0

Im using Zabbix and the network interface auto discovery adds the same interface multiple times. But with QoS, Wfp and Kaspersky.

How can i forbid them to being added into the host items?

1

Look on the template, under the discovery rule, and on the second tab (labeled "Filters" you can specify a condition to allow inclusion (or conversely exclude the interface). Generally you want something like:

{#SNMPVALUE} matches @Someexpression

Whether it is {#SNMPVALUE} or not depends on type of discovery, you can probably tell by looking at the prototypes.

Then in the Administration, General, Regular Expression you create one called Someexpression (use a better name) and in there list the ones you do not want as appropriate, either explicit (e.g. "loopback") or a posix regex (until 3.4 where you can use perl regular expressions), then put "result is false". This will then cause any that DO match to be excluded from the discovery.

Back on the discovery rule page, note the "Keep lost resources period". This determines (in days) how long the previously discovered item will stay around. You can set to zero to clean up quickly, but I recommend leaving it long, then looking on the Items of a real host (not the template) and see what is being discovered. The ones no longer discovered are flagged (I think it's an orange exclamation or something like that - hover over and it will tell you more). Once you are sure you are getting what you want, and excluding what you do not, you can lower the "Keep" period and they get cleaned up in an hour or day or so depending on discovery and housekeeping rates.

The Regular Expression page also has a "test" tab where you can type an interface name (be very precise!) and see if it will be excluded or included in your expression.

3
  • Sent more info. – Daniel Oliveira Aug 5 '17 at 19:00
  • Please note that your example ^T1\s likely does not work as expected - Zabbix daemons do not support PCRE, only POSIX ERE. This will change in Zabbix 3.4 - support.zabbix.com/browse/ZBX-3924. – Richlv Aug 6 '17 at 17:32
  • Hmmm... you're right. But I thought it worked somehow, need to go back and check. Thanks for the reminder; that's actual code that's in production, so it's probably missing those completely. I'll change the proposed answer for future reference leaving this. – Linwood Aug 6 '17 at 20:02
0

On Filters on my network interface discover i have:

Type of calculation "And/Or" A or B or C

A {#IFNAME} matches ^WFP$ B {#IFNAME} matches ^Kaspersky$

C {#IFNAME} matches @Network interfaces for discovery

On Configuration Regular Expression i have:

1 » ^lo$ [Result is FALSE] 2 » ^Software Loopback Interface [Result is FALSE] 3 » ^kaspersky$ [Result is FALSE] 4 » ^wfp$ [Result is FALSE]

But im still discovering interfaces that have WFP or Kaspersky in the name.

What i did wrong ?

2
  • I think i goit, was the ^ – Daniel Oliveira Aug 5 '17 at 19:11
  • So if my answer works, why not accept it instead of putting in your own? – Linwood Aug 6 '17 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.