Select which services to monitor

[rbicelli]

Hi, I don't know if @LinuxCuba is still looking for a solution to this but I can propose mine.

In Service Discovery Triggers Service {#DESCRIPTION} is not running I modified the expression to:

{Template pfSense Active:pfsense.value[service_value,{#SERVICE},status].last()}=0 
and {$PFSENSE_SRVC_MONITORING:"{#SERVICE}"}=1 
and (
    ({Template pfSense Active:pfsense.value[service_value,{#SERVICE},run_on_carp_slave].last()}=1 
    and {Template pfSense Active:pfsense.value[carp_status].last()}=2)
    or ( {Template pfSense Active:pfsense.value[carp_status].last()}=1)
    or ({Template pfSense Active:pfsense.value[carp_status].last()}=0)
)

I added those macro in template (to enable monitoring by default and disable monitoring for few services)

{$PFSENSE_SRVC_MONITORING} = 1 (Enable monitoring of Services)
{$PFSENSE_SRVC_MONITORING:"dnsbl"} = 0 (Disable monitoring of Service pfBlockerNG DNSBL Web Server)
{$PFSENSE_SRVC_MONITORING:"iperf"} = 0 (Disable monitoring of Service iperf Network Performance Testing Daemon/Client)
{$PFSENSE_SRVC_MONITORING:"pcscd"} = 0 (Disable monitoring of PC/SC Smart Card Daemon due to https://redmine.pfsense.org/issues/12095)

The idea is that I monitor several pfSense so I can control which service I want to disable monitor in a flexible manner.

If I want to enable dnsbl monitoring on one host, then I just add the macro {$PFSENSE_SRVC_MONITORING:"dnsbl"} = 1

If I want to disable XXXX, then I just add the macro {$PFSENSE_SRVC_MONITORING:"dnsbl"} = 0

Originally posted by @GuillaumeHullin in https://github.com/rbicelli/pfsense-zabbix-template/issues/61#issuecomment-920404396

[rbicelli]

Would like to expand this concept for next release

[GuillaumeHullin]

@rbicelli I added recently the following trigger:

Service {#DESCRIPTION} is running

{Template pfSense Active:pfsense.value[service_value,{#SERVICE},status].last()}=1 
and {$PFSENSE_SRVC_MONITORING:"{#SERVICE}"}=2 
and (
    ({Template pfSense Active:pfsense.value[service_value,{#SERVICE},run_on_carp_slave].last()}=1 
        and {Template pfSense Active:pfsense.value[carp_status].last()}=2) 
    or {Template pfSense Active:pfsense.value[carp_status].last()}=1 
    or {Template pfSense Active:pfsense.value[carp_status].last()}=0
)

The idea is that you set the macro to 2 in order to verify that a service is NOT running (like "pcscd")

0 = Service monitoring disabled 1 = Service monitoring check if running 2 = Service monitoring check if not running

[rbicelli]

Hi, just for being sure, if I don't have any macro in place services will stay monitored or have I to add a macro for each service I want to monitor?

[GuillaumeHullin]

Short answer: if you stick with the macros of the template all the services will be monitored by default and some specific services with monitoring disabled or "inverted".

Long answer:

{$PFSENSE_SRVC_MONITORING} = 1 (Enable monitoring of Services)
{$PFSENSE_SRVC_MONITORING:"dnsbl"} = 0 (Disable monitoring of Service pfBlockerNG DNSBL Web Server)
{$PFSENSE_SRVC_MONITORING:"iperf"} = 0 (Disable monitoring of Service iperf Network Performance Testing Daemon/Client)
{$PFSENSE_SRVC_MONITORING:"pcscd"} = 0 (Disable monitoring of PC/SC Smart Card Daemon due to https://redmine.pfsense.org/issues/12095)

Originally posted by @GuillaumeHullin in #61 (comment)

So the first macro {$PFSENSE_SRVC_MONITORING} = 1 will by default enable monitoring for ALL the services... the 3 next macro will do a specific settings for a service.

_Note that in my pull request I did not add the {$PFSENSE_SRVC_MONITORING:"dnsbl"} = 0 because I consider it very specific to my different installs of pfSense (I use pfBlocker but I don't use the DNSBL)._

If you do NOT have any macro set in the template (and none in the host manually), then logically {$PFSENSE_SRVC_MONITORING} = 0 and so no service will be monitored. I did that on purpose... in that way I can disable monitoring for all services excluding one or two (I don't use this logic now but maybe could be useful to some people).

[GuillaumeHullin]

@rbicelli I think this can be closed ;)

[postilion]

This functionality would be much appreciated, but appears to have been dropped at some point (not in current versions). Was that intentional? -nic