Exclude services from nsclient.ini using wildcards?

[DrWebster]

We have Nagios check the services on our Windows servers to ensure anything set to automatic start is running. Occasionally we'll need to exclude some services from the check, and this is easy enough to do in the affected server's nsclient.ini file as part of the alias_service stanza ("exclude=servicename"). Problem is, some applications such as Google Chrome install services with very specific names (like "GoogleUpdaterInternalService123.0.6288.0") that change every time the application is updated. Simply applying a wildcard to the service name (like "exclude=Google*") doesn't seem to work. Is there a way to exclude services using a wildcard or regex?

[jeanbruder]

Hi,

Same request here 'cause of Google updater too ... Have You found any solution @DrWebster ?

Regards,
Jean

[DrWebster]

Not yet. I'm probably going to have to open a thread on the Nagios forums to figure out a workaround.

[sjwk]

Yes, you can use 'filter'. In my alias definition that uses check_service I have:
filter="name not like 'clr_optimization' AND name not like 'GoogleUpdater'"

I also have a bunch of exclude fields, it'll apply both. The only caveat appears to be that you can only have one filter parameter, hence the AND above (having two filter parameters just ignored the second).
More information: https://nsclient.org/docs/reference/windows/CheckSystem/#check_service

I build and deploy the settings file with ansible, and it's starting to get a bit unwieldy with the number of exclude parameters, I'm thinking of changing it and only checking for the services I actually need to be running, rather than all that are marked as Automatic...

[DrWebster]

Thanks. I think we must be doing something different with our service checks; when I add the "filter" statement like you have, Nagios returns this:

Failed to validate filter see log for details: Critical expression is not valid:( name like 'filter' and state != 'name not like 'GoogleUpdater'' )

Here's the beginning of our service check line from nsclient.ini (there are a few more "exclude" statements after it, and those all work fine):

alias_service = checkServiceState CheckAll filter="name not like 'GoogleUpdater'" "exclude=ShellHWDetection"

[sjwk]

What version are you using? I'm running 0.5.2.41.
My alias is built using check_service rather than checkServiceState - it looks as though the latter is described in the docs as a legacy version of check_service and doesn't seem to have the Filter parameter.

I've created mine as:
alias_service = check_service exclude="Net Driver HPZ12" exclude="Pml Driver HPZ12" exclude=stisvc exclude=swi_update_64 exclude="<snip another 20 or so exclude parameters here>" exclude="MdmIntegrationService" exclude="RCSServer" filter="name not like 'clr_optimization' AND name not like 'GoogleUpdater'"
As long as you're not running a really old version, try changing it to use check_service instead. Also don't need the 'CheckAll' parameter with check_service that I can see in the docs.

[DrWebster]

Thank you, that did it!

[notorious-mso]

I had the same problem, now it's solved thanks to you,