Aria Operations: Remove a Windows Service and/or Linux Process in Applications > Telegraf Agents

[VRMware]

When I remove a Windows Service in Aria Operations > Applications > Telegraf > Windows Server > Services, the service disappears, but after 10 to 20 minutes, the service reappears, but this time with the name "Services Exec." Even if I remove the service object from the Inventory, it also reappears. I see the same behavior when removing a Linux Process. Is this a bug, or does anyone know the correct way to remove a Windows service/Linux Process?

Thanks in advance.

-------------------------------------------

[Shen88]

@VRMware,
This isn't a bug but it's due to how Telegraf agents in Aria Operations automatically rediscover services and processes unless explicitly excluded. 

To prevent reappearance:

1. Modify Telegraf Agent Configuration:

   • On the monitored server, locate the Telegraf configuration file.

   • For Windows services, adjust the [[inputs.win_services]] section.

   • For Linux processes, modify the [[inputs.procstat]] section.

   • Use filters or exclusion rules to prevent the agent from reporting specific services or processes.

2. Restart the Telegraf Agent:

   • After updating the config, restart the Telegraf service to apply changes.

3. Validate in Aria Operations:

   • Confirm that the service or process no longer appears in the Applications > Telegraf view after the next data collection cycle.

4. Optional: Use Agent Management UI:

   • In Aria Operations, go to Configure > Applications and Services > Manage Agents.

   • Select the agent and adjust its monitored services/processes directly if UI-based configuration is supported.

------------------------------
If you find this answer right, please 'Recommend' this post.

Thank you!

Regards,
Shen
------------------------------

[VRMware]

Hi Shen, 

Thank you for your detailed response. 

If I understand correctly, I first have to explicitly exclude services that were initially configured and later need to be removed in Telegraf.conf and then restart the Telegraf agent. I hope this is not true. So if, for example, you no longer need a certain service/process on 20 servers, you first have to manually edit Telegraf.conf or via API. The "Delete" option in the Telegraf agent isn't just for show, is it? I'll create an SR with Broadcom Support to check this.

Regards,

Vincent

-------------------------------------------

[VRMware]

Broadcom Support indicates that this may be a bug in Aria Operations. In VCF Operations removing a Linux Process works fine. To be continued.

-------------------------------------------

[VRMware]

I have tested with the latest Telegraf agent version 8.18.5.723 that is part of Aria Operations 8.18 Hotfix 9 (8.18.5 25072623). 

In about half of the cases, removing Windows Services and Linux Processes now works correctly in the first attempt. If the Service and/or Process reappears, you will need to remove it again. If a Service and/or Process reappears, it is easy to recognize because its name will start with "Services Exec.". Removing it a second time is also the workaround recommended by Broadcom Support.

-------------------------------------------