Zabbix ローレベルディスカバリ（LLD）の拡張② Windowsサービスの自動登録

 [Zabbix ローレベルディスカバリ（LLD）の拡張①](http://qiita.com/usiusi/items/51e8478cb080412958a4)
 [Zabbix ローレベルディスカバリ（LLD）の拡張②](http://qiita.com/usiusi/items/d616b7c0d51a926ca4a0)
 [Zabbix ローレベルディスカバリ（LLD）の拡張③](http://qiita.com/usiusi/items/0972da38984a82e43e74)
 [Zabbix ローレベルディスカバリ（LLD）の拡張④](http://qiita.com/usiusi360/items/8d44fd6b975b2db40ded)
 [Zabbix ローレベルディスカバリ（LLD）の拡張⑤](http://qiita.com/usiusi360/items/4664b10426bb6d993e1d)

> *追記*
>　Zabbix3.0ではLLDアイテムキー「service.discovery」がサポートされるため、本対応は不要になります。
> ■ 3.6 Discovery of Windows services
> https://www.zabbix.com/documentation/3.0/manual/discovery/low_level_discovery


#Windowsサービスの自動登録

windowsサービスの監視には以下の2つのアイテムが用意されています。
```
　service_state[*]
　services[<type>,<state>,<exclude>] 
```

【自動起動に設定されているものを全て監視対象としたい】場合、アイテムのキーにservices[automatic,stopped] とすれば一つのアイテムとトリガーだけで済むので登録は楽ですが、2点問題があります。

* 一つのサービスが停止状態になりトリガーが「異常」状態になっている場合に、2つ目のサービスが停止してもアラートを上げることが出来ない。
* servicesアイテムで得られるのはサービスの実名であり、表示名とは異なるため分かりづらい。例）表示名「Trend ServerProtect」⇒　実名「SpntSvc」
	
もう一つのservice_stateを使う場合、サービス別に登録が必要であり非常に手間です。
上記を解決するためにローレベルディスカバリを使い、サービス個別に登録しつつ表示名でアラート通知されるようにしたいと思います。


#### zabbix_agnetd.conf(エージェント側)での設定
UserParameter=services.discovery,cscript /nologo "C:\Program Files\zabbix\services.discovery.vbs" | "C:\Program Files\zabbix\nkf32.exe" -w

※2バイトのサービス名がある場合、文字化けしてしまうので、nkfツールを使って変換します。
[nkf.exe nkf32.dll Windows用（Vector）](http://www.vector.co.jp/soft/win95/util/se295331.html)

#### WebGUIでの設定

|ディスカバリルール | |
|:-----------|------------:|
|名前   |win32サービスのディスカバリ |
|タイプ |Zabbixエージェント |
|キー   |services.discovery |

|アイテムのプロトタイプ | |
|:-----------|------------:|
|名前   |Windowsサービス[{#SERVICE_NAME}] |
|タイプ |Zabbixエージェント |
|キー   |service_state[{#SERVICE_NAME}] |


#### WMIでの取得スクリプト
　StartMode = "Auto" のものを列挙

```lang:services.discovery.vbs
computerName = "\\."
sql = "select * from Win32_Service"

FIRST= "1"
 
Set obj = GetObject("winmgmts:{impersonationLevel=impersonate}!" & computerName & "\root\cimv2").ExecQuery(sql)

WScript.Echo "{"
WScript.Echo "     ""data"":["

For Each serviceName In obj
  If serviceName.StartMode = "Auto" Then
     If FIRST = 1 Then
          WScript.Echo ""
          FIRST= "0"
     Else
          WScript.Echo  ","
     End If

     WScript.StdOut.Write "          { ""{#SERVICE_NAME}"":""" & serviceName.Name &""" , ""{#SERVICE_DISPLAYNAME}"":""" & serviceName.DisplayName & """ }"

  End If
Next

WScript.Echo ""
WScript.Echo "     ]"
WScript.Echo "}"
```

```lang:出力結果
# zabbix_get -s 192.168.0.1 -p 10050 -k services.discovery		
{		
     "data":[		
		
          { "{#SERVICE_NAME}":"AeLookupSvc" , "{#SERVICE_DISPLAYNAME}":"Application Experience Lookup Service" },		
          { "{#SERVICE_NAME}":"CryptSvc" , "{#SERVICE_DISPLAYNAME}":"Cryptographic Services" },		
          { "{#SERVICE_NAME}":"DcomLaunch" , "{#SERVICE_DISPLAYNAME}":"DCOM Server Process Launcher" },		
          { "{#SERVICE_NAME}":"Dhcp" , "{#SERVICE_DISPLAYNAME}":"DHCP Client" },		
          { "{#SERVICE_NAME}":"dmserver" , "{#SERVICE_DISPLAYNAME}":"Logical Disk Manager" },		
          { "{#SERVICE_NAME}":"Dnscache" , "{#SERVICE_DISPLAYNAME}":"DNS Client" },		
          { "{#SERVICE_NAME}":"ERSvc" , "{#SERVICE_DISPLAYNAME}":"Error Reporting Service" },		
          { "{#SERVICE_NAME}":"Eventlog" , "{#SERVICE_DISPLAYNAME}":"Event Log" },		
          { "{#SERVICE_NAME}":"EventSystem" , "{#SERVICE_DISPLAYNAME}":"COM+ Event System" },		
          { "{#SERVICE_NAME}":"helpsvc" , "{#SERVICE_DISPLAYNAME}":"Help and Support" },		
          { "{#SERVICE_NAME}":"ImeDictUpdateService" , "{#SERVICE_DISPLAYNAME}":"Microsoft IME Dictionary Update" },		
          { "{#SERVICE_NAME}":"lanmanserver" , "{#SERVICE_DISPLAYNAME}":"Server" },		
          { "{#SERVICE_NAME}":"lanmanworkstation" , "{#SERVICE_DISPLAYNAME}":"Workstation" },		
          { "{#SERVICE_NAME}":"LmHosts" , "{#SERVICE_DISPLAYNAME}":"TCP/IP NetBIOS Helper" },		
          { "{#SERVICE_NAME}":"MDM" , "{#SERVICE_DISPLAYNAME}":"Machine Debug Manager" },		
          { "{#SERVICE_NAME}":"MSDTC" , "{#SERVICE_DISPLAYNAME}":"Distributed Transaction Coordinator" },		
          { "{#SERVICE_NAME}":"Netlogon" , "{#SERVICE_DISPLAYNAME}":"Net Logon" },		
          { "{#SERVICE_NAME}":"PlugPlay" , "{#SERVICE_DISPLAYNAME}":"Plug and Play" },		
          { "{#SERVICE_NAME}":"PolicyAgent" , "{#SERVICE_DISPLAYNAME}":"IPSEC Services" },		
          { "{#SERVICE_NAME}":"ProtectedStorage" , "{#SERVICE_DISPLAYNAME}":"Protected Storage" },		
          { "{#SERVICE_NAME}":"RemoteRegistry" , "{#SERVICE_DISPLAYNAME}":"Remote Registry" },		
          { "{#SERVICE_NAME}":"RpcSs" , "{#SERVICE_DISPLAYNAME}":"Remote Procedure Call (RPC)" },		
          { "{#SERVICE_NAME}":"SamSs" , "{#SERVICE_DISPLAYNAME}":"Security Accounts Manager" },		
          { "{#SERVICE_NAME}":"Schedule" , "{#SERVICE_DISPLAYNAME}":"Task Scheduler" },		
          { "{#SERVICE_NAME}":"seclogon" , "{#SERVICE_DISPLAYNAME}":"Secondary Logon" },		
          { "{#SERVICE_NAME}":"SENS" , "{#SERVICE_DISPLAYNAME}":"System Event Notification" },		
          { "{#SERVICE_NAME}":"SharedAccess" , "{#SERVICE_DISPLAYNAME}":"Windows Firewall/Internet Connection Sharing (ICS)" },		
          { "{#SERVICE_NAME}":"ShellHWDetection" , "{#SERVICE_DISPLAYNAME}":"Shell Hardware Detection" },		
          { "{#SERVICE_NAME}":"SpntSvc" , "{#SERVICE_DISPLAYNAME}":"Trend ServerProtect" },		
          { "{#SERVICE_NAME}":"Spooler" , "{#SERVICE_DISPLAYNAME}":"Print Spooler" },		
          { "{#SERVICE_NAME}":"SysmonLog" , "{#SERVICE_DISPLAYNAME}":"Performance Logs and Alerts" },		
          { "{#SERVICE_NAME}":"TrkWks" , "{#SERVICE_DISPLAYNAME}":"Distributed Link Tracking Client" },		
          { "{#SERVICE_NAME}":"W32Time" , "{#SERVICE_DISPLAYNAME}":"Windows Time" },		
          { "{#SERVICE_NAME}":"winmgmt" , "{#SERVICE_DISPLAYNAME}":"Windows Management Instrumentation" },		
          { "{#SERVICE_NAME}":"WZCSVC" , "{#SERVICE_DISPLAYNAME}":"Wireless Configuration" },		
          { "{#SERVICE_NAME}":"ZABBIX Agent" , "{#SERVICE_DISPLAYNAME}":"ZABBIX Agent" },		
          { "{#SERVICE_NAME}":"JavaQuickStarterService" , "{#SERVICE_DISPLAYNAME}":"Java Quick Starter" }		
     ]		
}		
```