[ZBX-9891] vfs.fs.size find network mapped disk on windows Created: 2015 Sep 19  Updated: 2024 Jul 30  Resolved: 2015 Sep 20

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: None
Fix Version/s: None

Type: Incident report Priority: Trivial
Reporter: Arnon Meshoulam Assignee: Unassigned
Resolution: Won't fix Votes: 0
Labels: mapping, shared, windows
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

windows


Attachments: PNG File disk.png    
Issue Links:
Duplicate

 Description   

I use vfs.fs.size to find disk list.it will find many network mapping disk,exp.Z:\ Y:\ O:\ .
if hostA(Z:) is hostB(D:) and hostC(Z:) is hostB(D:), when hostB(D:) free disk space is less than 5%,it will has 3 triggers and 3 alerts. I do not want to have hostA(vfs.fs.size[Z:]) and hostC(vfs.fs.size[Z:]) item.



 Comments   
Comment by Arnon Meshoulam [ 2015 Sep 19 ]

Cloned this from vfs.fs.size find network mapping disk - ZBX-6594

Issue is seen with version 2.4.09

Host as a disconnected network devices - it appears in Network History as z: drive
There is no active connection to it: "net use" shows nothing.
However,

c:\zabbix\zabbix_agentd.exe -c c:\zabbix\zabbix_agentd.conf -t vfs.fs.discovery
returns:

vfs.fs.discovery                              [s|{
        "data":[
                {
                        "{#FSNAME}":"C:",
                        "{#FSTYPE}":"NTFS"},
                {
                        "{#FSNAME}":"D:",
                        "{#FSTYPE}":"NTFS"},
                {
                        "{#FSNAME}":"E:",
                        "{#FSTYPE}":"NTFS"},
                {
                        "{#FSNAME}":"Z:",
                        "{#FSTYPE}":"UNKNOWN"}]}]
Comment by Arnon Meshoulam [ 2015 Sep 19 ]

correction 2.2.9 version

Comment by richlv [ 2015 Sep 19 ]

but what's the bug with that ?

Comment by Arnon Meshoulam [ 2015 Sep 19 ]

Sorry, missing information.
Expected behaviour is not to have the UNKNOWN drive (z: in this case) be reported as it is being filtered out by the Macro:
Regular expression set as default:
Name: File systems for discovery
Expression: ^(btrfs|ext2|ext3|ext4|jfs|reiser|xfs|ffs|ufs|jfs|jfs2|vxfs|hfs|ntfs|fat32|zfs)$
Result is TRUE

Discovery rule:
Name: Mounted filesystem discovery
Key: vfs.fs.discovery
Filter: {#FSTYPE}
RegEx: @File systems for discovery

Based on the filter, I would not expect to get information for the z: drive since it is does not pass the RegEx (UNKNOWN)

However, in the Latest data, I get information and triggers on the z: drive

Comment by Oleksii Zagorskyi [ 2015 Sep 20 ]

Never clone issues !!! Always create only new issues, thanks.

Looks more like support request, see http://zabbix.org/wiki/Getting_help to get help
It may be considered as duplicate of the ZBX-6594 too.

Well, will answer here only as exception.

Tests on Win7 host, agent 2.2.9.
When I've mapped a network drive:

c:\>net use
New connections will be remembered.

Status       Local     Remote                    Network
-------------------------------------------------------------------------------
OK           Z:        \\7test-zalex\c           Microsoft Windows Network
The command completed successfully.

when run zabbix agent for testing a key (under the same account as logged in):

c:\>zabbix_agentd.exe -c c:\zabbix_agentd.conf -t vfs.fs.discovery
vfs.fs.discovery                              [s|{
        "data":[
                {
                        "{#FSNAME}":"C:",
                        "{#FSTYPE}":"NTFS"},
                {
                        "{#FSNAME}":"D:",
                        "{#FSTYPE}":"CDFS"},
                {
                        "{#FSNAME}":"E:",
                        "{#FSTYPE}":"NTFS"},
                {
                        "{#FSNAME}":"Z:",
                        "{#FSTYPE}":"NTFS"}]}]

But zabbix agent running as service (under SYSTEM) doesn't see it:

c:\>zabbix_get.exe -s localhost -k vfs.fs.discovery
{
        "data":[
                {
                        "{#FSNAME}":"C:",
                        "{#FSTYPE}":"NTFS"},
                {
                        "{#FSNAME}":"D:",
                        "{#FSTYPE}":"CDFS"},
                {
                        "{#FSNAME}":"E:",
                        "{#FSTYPE}":"NTFS"}]}

Using suggestions for example on you can run cmd under system and check what does it return for "net use"
http://verbalprocessor.com/2007/12/05/running-a-cmd-prompt-as-local-system/

On this win7 host for drive C: I did a share with name "c".
Then I could connect/disconnect it (as drive Z: ) by commands:

net use Z: \\7test-zalex\c
net use /DELETE Z:

What is interesting that I was able to connect it as Z: under "SYSTEM" account too (using "psexec -i -s cmd.exe" from the article).
And in this case it has appeared under regular logged user too, but as a "disconnected network device" with a specific icon.
Although "net use" for logged in user shows nothing, but in Explorer the Z: is visible and it's accessible.

When the share is connected under SYSTEM, it's visible for "zabbix_agents -t" for both accounts (logged in and system (zabbix agent service running under system too)), and in both cases it shows {#FSTYPE}":"NTFS" macro for the Z: drive.
I suppose in a case if I'd use remote host with not specified credentials, the FSTYPE would be expanded to UNKNOWN.

As I recall network drives may be connected for all users by group policies.
The polices may be defined on user and/or host levels and it also may have effect.

Closed as won't fix.

Generated at Wed May 07 06:30:40 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.