icmppingsec: /usr/bin/fping: [13] Permission denied

[NOOK]

Hello, dear community.
I have a problem with making ping item to create a graph:
My fping located in /usr/bin/fping, not in /sbin/
So i configired zabbix_server.conf file:

### Option: FpingLocation
#	Location of fping.
#	Make sure that fping binary has root ownership and SUID flag set.
# Mandatory: no
# Default:
FpingLocation=/usr/bin/fping

There is also fping6 option near, but when i uncomment

# Fping6Location=/usr/bin/fping6

zabbix server don't start, so i ran without it (is it useing to make simple ping time?)

zabbix_server [2482]: unknown parameter [Fping6Location] in config file [/home/uadm/work/zabbix/etc/zabbix_server.conf], line 415

then i apply premissions like described in manual:

shell> chown root:zabbix /usr/sbin/fping
shell> chmod 4710 /usr/sbin/fping

but i type /bin/, not sbin.

So after all that i did not receive any date with this item, and have errors in log:

1546:20130102:152015.251 /usr/bin/fping: [13] Permission denied
  1546:20130102:152018.254 /usr/bin/fping: [13] Permission denied
  1540:20130102:152018.265 cannot send list of active checks to [192.168.1.250]: host [RECHMP] not found
  1546:20130102:152021.258 /usr/bin/fping: [13] Permission denied
  1546:20130102:152024.261 /usr/bin/fping: [13] Permission denied

Someone can tell me why i don't have permissions?
Thanks for help.

[vrtareg]

Hi

Try to change owner for /usr/sbin/fping to root:root and set sticky bit - "chmod +s /usr/sbin/fping".

This is working fine for me.

You can check it by logging as Zabbix user and try to rung fping from command line: "/usr/sbin/fping www.google.com".

Regards,
Areg

[NOOK]

Hello, vrtareg.
Thanks for respond.
asi wrote before - i dont have fping in /usr/sbin/, will it works for mine /usr/bin?

[vrtareg]

Hi

In the first post you mentioned that you set the permissions on /usr/sbin/fping file.

Yes it will normally work if the fping is located in /usr/bin folder too.
Just be sure that you set the +s permission on the same file that is mentioned in configuration file.

Regards,
Areg

[NOOK]

I did what you wrote:

root@spravka:/usr/bin# ls -al | grep fping
-rwx--x---  1 root   root      31528 2010-02-02 09:06 fping
-rwxr-xr-x  1 root   zabbix    31560 2010-02-02 09:06 fping6

Nothing changed - permission denied.

PS. Do i need to restart zabbix server?
And if yes - meybe you can tell me how to do it easy?

Thanks for help.

[vrtareg]

Hi

You should run the following commands:

chown root.root -v /usr/bin/fping
chmod a+s -v /usr/bin/fping*

It is not necessary to restart Zabbix Server.

Regards,
Areg

[NOOK]

Sorry, i have russian locale, but here is shell:

root@spravka:/tmp# chown root.root -v /usr/bin/fping
владелец «/usr/bin/fping» оставлен как root:root
root@spravka:/tmp# chmod a+s -v /usr/bin/fping*
права доступа «/usr/bin/fping» изменены на 6710 (rws--s---)
права доступа «/usr/bin/fping6» изменены на 6755 (rwsr-sr-x)

-rws--s---  1 root   root      31528 2010-02-02 09:06 fping
-rwsr-sr-x  1 root   zabbix    31560 2010-02-02 09:06 fping6

Looks like all okay, but it wont work.

[vrtareg]

Hi
It is not Ok as there is no read permission for group and read + execute for other on /usr/bin/fping.

You need to fix them:

chmod -v 6755 /usr/bin/fping

Regards,
Areg

[NOOK]

Hi
It is not Ok as there is no read permission for group and read + execute for other on /usr/bin/fping.

I am a newbie unix user, so sorry for that.

Now there is no permission messages in log, but there is still

  1478:20130102:175906.542 cannot send list of active checks to [192.168.1.20]: host [INSYSERVER] not found

[vrtareg]

Hi

That's Ok

Seems you tried to add the icmpping item to the existing template which is trying to access the agent running on that host (192.168.1.20).

If you are trying to monitor the host without the Zabbix Agent running you need to create new template (something like "Host Availability") with the icmpping* items and assign that template to the host.

Hope this will help.

Regards,
Areg

[NOOK]

Helo, Areg.
Yes, You are right, i just added ping item to default OS Windows template.
Can you explain me why i need to separate it to new template, and why i have working ping and errors in log? Its some kind of conflict?

[vrtareg]

Hi

The standard Windows template contain items which require the Zabbix Agent to be running on the host.
The Simple Check item does not require the Agent to be running on host because it is checked by the Zabbix Server.

So in the log you are getting error message from the Windows template Agent items which are working in the way that Server is communicating with the Agent by sending the list of the items to be checked and after that Agent collecting the data and sending them back to the server.

It is better to separate the the different kind of items in separate templates so you will be able to control them and assign to the hosts if necessary.

For example you can have a "Host Availability" template with the icmpping and icmppingsec items with the according graphs and triggers which will check the host availability and latency to the host. After that you can assign this template to the different hosts even if they are not running Agent.

Hope I explained well and this will help you.

Regards,
Areg

[NOOK]

Areg, thank you very much for great explanation. Now i see, that i need to separate passive and active checks, and i learned how to link templates
But after separating icmp checks to the new template problem still remain.
But i see in log that error appears only on 3 hosts. I thought that problem can be in agent configuration, and i remembered, that had troubles with configuration. I set ServerActive same as Server (ip of zabbix server). Is it right?
On non problem hosts ServerActive=127.0.0.1.
Now i'm confused.
Sorry, for some offtopic.
Thanks for help.

[vrtareg]

Hi

You should probably need to check the logs on the Agent hosts.
The values Server and ServerActive can be configured both and they can point to the same Zabbix server.

You should increase the level of debug on problematic hosts agent config file and check is there any messages about active checks.

You can dump the log content so we can have a look what's going on.

Regards,
Areg

[NOOK]

Here is my agent log in maximum debug level.
http://pastebin.com/WNH4cmDt
I see fail situation only here:
4084:20130104:121207.512 In collect_perfstat()
1952:20130104:121207.543 Got [{"response":"failed","info":"host [RECHMP] not found"}]
But now i don't know what to do next.