":"ZABBIX Agent" , "{#SERVICE_DISPLAYNAME}":"ZABBIX Agent" },		
          { "{#SERVICE_NAME}":"JavaQuickStarterService" , "{#SERVICE_DISPLAYNAME}":"Java Quick Starter" }		
     ]		
}