Category Archives: Zabbix

Monitoring Linux ISG in Zabbix

Today I wanted to monitor Linux ISG sessions in Zabbix.

By entering the command on one of the servers:

/opt/ISG/bin/ISG.pl show_count

Saw the following:

Approved sessions count: 2021
Unapproved sessions count: 2

The Zabbix agent on the server has already been installed, so it opened its configuration file (in the nano editor, the Ctrl+X keys for the exit, and y/n for saving or canceling the changes):

nano /etc/zabbix/zabbix_agentd.conf

Invented and added the following code:

UserParameter=isg.approved, /opt/ISG/bin/ISG.pl show_count | grep "Approved sessions count:" | awk '{print $4}'
UserParameter=isg.unapproved, /opt/ISG/bin/ISG.pl show_count | grep "Unapproved sessions count:" | awk '{print $4}'

We will allow Zabbix agent to work as root with the user specifying:

AllowRoot=1

Restart the Zabbix agent to apply the changes:

sudo /etc/init.d/zabbix-agent restart

On the Zabbix server, create an ISG template, add the data elements to it, specifying the type – Zabbix agent, and the keys: isg.approved, isg.unapproved.
Create graphics for the created data items.

Apply the template to the desired nodes of the network.

Done.

Monitoring Postfix in Zabbix

First, configure the Zabbix agent.

Create a file (in the nano editor, press Ctrl+X to exit, and y/n to save or discard changes):

nano /etc/zabbix/zabbix_agentd.d/userparameter_postfix.conf

Add to it:

UserParameter=postfix.maildrop, find /var/spool/postfix/maildrop -type f | wc -l
UserParameter=postfix.deferred, find /var/spool/postfix/deferred -type f | wc -l
UserParameter=postfix.incoming, find /var/spool/postfix/incoming -type f | wc -l
UserParameter=postfix.active, find /var/spool/postfix/active -type f | wc -l
UserParameter=postfix.queue, mailq | grep -v "Mail queue is empty" | grep -c '^[0-9A-Z]'

Alternatively, you can simply add the lines above to the Zabbix agent configuration file.

Also open the Zabbix agent configuration file:

nano /etc/zabbix/zabbix_agentd.conf

We will allow Zabbix agent to work as root with the user specifying:

AllowRoot=1

Restart the Zabbix agent to apply the changes:

sudo /etc/init.d/zabbix-agent restart

Now go to the Zabbix server.
Create a Postfix template, add data items to it, specifying the type – Zabbix agent, and the keys: postfix.maildrop, postfix.deferred, postfix.incoming, postfix.active, postfix.queue.
Create graphics for the created data items.

You can also create a data item that counts the number of Postfix processes by specifying the type – Zabbix agent, and the key:

proc.num[,postfix]

Also create a trigger that tells when processes 0.

Download the ready template here – Zabbix шаблон для Postfix

Configuring low-level discovery in Zabbix

Low-level discovery allows you to automatically create data items, triggers, graphics.
Massively it is better not to use it, since in practice it noticed that it gives a significant load on the system.

Here is an example of the discovery configuration for viewing the port load of the managed switch.
To start, open the “Settings” – “Templates“, create a new template, or click “Discovery“.
Click “Create rule” and fill out the main parameters:

Continue reading “Configuring low-level discovery in Zabbix”

Solving the Zabbix problem “icmp pinger processes more than 75% busy”

Message “Zabbix icmp pinger processes more than 75% busy” it means that the process or processes performing ping hosts are overloaded.
To solve this problem, you need to open the zabbix server configuration file, for example, via the nano editor:

sudo nano /etc/zabbix/zabbix_server.conf

Next, find the parameter StartPingers in it, if it is 1 and commented out, then you can increase it for example by 5 and uncomment (remove the # symbol before it).
By this we increase the number of processes performing ICMP Ping, accordingly the load will be distributed and reduced.
To save changes in the nano editor, use the keyboard shortcut Ctrl+O, then Enter. To exit Ctrl+X.

After the manipulations, you must reboot the Zabbix server with the command:

service zabbix-server restart

Also, the load can be reduced by increasing the “Update interval” in the template parameters. To do this, go to the Zabbix Web interface under the administrator and click Settings – Templates, select the “Data items” on the required template, open the ping data item and find the “Update interval (in sec)“. The values of 180 (three minutes) or more I think is quite enough.

Solving the error in Zabbix “snmp_parse_oid(): cannot parse OID “MIB””

I noticed once on the new system after importing Zabbix templates that not all data elements work successfully.

And the error is displayed:

snmp_parse_oid(): cannot parse OID “MIB”

As it turned out, the data elements have MIBs instead of OIDs that are not in the system.
For example, the MIB for incoming traffic on the first interface will be ifInOctets.1, and OID 1.3.6.1.2.1.2.2.1.10.1
Here in more detail you can see examples SNMP OID and MIB for interfaces
Therefore, the solution to this error will be either editing all the elements of the template, we will change the MIB to OID, or the option is easier – to install MIBs that are not in the system, if these are standard MIBs, then they can be installed as I described in this article – Installing MIB in Ubuntu and Solving the Error “SNMP Cannot Find Module …”

In the end, we will necessarily restart snmpd and zabbix-server:

sudo service snmpd restart
sudo service zabbix-server restart

Done.

Monitoring the number of Ubiquiti sector clients by SSH from Zabbix

On the test I’ll give an example of getting the number of clients connected to the usual sectoral antenna Ubiquiti AirMax Rocket M5.
We will receive the data via SSH.

To test once we connect to the device (the first time when connecting, type yes and press enter):

sudo -u zabbix ssh -p 22 [email protected]

Now in Zabbix we add the data element to the template or host, for example with the name “Template Ubiquiti Rocket M5 Sector”:

Name: any
Type: SSH agent
Key: ssh.run[clients,,22,utf8]
Authentication method: Password
Username: NAME
Password: PASSWORD
Executed script: the command executed on the device (see below)

Example of the command displayed the number of connected clients:

wstalist |grep "mac" |wc -l

Accordingly, we create a graph for the data element, as well as the trigger:

Name: On the sector antenna {HOST.NAME} > 40 clients
Expression: {Template Ubiquiti Rocket M5 Sector:ssh.run[clients,,22,utff8].last(#1)}>40

See also:
Configuring SSH checks in Zabbix

Change port in SSH, HTTP, etc. checks. in Zabbix

Suppose that SSH is working on a non-standard port, in Zabbix, the “Template App SSH Service” template checks it on a standard port and will therefore send out the message “SSH service is down on …”.

To specify which port to check for SSH, we will make a complete cloning of the “Template App SSH Service” template so that it does not change it and in the new cloned template we already change the key in the data element:

net.tcp.service[ssh]

to (where 500 is the SSH port number):

net.tcp.service[ssh,,500]

And we’ll specify this new template instead of the standard one, then SSH will be scanned at the specified port.
Templates are configured in the “Settings” -> “Templates” -> “Templates” group.

Similarly, the port for other services changes.

From the command line, you can check it with the following commands:

zabbix_get -s127.0.0.1 -k'net.tcp.service[ssh]'
zabbix_get -s127.0.0.1 -k'net.tcp.service[ssh,,500]'

If Zabbix-agent is installed on the node, then in the field the key is better to specify:

proc.num[sshd]

Monitoring DNS from Zabbix

To monitor the DNS service itself on the port, you can use the following key in the data items (where SERVER is the IP address or DNS server domain):

net.tcp.dns[SERVER]

In order not to create a template from scratch, you can clone eg the standard “Template App SSH Service” by changing the name in it and specifying a new key, the trigger will change automatically. And also in the “Type” we select “Zabbix agent” instead of a simple check.

The next command can be checked from the Linux command line:

zabbix_get -s127.0.0.1 -k'net.tcp.dns[SERVER]'

Naturally, if the answer is 1, the DNS service is started, 0 is not.

If Zabbix-agent is installed on the node, then in the field the key is better to specify:

proc.num[nemed]

See also my article:
Monitoring Bind9 in Zabbix