Missing Windows Services in agent output

Troubleshooting
, ,
1

CMK version: cee 2.1.0p10
OS version: Debian 11.4

Error message: None

Hi all,
I’m having issues monitoring specific Windows services. I have create a Windows Service Discovery rule to match all services beginning with “Sage”. (I’ve tried with “Sophos.*” and that has worked fine). But I wasn’t able to discover those specific services. So I downloaded the agent output for that host and notices that the Services related to Sage were actually missing.
As you can see in this screenshot, the services are actually there and running:

image
image741×192 66.3 KB

But in this snippet of the <<<services>>> section, they are missing:

SamSs running/auto Sicherheitskonto-Manager
SAVAdminService running/auto Sophos Anti-Virus Statusreporter
SAVService running/auto Sophos Anti-Virus
SCardSvr stopped/demand Smartcard
ScDeviceEnum stopped/disabled Smartcard-Geräteaufzählungsdienst
Schedule running/auto Aufgabenplanung
SCPolicySvc stopped/demand Richtlinie zum Entfernen der Scmartcard
SE3Recovery running/auto Server-Eye Emergency Recovery
seclogon stopped/demand Sekundäre Anmeldung
SecurityHealthService running/demand Windows-Sicherheitsdienst
SEMgrSvc stopped/disabled Zahlungs- und NFC/SE-Manager
SENS running/auto Benachrichtigungsdienst für Systemereignisse
Sense stopped/demand Windows Defender Advanced Threat Protection-Dienst
SensorDataService stopped/disabled Sensordatendienst

And now I am wondering why?
Does anyone have an idea? Any help is appreciated.

Cheers!

2

Hi,

i never had a problem with that output.
Could it be, that those service names are not named with sage as a prefix ?
Can you check the “internal” services names in the properties of that service in windows ?

3

As you can see in the screenshot, the services are actually prefixed with Sage, all of them.
I opened the properties for one of the services:

image
image526×599 74.3 KB

Every name the service has, begins with “Sage”.

4

funny :slight_smile:

Can you test locally, to see if there is a difference in the checkmk agent output ?

"C:/Program Files (x86)/checkmk/service/check_mk_agent.exe" test | more
5

Okay, wow, this is embarrassing. As it turns out, I had an ip address typo…
Funny thing is, if you use the correct ip address, everything seems to work fine :man_shrugging:t2:

Thank you @aeckstein - your hint lead me to my mistake.

Case closed.

1 Like
6

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.