Repository navigation
New to Zabbix and trying to use this #51
Description
Hi,
I'm relatively new to Zabbix so there is a good chance I'm missing something. We monitor most of our hosts via SNMP and don't have the agent installed (mostly because we are still in a testing phase and I don't want an agent left behind if we go another way).
So since we aren't using the agent, I would like to monitor SSL certs on some of the hosted sites via script instead.
I've put the script in /usr/local/bin and made it executable.
I've put the conf file in /etc/zabbix/zabbix_agentd.d
I've imported the basic example template.
But when I go to assign to a host it wants it to be an agent host rather than SNMP. Is the agent required or can I modify the template in some way to make this work in our scenario.
Thanks for your help in advance.
Activity
astrugatch commentedon Nov 6, 2024
reading back over what I wrote and realizing that it obviously requires the agent. sigh. Back to the drawing board.
selivan commentedon Nov 6, 2024
@astrugatch You can use the agent on Zabbix server itself, if it has access to hosts and ports that require TLS cert monitoring.
See the example in
zabbix_integration_examples:template_ssl_advanced.xml- zabbix templateuserparameters_ssl_cert_discovery.conf- userparameters for monitoring agentssl_cert_list.json- list of hosts, ports and domain names to monitorastrugatch commentedon Nov 7, 2024
OK. I think I'm 95% of the way there. I've got the JSON filled out and in place, the conf files in place, and the template imported and applied to the Zabbix host. But under discovery rules the status shows as Unsupported item key. instead of enabled.
selivan commentedon Nov 7, 2024
@astrugatch Seems that zabbix agent didn't read userparameters from
userparameters_ssl_cert_discovery.conf.You should place that file somewhere in
/etc/zabbix/zabbix_agentd.conf.dor/etc/zabbix/zabbix_agentd.dor whateverInclude=directive in your/etc/zabbix/zabbix_agentd.confsays. Than you should restart zabbix agent.You can check if userparameter became available by running
sudo -u zabbix zabbix_agentd -t ssl_cert_list.Running from root without sudo also works, but than you can miss problems like file premissions.
astrugatch commentedon Nov 7, 2024
Thanks for your reply.
Without changing anything
sudo -u zabbix zabbix_agentd -t ssl_cert_listreturns my JSON./etc/zabbix/zabbix_agentd.dis the location set byInclude=Contents of /etc/zabbix/zabbix_agentd.d
astrugatch commentedon Nov 7, 2024
I see in another thread with a similar issue that someone moved the script int /etc/zabbix/zabbix_agentd.d as well. I'm assuming I would need to modify the conf files to match the script location.
astrugatch commentedon Nov 7, 2024
moving the script worked.
Is the hostname variable in the json the server host name or the host name expected in the certificate? I'm having servers with a wildcard installed returning as invalid.
astrugatch commentedon Nov 7, 2024
Disregard. It's a config issue. Missing an intermediate cert. Browsers don't seem to mind but openssl seems to care.
selivan commentedon Nov 7, 2024
{#IPADDR}is network endpoint to connect to looking for certificate(DNS hostname or IP address),{#SSLDOMAIN}is hostname expected in the certificate.Glad I could help.