zabbix_export: version: '5.4' date: '2021-11-21T21:52:58Z' groups: - uuid: c60c229af5624393970a0490e5e6b5c6 name: 'Exchange Servers' templates: - uuid: ca2fb8ece27b4dbea39b1bec3ff00802 template: 'Microsoft Exchange Server 2016 - Services' name: 'Microsoft Exchange Server 2016 - Services' description: | ## Overview ``` The "Exchange 2016 - Services" is mostly used to restart critical services by using "ACTIONS" and has discovery rules (Which Are Disabled by Default) This template is based on using the {EVENT.TAGS} as a execute command within Actions. (Note: The whole Trigger will execute all alerts and do with them as you specify but independently execute based on 5m run-times) So if there are three (3) services out, it may take fifteen (15) to twenty (20) mins to restart them. To create an "ACTION" do the following. Add "All Services" and tag them as (Trigger equals XXX) See Example: Trigger equals Template Microsoft Exchange Server 2016 - Services: Service: MSExchangeUMCR on Template Microsoft Exchange Server 2016 - Services If done correctly, you will have A~AE Trigger equals, about (31 Objects) Once done, under "Operations" to Execute a command on the windows server use the following configuration. Operation Type: Remote Command (Note: Zabbix Agent must be set to "Allow Remote Commands) Target list: Current Host Type: Custom Script Execute on: Zabbix Agent Commands: net start {EVENT.TAGS} Yes, it a "Vague" tutorial (Sorry) ``` ## Author Route Packets groups: - name: 'Exchange Servers' items: - uuid: 56983ebf889a4804b4dcfe371ef04c38 name: 'Service Status Microsoft Exchange Search Host Controller' key: 'service_state[HostControllerService]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 1861454e4a8842228864e3de1ef48b99 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[HostControllerService])<>0' name: 'Service: HostControllerService on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: HIGH tags: - tag: HostControllerService - uuid: 67b509e463054a97b1c60af387df1b8d name: 'Service Status Microsoft Exchange Compliance Audit' key: 'service_state[MSComplianceAudit]' delay: 5m tags: - tag: Application value: 'Exchange 2016 Transport' triggers: - uuid: 200547633d924f8ca6cbb7b270c840e3 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSComplianceAudit])<>0' name: 'Service: MSComplianceAudit on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: INFO tags: - tag: MSComplianceAudit - uuid: abe5e3c672e14f64a290f194fffbb5c9 name: 'Service Status Microsoft Exchange Active Directory Topology' key: 'service_state[MSExchangeADTopology]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 9805089efb784c7396cf26a9c920af72 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeADTopology])<>0' name: 'Service: MSExchangeADTopology on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeADTopology - uuid: c3c6c75afc9a4e418b44f1ffbdab725b name: 'Service Status Microsoft Exchange Anti-spam update' key: 'service_state[MSExchangeAntispamUpdate]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 07da79ffac5f4207ae4ee52c80311c31 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeAntispamUpdate])<>0' name: 'Service: MSExchangeAntispamUpdate on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: WARNING tags: - tag: MSExchangeAntispamUpdate - uuid: 4732309fa6a14cffa61ff6a0fa9ade6a name: 'Service Status Microsoft Exchange Compliance Service' key: 'service_state[MSExchangeCompliance]' delay: 5m tags: - tag: Application value: 'Exchange 2016 Transport' triggers: - uuid: b9651b34ba204480a54cdb93f220c905 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeCompliance])<>0' name: 'Service: MSExchangeCompliance on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: WARNING tags: - tag: MSExchangeCompliance - uuid: fc6a730aafeb47bba737171d60eced86 name: 'Service Status Microsoft Exchange DAG Management' key: 'service_state[MSExchangeDagMgmt]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 09e55e450cb64564b95d1e22f26c9621 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeDagMgmt])<>0' name: 'Service: MSExchangeDagMgmt on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangeDagMgmt - uuid: cd7e34ab8a5046d499bddfaca5924da4 name: 'Service Status Microsoft Exchange Transport Delivery' key: 'service_state[MSExchangeDelivery]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: ad636b671cd442cba4c35bb07630ec76 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeDelivery])<>0' name: 'Service: MSExchangeDelivery on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangeDelivery - uuid: 69b6dca3a7384486ae4d2b342c4bea8a name: 'Service Status Microsoft Exchange Diagnostics' key: 'service_state[MSExchangeDiagnostics]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: f2f282beab2e4ababbdd4a5fbcb50d66 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeDiagnostics])<>0' name: 'Service: MSExchangeDiagnostics on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeDiagnostics - uuid: f028db77236141f38469b478e7f026e3 name: 'Service Status Microsoft Exchange EdgeSync' key: 'service_state[MSExchangeEdgeSync]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: f4f4137607804b2084c5996ceb2e7a09 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeEdgeSync])<>0' name: 'Service: MSExchangeEdgeSync on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: WARNING tags: - tag: MSExchangeEdgeSync - uuid: 115fbd4b1fa1428c935a8b2aca74c6a5 name: 'Service Status Microsoft Exchange Search' key: 'service_state[MSExchangeFastSearch]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 93c5c219748544509bded6bfbb99cb7e expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeFastSearch])<>0' name: 'Service: MSExchangeFastSearch on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: HIGH tags: - tag: MSExchangeFastSearch - uuid: 7b6adda468ad4af68295dfa5e16f55f0 name: 'Service Status Microsoft Exchange Frontend Transport' key: 'service_state[MSExchangeFrontEndTransport]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 16007f56552a4b72866aeb3222c2a54a expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeFrontEndTransport],#1:now-0)<>0' name: 'Service: MSExchangeFrontEndTransport on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: HIGH tags: - tag: MSExchangeFrontEndTransport - uuid: 3fe65ab8c76d497bbdaa229ae91c7a82 name: 'Service Status Microsoft Exchange Health Manager Recovery' key: 'service_state[MSExchangeHMRecovery]' tags: - tag: Application value: 'Exchange 2016 Client Access' - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: ba164a979c8e4b73b92e1194159d0718 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeHMRecovery])<>0' name: 'Service: MSExchangeHMRecovery on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangeHMRecovery - uuid: 84b232ad8fd6440e902dd0bbe55e7f96 name: 'Service Status Microsoft Exchange Health Manager' key: 'service_state[MSExchangeHM]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 7c9db5ddbb544d82b4bb1c7cb7be557e expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeHM])<>0' name: 'Service: MSExchangeHM on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: HIGH tags: - tag: MSExchangeHM - uuid: 8d4b14c0a36e43aa828793c42a48e38c name: 'Service Status Microsoft Exchange IMAP4 Backend' key: 'service_state[MSExchangeIMAP4BE]' delay: 5m tags: - tag: Application value: 'Exchange 2016 Client Access' triggers: - uuid: 78daace052d84860bf8b95f369da818e expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeIMAP4BE])<>0' name: 'Service: MSExchangeIMAP4BE on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangeIMAP4BE - uuid: 40279c1d804a405d8f164ddd870b7b90 name: 'Service Status Microsoft Exchange IMAP4' key: 'service_state[MSExchangeImap4]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' triggers: - uuid: 74379d40599f421988ea3edd1ac5563d expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeImap4])<>0' name: 'Service: MSExchangeImap4 on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: HIGH tags: - tag: MSExchangeImap4 - uuid: 0bc0ffff9bd2449787ce8c36fa6898ce name: 'Service Status Microsoft Exchange Information Store' key: 'service_state[MSExchangeIS]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: f9859956fb6340b18ffa8c0264bf6e24 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeIS])<>0' name: 'Service: MSExchangeIS on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangeIS - uuid: b7caac74603940c58c389c5371e7a297 name: 'Service Status Microsoft Exchange Mailbox Assistants' key: 'service_state[MSExchangeMailboxAssistants]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: bc9c79bb1d67491c89828ac4c64be724 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeMailboxAssistants])<>0' name: 'Service: MSExchangeMailboxAssistants on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeMailboxAssistants - uuid: 8cc6b331970b40fea4b05ab5c1015ef3 name: 'Service Status Microsoft Exchange Mailbox Replication' key: 'service_state[MSExchangeMailboxReplication]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' triggers: - uuid: c9ac1bb592cd4a5cbefcd3691e37538a expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeMailboxReplication])<>0' name: 'Service: MSExchangeMailboxReplication on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeMailboxReplication - uuid: 68aae9d226d84ca4a196ba84cd43a121 name: 'Service Status Microsoft Exchange Notifications Broker' key: 'service_state[MSExchangeNotificationsBroker]' delay: 5m status: DISABLED tags: - tag: Application value: 'Exchange 2016 Client Access' - tag: Application value: 'Exchange 2016 Mailbox' - tag: Application value: 'Exchange 2016 Transport' triggers: - uuid: 4ce3c5cb3457454585cc191d4c8b9c08 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeNotificationsBroker])<>0' name: 'Service: MSExchangeNotificationsBroker on {HOST.NAME}' opdata: '{EVENT.TAGS}' status: DISABLED priority: WARNING tags: - tag: MSExchangeNotificationsBroker - uuid: 8b6a6d27c11745cb8a39a101c651e55a name: 'Service Status Microsoft Exchange POP3 Backend' key: 'service_state[MSExchangePOP3BE]' delay: 5m tags: - tag: Application value: 'Exchange 2016 Client Access' triggers: - uuid: 51223080fbf14d2b88d3339c058a777e expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangePOP3BE])<>0' name: 'Service: MSExchangePOP3BE on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangePOP3BE - uuid: 34d0bef5425a49a98bd3d562711c214c name: 'Service Status Microsoft Exchange POP3' key: 'service_state[MSExchangePop3]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' triggers: - uuid: bf32e977e8854754a81dfff8c4785a1e expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangePop3])<>0' name: 'Service: MSExchangePop3 on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: HIGH tags: - tag: MSExchangePop3 - uuid: 74e9fb272b1c408e9fcc0692d6024824 name: 'Service Status Microsoft Exchange Replication' key: 'service_state[MSExchangeRepl]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: bb64bde40e804d6d8042c39e286dbd4b expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeRepl])<>0' name: 'Service: MSExchangeRepl on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeRepl - uuid: fa0f9bef19994f2480e511bc9da7825b name: 'Service Status Microsoft Exchange RPC Client Access' key: 'service_state[MSExchangeRPC]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 77f2e3b272a84a7d8e05d449a2508b41 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeRPC])<>0' name: 'Service: MSExchangeRPC on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeRPC - uuid: 5c559641c2184ed2bf0270b6e56918f2 name: 'Service Status Microsoft Exchange Service Host' key: 'service_state[MSExchangeServiceHost]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: a004cec775d44bb18bd7a3530728006e expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeServiceHost])<>0' name: 'Service: MSExchangeServiceHost on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeServiceHost - uuid: 2b408d44327f497e948781c6d317ec77 name: 'Service Status Microsoft Exchange Transport Submission' key: 'service_state[MSExchangeSubmission]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 3286c1d0ceaf4481907fe8a3a1431fb5 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeSubmission])<>0' name: 'Service: MSExchangeSubmission on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangeSubmission - uuid: 38d674bea253453ab870e4607254aca7 name: 'Service Status Microsoft Exchange Throttling' key: 'service_state[MSExchangeThrottling]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 690de4787674448982b524d7f48ebe0c expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeThrottling])<>0' name: 'Service: MSExchangeThrottling on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeThrottling - uuid: cafb3ed7b8db4e8d8c0279f87c847673 name: 'Service Status Microsoft Exchange Transport Log Search' key: 'service_state[MSExchangeTransportLogSearch]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: b9863a5826ab4d8cb7e5b33d7e5cce66 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeTransportLogSearch])<>0' name: 'Service: MSExchangeTransportLogSearch on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: AVERAGE tags: - tag: MSExchangeTransportLogSearch - uuid: 29817d75c0db4cff89855096bc5bd1ef name: 'Service Status Microsoft Exchange Transport' key: 'service_state[MSExchangeTransport]' delay: 5m request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: c1151860b2b54cb48ada7509d4794df7 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeTransport])<>0' name: 'Service: MSExchangeTransport on {HOST.NAME}' opdata: '{EVENT.TAGS}' priority: DISASTER tags: - tag: MSExchangeTransport - uuid: 8f010c70bded4bebba1fb2b8d54975ea name: 'Service Status Microsoft Exchange Unified Messaging Call Router' key: 'service_state[MSExchangeUMCR]' delay: 5m status: DISABLED request_method: POST tags: - tag: Application value: 'Exchange 2016 Client Access' triggers: - uuid: aca6d050c5b3484b8fa2cf378738db16 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeUMCR])<>0' name: 'Service: MSExchangeUMCR on {HOST.NAME}' opdata: '{EVENT.TAGS}' status: DISABLED priority: AVERAGE tags: - tag: MSExchangeUMCR - uuid: e1146785a996466c947d077871fea4df name: 'Service Status Microsoft Exchange Unified Messaging' key: 'service_state[MSExchangeUM]' delay: 5m status: DISABLED request_method: POST tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: 1daf25e10f9a413d92481824047210f4 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[MSExchangeUM])<>0' name: 'Service: MSExchangeUM on {HOST.NAME}' opdata: '{EVENT.TAGS}' status: DISABLED priority: AVERAGE tags: - tag: MSExchangeUM - uuid: 3a3c440bed9c4e1b9781d2eb3952bc48 name: 'Service Status Microsoft Exchange Server Extension for Windows Server Backup' key: 'service_state[wsbexchange]' status: DISABLED tags: - tag: Application value: 'Exchange 2016 Mailbox' triggers: - uuid: e60a327502164bee968713dc42e48886 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[wsbexchange])<>0' name: 'Service: wsbexchange on {HOST.NAME}' opdata: '{EVENT.TAGS}' status: DISABLED priority: AVERAGE tags: - tag: wsbexchange discovery_rules: - uuid: e873c4b7cdb4487cabdf5063c4f86501 name: '{#SERVICE.NAME}' key: service_state item_prototypes: - uuid: 4e3f02cffbbd41a6a7603c8e0ebe28e5 name: 'State of service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME})' key: 'service_state[{#SERVICE.NAME},state]' history: 1w valuemap: name: 'Windows service state' tags: - tag: Application value: 'Exchange 2016 Client Access' - tag: Application value: 'Exchange 2016 Mailbox' - tag: Application value: 'Exchange 2016 Transport' trigger_prototypes: - uuid: 18bda541658d4fcebc45585327bff934 expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[{#SERVICE.NAME},state])<>0' recovery_mode: RECOVERY_EXPRESSION recovery_expression: 'last(/Microsoft Exchange Server 2016 - Services/service_state[{#SERVICE.NAME},state])<>0' name: '{#SERVICE.DISPLAYNAME} ({#SERVICE.NAME}) {#SERVICE.STATENAME} on {HOST.NAME} and be able to extract {#SERVICE.NAME} from it' status: DISABLED manual_close: 'YES' tags: - tag: '{#SERVICE.NAME}' valuemaps: - uuid: beccc688c8f347b6be764877fd854a0d name: 'Windows service state' mappings: - value: '0' newvalue: Running - value: '1' newvalue: Paused - value: '2' newvalue: 'Start pending' - value: '3' newvalue: 'Pause pending' - value: '4' newvalue: 'Continue pending' - value: '5' newvalue: 'Stop pending' - value: '6' newvalue: Stopped - value: '7' newvalue: Unknown - value: '255' newvalue: 'No such service'