[ZBX-6787] "net.if.discovery" for Win7/2008 returns disabled and nonpresent interfaces, but it should not. Created: 2013 Jul 12  Updated: 2019 Dec 10

Status: Open
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 1.8.16, 2.1.0
Fix Version/s: None

Type: Incident report Priority: Trivial
Reporter: Oleksii Zagorskyi Assignee: Unassigned
Resolution: Unresolved Votes: 4
Labels: interfaces, lld, windows
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Windows 7, Server 2008 +

Issue Links:
Duplicate

 Description   

First of all "net.if.discovery" and "net.if.list" keys on Win XP/2003 server return only present AND enabled interfaces.
This is good and desired behavior.
But in Win7/2008 the behavior is different.

Yes, there is such sort of network interfaces (to be correct - actually any device type in windows) that being classified as "nonpresent".
I.e. this interface has been once inserted to motherboard (enabled in Bios etc) and later has been removed.

To see such nonpresent interfaces (any devices actually) we need to open a cmd and execute:
set devmgr_show_nonpresent_devices=1
start devmgmt.msc
Then in appeared Devicemanager click menu View -> and enable "Show hidden devices" checkbox.
Note that enabling this checkbox without starting devicemanger with defined devmgr_show_nonpresent_devices=1 will not show the nonpresent devices.
Such nonpresent devices are grayed out in the Devicemanager.

We have here a lot of other ZBXs where we saw outputs of the keys and they always were ... hmmm ... "scary" - there always are a lot of almost duplicated, unclear, unneeded records.
For example:
"<an interface name> ... Native WiFi Filter Driver-0000",
"<an interface name> ... Native QoS Packet Scheduler-0000",
"<an interface name> ... WFP LightWeight Filter-0000",
"<an interface name> ... Virtual WiFi Filter Driver-0000",
maybe others.
Some of these "clones" can be removed by disabling corresponding Component check boxes in an interface settings (Windows control panel), but not all.
I have to say that it much complicates to construct global regexps to filter only REAL interfaces and drop all such "clones".

If you will start windows' perfmon utility, try to add a counter, open "Network interface" tree - you will NOT see there:
those "clones",
disabled interfaces,
nonpresent interfaces.

I think this is good point that such interfaces are meaningless for monitoring !

What I suggest:
1. net.if.discovery key should return only the same interfaces which we can see in the perfmon tool.
I mean that additionally to disabled/nonpresent interfaces would be ideally to NOT show even those "clones".
2. net.if.list - leave it as is, will be mentioned below.

Issue description will be continued in comments because of supported formating there.

 Comments   
Comment by Oleksii Zagorskyi [ 2013 Jul 12 ]

All examples are only on Win7 and Server 2008 hosts.
In examples I'll use only "net.if.list" key - it provides the same interfaces list as "net.if.discovery", but it's better readable and contains more interesting details.

Some host
USB-Ethernet adapter pluged to USB port:

# zabbix_get -s 10.20.1.17 -k net.if.list
Other                     unknown  - Устройство Bluetooth (протокол RFCOMM TDI)
Ethernet                  enabled  - WAN Miniport (IPv6)
Ethernet                  enabled  - WAN Miniport (Network Monitor)
Ethernet                  enabled  - WAN Miniport (Network Monitor)-QoS Packet Scheduler-0000
Ethernet                  enabled  - WAN Miniport (IP)-QoS Packet Scheduler-0000
Ethernet                  enabled  - WAN Miniport (IP)
Ethernet                  enabled  - WAN Miniport (IPv6)-QoS Packet Scheduler-0000
Ethernet                  enabled  - Устройства Bluetooth (личной сети)
Ethernet                  enabled  - ASIX AX88772B USB2.0 to Fast Ethernet Adapter
Ethernet                  enabled  - ASIX AX88772B USB2.0 to Fast Ethernet Adapter-WFP LightWeight Filter-0000
Ethernet                  enabled  - ASIX AX88772B USB2.0 to Fast Ethernet Adapter-QoS Packet Scheduler-0000
PPP                       enabled  - WAN Miniport (PPPOE)
PPP                       enabled  - RAS Async Adapter
PPP                       unknown  10.20.1.17      QQ vpn
Software Loopback         enabled  127.0.0.1       Software Loopback Interface 1
IEEE 802.11 Wireless      enabled  192.168.1.2     Intel(R) Centrino(R) Advanced-N 6235
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-Virtual WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-QoS Packet Scheduler-0000
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-Native WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-WFP LightWeight Filter-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2-Native WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2-QoS Packet Scheduler-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2-WFP LightWeight Filter-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter-Native WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter-QoS Packet Scheduler-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter-WFP LightWeight Filter-0000
Tunnel type encapsulation enabled  - WAN Miniport (SSTP)
Tunnel type encapsulation enabled  - WAN Miniport (IKEv2)
Tunnel type encapsulation enabled  - WAN Miniport (L2TP)
Tunnel type encapsulation enabled  - WAN Miniport (PPTP)
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #2
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #3
Tunnel type encapsulation enabled  - Teredo Tunneling Pseudo-Interface
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #4
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #5
Tunnel type encapsulation enabled  - Адаптер Microsoft 6to4
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #6

USB-Ethernet adapter has been unpluged from USB port:

# zabbix_get -s 10.20.1.17 -k net.if.list
Other                     unknown  - Устройство Bluetooth (протокол RFCOMM TDI)
Ethernet                  enabled  - WAN Miniport (IPv6)
Ethernet                  enabled  - WAN Miniport (Network Monitor)
Ethernet                  enabled  - WAN Miniport (Network Monitor)-QoS Packet Scheduler-0000
Ethernet                  enabled  - WAN Miniport (IP)-QoS Packet Scheduler-0000
Ethernet                  enabled  - WAN Miniport (IP)
Ethernet                  enabled  - WAN Miniport (IPv6)-QoS Packet Scheduler-0000
Ethernet                  enabled  - Устройства Bluetooth (личной сети)
Ethernet                  unknown  - ASIX AX88772B USB2.0 to Fast Ethernet Adapter
PPP                       enabled  - WAN Miniport (PPPOE)
PPP                       enabled  - RAS Async Adapter
PPP                       unknown  10.20.1.17      QQ vpn
Software Loopback         enabled  127.0.0.1       Software Loopback Interface 1
IEEE 802.11 Wireless      enabled  192.168.1.2     Intel(R) Centrino(R) Advanced-N 6235
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-Virtual WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-QoS Packet Scheduler-0000
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-Native WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Intel(R) Centrino(R) Advanced-N 6235-WFP LightWeight Filter-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2-Native WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2-QoS Packet Scheduler-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2-WFP LightWeight Filter-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter #2
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter-Native WiFi Filter Driver-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter-QoS Packet Scheduler-0000
IEEE 802.11 Wireless      enabled  - Microsoft Virtual WiFi Miniport Adapter-WFP LightWeight Filter-0000
Tunnel type encapsulation enabled  - WAN Miniport (SSTP)
Tunnel type encapsulation enabled  - WAN Miniport (IKEv2)
Tunnel type encapsulation enabled  - WAN Miniport (L2TP)
Tunnel type encapsulation enabled  - WAN Miniport (PPTP)
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #2
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #3
Tunnel type encapsulation enabled  - Teredo Tunneling Pseudo-Interface
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #4
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #5
Tunnel type encapsulation enabled  - Адаптер Microsoft 6to4
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #6

Note before->after:

  • dissapeared clones "ASIX AX88772B USB2.0 to Fast Ethernet Adapter-WFP LightWeight Filter-0000", "ASIX AX88772B USB2.0 to Fast Ethernet Adapter-QoS Packet Scheduler-0000"
  • and real addapter "ASIX AX88772B USB2.0 to Fast Ethernet Adapter" appeared to be unknown

Another host (virtual one on VirtualBox)
"VirtualBox Host-Only Ethernet Adapter" is enabled:

# zabbix_get -s 10.20.0.71 -k net.if.list
Ethernet                  enabled  - WAN Miniport (IPv6)
Ethernet                  enabled  - WAN Miniport (Network Monitor)
Ethernet                  enabled  - Realtek RTL8139C+ Fast Ethernet сетевой адаптер - VirtualBox Bridged Networking Driver Miniport
Ethernet                  enabled  - WAN Miniport (Network Monitor)-QoS Packet Scheduler-0000
Ethernet                  enabled  - WAN Miniport (IP)-QoS Packet Scheduler-0000
Ethernet                  unknown  - Realtek RTL8139C+ Fast Ethernet сетевой адаптер
Ethernet                  enabled  - WAN Miniport (IP)
Ethernet                  enabled  - WAN Miniport (IPv6)-QoS Packet Scheduler-0000
Ethernet                  enabled  - Сетевое подключение Intel(R) PRO/1000 MT #2-WFP LightWeight Filter-0000
Ethernet                  unknown  - Сетевое подключение Intel(R) PRO/1000 MT
Ethernet                  enabled  - VirtualBox Host-Only Ethernet Adapter-WFP LightWeight Filter-0000
Ethernet                  enabled  - Сетевое подключение Intel(R) PRO/1000 MT - VirtualBox Bridged Networking Driver Miniport
Ethernet                  enabled  10.20.0.71      Сетевое подключение Intel(R) PRO/1000 MT #2
Ethernet                  enabled  192.168.56.1    VirtualBox Host-Only Ethernet Adapter
PPP                       enabled  - WAN Miniport (PPPOE)
PPP                       unknown  - RAS Async Adapter
Software Loopback         enabled  127.0.0.1       Software Loopback Interface 1
Tunnel type encapsulation enabled  - WAN Miniport (SSTP)
Tunnel type encapsulation enabled  - WAN Miniport (IKEv2)
Tunnel type encapsulation enabled  - WAN Miniport (L2TP)
Tunnel type encapsulation enabled  - WAN Miniport (PPTP)
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP
Tunnel type encapsulation enabled  - Teredo Tunneling Pseudo-Interface
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #2
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #3

"VirtualBox Host-Only Ethernet Adapter" is disabled in device manager:

# zabbix_get -s 10.20.0.71 -k net.if.list
Ethernet                  enabled  - WAN Miniport (IPv6)
Ethernet                  enabled  - WAN Miniport (Network Monitor)
Ethernet                  enabled  - Realtek RTL8139C+ Fast Ethernet сетевой адаптер - VirtualBox Bridged Networking Driver Miniport
Ethernet                  enabled  - WAN Miniport (Network Monitor)-QoS Packet Scheduler-0000
Ethernet                  enabled  - WAN Miniport (IP)-QoS Packet Scheduler-0000
Ethernet                  unknown  - Realtek RTL8139C+ Fast Ethernet сетевой адаптер
Ethernet                  enabled  - WAN Miniport (IP)
Ethernet                  enabled  - WAN Miniport (IPv6)-QoS Packet Scheduler-0000
Ethernet                  enabled  - Сетевое подключение Intel(R) PRO/1000 MT #2-WFP LightWeight Filter-0000
Ethernet                  unknown  - Сетевое подключение Intel(R) PRO/1000 MT
Ethernet                  enabled  - Сетевое подключение Intel(R) PRO/1000 MT - VirtualBox Bridged Networking Driver Miniport
Ethernet                  enabled  10.20.0.71      Сетевое подключение Intel(R) PRO/1000 MT #2
Ethernet                  unknown  - VirtualBox Host-Only Ethernet Adapter
PPP                       enabled  - WAN Miniport (PPPOE)
PPP                       unknown  - RAS Async Adapter
Software Loopback         enabled  127.0.0.1       Software Loopback Interface 1
Tunnel type encapsulation enabled  - WAN Miniport (SSTP)
Tunnel type encapsulation enabled  - WAN Miniport (IKEv2)
Tunnel type encapsulation enabled  - WAN Miniport (L2TP)
Tunnel type encapsulation enabled  - WAN Miniport (PPTP)
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP
Tunnel type encapsulation enabled  - Teredo Tunneling Pseudo-Interface
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #2
Tunnel type encapsulation enabled  - Адаптер Microsoft ISATAP #3

Note here other interfaces:
"Realtek RTL8139C+ Fast Ethernet сетевой адаптер",
"Сетевое подключение Intel(R) PRO/1000 MT"
are nonpresent (once removed on the virtual mashine) and their state is "unknown" but note that state of their "clones" is "enabled", doh.

Some Components (like QoS etc) for present and enabled interfaces:
"Сетевое подключение Intel(R) PRO/1000 MT #2",
"VirtualBox Host-Only Ethernet Adapter"
are disabled so they have less "clones".

Comment by Oleksii Zagorskyi [ 2013 Jul 12 ]

Btw, you can remove nonpresent devices in the Devicemanager when run it as I described above.
This sometimes is required if you for example plugged to you Windows desktop a lot of Android devices with different firmwares - you will have then tens of nonpresent COM ports.
This is a problem for some service software which cannot address COM ports above #32.

Comment by Matt Keller [ 2014 May 30 ]

I am also running into this bug. I was able to work around it by adding entries to the system wide regular expressions "Network interfaces for discovery" entry. (General > Regular expressions > Network interfaces for discovery) However, this definitely seems like a bug that should be addressed at some point. The error is present with Windows Server 2012 and 2012R2 as well.

Comment by Wellington Watanabe Filho [ 2015 Mar 07 ]

Same with me.
Agent Zabbix Version Tested: 2.2.7
Server Zabbix Version Tested: 2.2.8

Are someone running into this on Zabbix 2.4 ?

Comment by Oleksii Zagorskyi [ 2015 Mar 07 ]

I believe it's the same for recent agent versions because none fixed it yet.

Comment by Alexander Vladishev [ 2016 Sep 22 ]

Related issue: ZBXNEXT-3410

Generated at Thu Apr 25 10:49:51 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.