Today I noticed that services are no longer visible in WATO for our Windows servers. For example, we used to monitor things like Firewall, Patch Management, etc., to check if they were running or if they restarted.
Unfortunately, running a new discovery does not help, and I cannot find them under disabled services either. However, when I inspect the host using cmk -d, I can see that the data is being delivered.
I cannot say exactly when this issue started, as a colleague brought it to my attention. I hope someone can give me a tip on what might be causing this.
Yes, I can see all available Windows services with that.
I think it’s a WATO rule that makes some services invisible. I don’t see them in the rule for disabled services of the host. Is there a rule that suppresses services?
Just to clarify, cmk -d outputs all services. In the disable rule I see some, but the important services that are usually always monitored are strangely no longer to be found in Wato under the host configuration.
What I just noticed.
When I do a service rescan of the host in WATO, I only see a ‘Service Summary’ anymore, not the individual entries not even under the disabled ones. I can only see that services are disabled in the rule for disabled services of the host.
Linux Hosts are ok it only affects windows hosts.
To clarify the cmk -d <yourhostname> just is a raw dump of the agent output.
The cmk -D <yourhostname> is what CheckMK Server do with the agent output and what should also shown in the GUI.
Do you also get output from a livequery for this host ? lq "GET services\nColumns: host_name description\nFilter: host_name = <yourhostname>"
Any chance this is might be a View or Dashboard issue e.g. some filter applied here (?)
Sorry, I didn’t read your answer correctly. Too many parallel topics.
With -D and the query, I only get the services that I can also see in WATO.
I wouldn’t know where I can restrict views or dashboards so that it hides services from me. I just don’t understand why I can see them with -d but nowhere else. Neither in monitored, disabled, nor vanished. They are simply not visible.
I have even completely deleted a host and added it back again, but the result is the same. It only affects Windows.
Could it be some kind of discovery rule? The services were all visible at one point and were actively monitored. Or an update?
Well as a User of a pro version I would suggest you open a regular service ticket to get this issue addressed. Prepare a Support Diagnostic Dump. Maybe I able to catch the ticket. You also might would like to reference to this thread.
by default only the service summary is monitored. That’s by design, because CMK cannot know which of the available services you would like to monitor (all of the following appropriately applies to processes):
Ruleset “setup > service monitoring rules > Windows services” can be used to define individual (Windows-)services to be discovered
Ruleset " setup > enforced services > Windows services" can be used to get individual (Windows-)services to be monitored while bypassing the discovery of these
I think you most likely did not configure individual services to get discovered/enforced or your rules for those rulesets simply do not match anymore (can happen by service’s display name or internal id changes, both can happen at Windows side when updating OS or related software)…
