Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  2. ZBX-6787

"net.if.discovery" for Win7/2008 returns disabled and nonpresent interfaces, but it should not.



    • Type: Incident report
    • Status: Open
    • Priority: Trivial
    • Resolution: Unresolved
    • Affects Version/s: 1.8.16, 2.1.0
    • Fix Version/s: None
    • Component/s: Agent (G)
    • Environment:
      Windows 7, Server 2008 +


      First of all "net.if.discovery" and "net.if.list" keys on Win XP/2003 server return only present AND enabled interfaces.
      This is good and desired behavior.
      But in Win7/2008 the behavior is different.

      Yes, there is such sort of network interfaces (to be correct - actually any device type in windows) that being classified as "nonpresent".
      I.e. this interface has been once inserted to motherboard (enabled in Bios etc) and later has been removed.

      To see such nonpresent interfaces (any devices actually) we need to open a cmd and execute:
      set devmgr_show_nonpresent_devices=1
      start devmgmt.msc
      Then in appeared Devicemanager click menu View -> and enable "Show hidden devices" checkbox.
      Note that enabling this checkbox without starting devicemanger with defined devmgr_show_nonpresent_devices=1 will not show the nonpresent devices.
      Such nonpresent devices are grayed out in the Devicemanager.

      We have here a lot of other ZBXs where we saw outputs of the keys and they always were ... hmmm ... "scary" - there always are a lot of almost duplicated, unclear, unneeded records.
      For example:
      "<an interface name> ... Native WiFi Filter Driver-0000",
      "<an interface name> ... Native QoS Packet Scheduler-0000",
      "<an interface name> ... WFP LightWeight Filter-0000",
      "<an interface name> ... Virtual WiFi Filter Driver-0000",
      maybe others.
      Some of these "clones" can be removed by disabling corresponding Component check boxes in an interface settings (Windows control panel), but not all.
      I have to say that it much complicates to construct global regexps to filter only REAL interfaces and drop all such "clones".

      If you will start windows' perfmon utility, try to add a counter, open "Network interface" tree - you will NOT see there:
      those "clones",
      disabled interfaces,
      nonpresent interfaces.

      I think this is good point that such interfaces are meaningless for monitoring !

      What I suggest:
      1. net.if.discovery key should return only the same interfaces which we can see in the perfmon tool.
      I mean that additionally to disabled/nonpresent interfaces would be ideally to NOT show even those "clones".
      2. net.if.list - leave it as is, will be mentioned below.

      Issue description will be continued in comments because of supported formating there.




            zalex_ua Oleksii Zagorskyi
            4 Vote for this issue
            5 Start watching this issue