Configuring low-level discovery in Zabbix

Low-level discovery allows you to automatically create data items, triggers, graphics.
Massively it is better not to use it, since in practice it noticed that it gives a significant load on the system.

Here is an example of the discovery configuration for viewing the port load of the managed switch.
To start, open the “Settings” – “Templates“, create a new template, or click “Discovery“.
Click “Create rule” and fill out the main parameters:

Continue reading “Configuring low-level discovery in Zabbix”

Solving the Zabbix problem “icmp pinger processes more than 75% busy”

Message “Zabbix icmp pinger processes more than 75% busy” it means that the process or processes performing ping hosts are overloaded.
To solve this problem, you need to open the zabbix server configuration file, for example, via the nano editor:

sudo nano /etc/zabbix/zabbix_server.conf

Next, find the parameter StartPingers in it, if it is 1 and commented out, then you can increase it for example by 5 and uncomment (remove the # symbol before it).
By this we increase the number of processes performing ICMP Ping, accordingly the load will be distributed and reduced.
To save changes in the nano editor, use the keyboard shortcut Ctrl+O, then Enter. To exit Ctrl+X.

After the manipulations, you must reboot the Zabbix server with the command:

service zabbix-server restart

Also, the load can be reduced by increasing the “Update interval” in the template parameters. To do this, go to the Zabbix Web interface under the administrator and click Settings – Templates, select the “Data items” on the required template, open the ping data item and find the “Update interval (in sec)“. The values of 180 (three minutes) or more I think is quite enough.

Solving the error in Zabbix “snmp_parse_oid(): cannot parse OID “MIB””

I noticed once on the new system after importing Zabbix templates that not all data elements work successfully.

And the error is displayed:

snmp_parse_oid(): cannot parse OID “MIB”

As it turned out, the data elements have MIBs instead of OIDs that are not in the system.
For example, the MIB for incoming traffic on the first interface will be ifInOctets.1, and OID 1.3.6.1.2.1.2.2.1.10.1
Here in more detail you can see examples SNMP OID and MIB for interfaces
Therefore, the solution to this error will be either editing all the elements of the template, we will change the MIB to OID, or the option is easier – to install MIBs that are not in the system, if these are standard MIBs, then they can be installed as I described in this article – Installing MIB in Ubuntu and Solving the Error “SNMP Cannot Find Module …”

In the end, we will necessarily restart snmpd and zabbix-server:

sudo service snmpd restart
sudo service zabbix-server restart

Done.

Monitoring the number of Ubiquiti sector clients by SSH from Zabbix

On the test I’ll give an example of getting the number of clients connected to the usual sectoral antenna Ubiquiti AirMax Rocket M5.
We will receive the data via SSH.

To test once we connect to the device (the first time when connecting, type yes and press enter):

sudo -u zabbix ssh -p 22 admin@192.168.0.55

Now in Zabbix we add the data element to the template or host, for example with the name “Template Ubiquiti Rocket M5 Sector”:

Name: any
Type: SSH agent
Key: ssh.run[clients,,22,utf8]
Authentication method: Password
Username: NAME
Password: PASSWORD
Executed script: the command executed on the device (see below)

Example of the command displayed the number of connected clients:

wstalist |grep "mac" |wc -l

Accordingly, we create a graph for the data element, as well as the trigger:

Name: On the sector antenna {HOST.NAME} > 40 clients
Expression: {Template Ubiquiti Rocket M5 Sector:ssh.run[clients,,22,utff8].last(#1)}>40

See also:
Configuring SSH checks in Zabbix

Change port in SSH, HTTP, etc. checks. in Zabbix

Suppose that SSH is working on a non-standard port, in Zabbix, the “Template App SSH Service” template checks it on a standard port and will therefore send out the message “SSH service is down on …”.

To specify which port to check for SSH, we will make a complete cloning of the “Template App SSH Service” template so that it does not change it and in the new cloned template we already change the key in the data element:

net.tcp.service[ssh]

to (where 500 is the SSH port number):

net.tcp.service[ssh,,500]

And we’ll specify this new template instead of the standard one, then SSH will be scanned at the specified port.
Templates are configured in the “Settings” -> “Templates” -> “Templates” group.

Similarly, the port for other services changes.

From the command line, you can check it with the following commands:

zabbix_get -s127.0.0.1 -k'net.tcp.service[ssh]'
zabbix_get -s127.0.0.1 -k'net.tcp.service[ssh,,500]'

If Zabbix-agent is installed on the node, then in the field the key is better to specify:

proc.num[sshd]

Monitoring DNS from Zabbix

To monitor the DNS service itself on the port, you can use the following key in the data items (where SERVER is the IP address or DNS server domain):

net.tcp.dns[SERVER]

In order not to create a template from scratch, you can clone eg the standard “Template App SSH Service” by changing the name in it and specifying a new key, the trigger will change automatically. And also in the “Type” we select “Zabbix agent” instead of a simple check.

The next command can be checked from the Linux command line:

zabbix_get -s127.0.0.1 -k'net.tcp.dns[SERVER]'

Naturally, if the answer is 1, the DNS service is started, 0 is not.

If Zabbix-agent is installed on the node, then in the field the key is better to specify:

proc.num[nemed]

See also my article:
Monitoring Bind9 in Zabbix

The solution to the warning “Lack of Free Swap Space on Zabbix Server”

Put somehow on a new Linux server Zabbix and immediately began to display the following warning:

Lack of Free Swap Space on Zabbix Server

The warning says that there is no place in the Swap section, having seen that there is no Swap partition at all, it’s strange that when installing Ubuntu 14.04 LTS with the option to use the entire disk it was not created automatically, there was only 6 GB of RAM on the server.

On this solution of the problem in my case was the creation of the Swap partition, after which the warning disappeared.
Look another my article on this – How to create SWAP in Linux

Well, if there is a lot of RAM and it’s free basically, then Swap can make no sense, so you can simply turn off the trigger for this server creating a notification. To do this, open the Zabbix panel, go to the “Settings” tab – “Network nodes”, in front of this server, click “Triggers” and deactivate the trigger creating this warning.

Done.

Configuring email notifications in Zabbix via iRedMail

On the test I will use Zabbix 3.0.3 and iRedMail 0.9.4 installed in Ubuntu Server 14.04.4 LTS.

First, in the Zabbix panel, activate the action by opening the tab “Configuration” – “Actions” and activate “Report problems to Zabbix administrators“. In it I also, to see the names of the hosts, changed both topics of the letter with:

{TRIGGER.STATUS}: {TRIGGER.NAME}

on

{TRIGGER.STATUS}: {HOST.NAME1} {TRIGGER.NAME}

In Zabbix, the email notification method was initially added, but depending on the settings of the mail server it can work or not work. You can find it by going to Zabbix under the administrator and opening the tab “Administration” – “Media types” – “Email“.

When configuring with iRedMail, I specified the following parameters:

Name: Email
Type: Email
SMTP server: mail.example.com
SMTP server port: 25
SMTP helo: example.com
SMTP email: user@example.com
Connection security: STARTTLS
Checkboxes for “SSL verify peer” and “SSL verify host” did not put
Authentication: Username and password
Username: user@example.com
Password: PASSWORD
check for “Enabled”

If the mail server is in the same system as the Zabbix server, you can try to configure both the above, but where “Connection security” and “Authentication” select “None”.

Also in the user profile, in the tab “Media” need to add:

Type: Email
Send to: mail for notifications
When active: time when it is allowed to be alerted
Use if severity: what importance of notification to send
check for “Enabled”

Done.

Zabbix installation on Ubuntu from distribution packages

On the test, I installed Zabbix 3.4 in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS.
Links to other versions of Zabbix can be found on the official website www.zabbix.com or http://repo.zabbix.com/zabbix/.
For example, Zabbix 3.4 for Ubuntu is located here http://repo.zabbix.com/zabbix/3.4/ubuntu/pool/main/z/zabbix-release/.

After installing Zabbix, transferred the data from the old Zabbix 2.2 server to it, simply exporting the templates first, then network nodes, set cards and complex screens.

Let’s proceed to installation, add the official source of packages to the system (example for Ubuntu 14.04 LTS (trusty)):

wget http://repo.zabbix.com/zabbix/3.4/ubuntu/pool/main/z/zabbix-release/zabbix-release_3.4-1+trusty_all.deb
sudo dpkg -i zabbix-release_3.4-1+trusty_all.deb
sudo apt update

For Ubuntu 16.04 LTS (xenial):

wget http://repo.zabbix.com/zabbix/3.4/ubuntu/pool/main/z/zabbix-release/zabbix-release_3.4-1+xenial_all.deb
sudo dpkg -i zabbix-release_3.4-1+xenial_all.deb
sudo apt update

For Ubuntu 18.04 (Bionic Beaver):

wget http://repo.zabbix.com/zabbix/3.4/ubuntu/pool/main/z/zabbix-release/zabbix-release_3.4-1+bionic_all.deb
sudo dpkg -i zabbix-release_3.4-1+bionic_all.deb
sudo apt-get update

Perform the installation of Zabbix:

sudo apt-get install zabbix-server-mysql zabbix-frontend-php zabbix-agent

Connect to the MySQL server and create a database:

mysql -uroot -p
create database zabbix character set utf8 collate utf8_bin;
grant all privileges on zabbix.* to zabbix@localhost identified by 'ПАРОЛЬ';
quit;

We import the standard data into the created database:

cd /usr/share/doc/zabbix-server-mysql
zcat create.sql.gz | mysql -uroot -p zabbix

For example, open the Zabbix server configuration file in the nano text editor (in nano, press Ctrl+X to exit, y/n to save or cancel changes):

sudo nano /etc/zabbix/zabbix_server.conf

Specify the MySQL database name, user name and password:

DBHost=localhost
DBName=zabbix
DBUser=zabbix
DBPassword=PASSWORD

Run the Zabbix server process:

sudo service zabbix-server start

You need to fix the PHP configuration for Zabbix. The Apache configuration file for the Zabbix web interface is located in /etc/apache2/conf.d/zabbix or /etc/apache2/conf-enabled/zabbix.conf. Some minimal PHP configuration parameters have already been set there:

php_value max_execution_time 300
php_value memory_limit 128M
php_value post_max_size 16M
php_value upload_max_filesize 2M
php_value max_input_time 300
php_value always_populate_raw_post_data -1
php_value date.timezone Europe/Kiev

Restart the web server to apply the changes:

sudo service apache2 restart
sudo service zabbix-server restart

Make sure that the Zabbix agent and the Zabbix server are started at system startup and, if necessary, enable:

sudo systemctl is-enabled zabbix-agent.service
sudo systemctl is-enabled zabbix-server.service
sudo systemctl enable zabbix-agent.service
sudo systemctl enable zabbix-server.service

The Zabbix web interface is available through a browser at http://HOST/zabbix.
By default, the user name for logging in through the web interface is admin or Admin, the password is zabbix.

See also:
Installing and Configuring Zabbix Agent in Ubuntu

Why Zabbix does not always draw graphics

There are times when some of the information on the graphs in Zabbix is missing, so to say it is displayed partially and with interruptions.

I will describe possible reasons for interruptions and their solution:

1) There may be a bad connection to the network node, you need to check the ping from the Zabbix server to the network node.
For example, the first PING command with large packages from Windows, and the second from Linux:

ping -t -l 1024 192.168.5.1
ping -i 0.2 -s 1024 192.168.5.1

2) The device is slow to work and stops responding when there are a large number of requests, in order to solve this problem it is necessary to uncheck “Use mass requests” in the settings of the Zabbix network node.

3) 32-bit counters are used to obtain data from the network node, and when loading device interfaces, for example, above 400 megabits, the data on the graph may not be displayed; in order to solve this problem, in the data elements, they must be replaced with 64-bit ones and the node’s network history is cleared in order there were no leaps.
For example, if traffic is received from the first network interface via the ifInOctets.1 MIB (32-bit), then it must be replaced with ifHCInOctets.1 (64-bit).