Cloud based Zabbix Server and Remote Proxies

[jluvs2ride]

So, I have been building and configuring individual Zabbix servers for a number of remote locations. Each location has it's own Zabbix server, if there are issues I get email notifications and if I want details, I connect to the site over VPN and connect to the Zabbix Web Sever.

To simplify things I am considering a central Zabbix server running in the cloud on MS Azure. Each remote location would have proxy running on lightweight hardware like a Raspberry PI all sending data to the central server.

My main concern is security. I understand that the proxies can send encrypted data to the server, does the proxy need communication back from the server?

Do I need an inbound rule on my firewall at each remote location?

I suppose the Web interface on the server should use SSL.

Are there other security concerns that come to mind that I may not have considered?

Are there any obvious reason I may have missed that make this configuration impractical?

Thanks.

[jluvs2ride]

Interesting.

I would have thought there would be more interest in this topic.

IMO the idea of a central could based Zabbix server with Proxies reporting from remote sites would be an appealing solution.

Is it such a mundane idea that it isn't even worth commenting on?

I did search the forums for a similar topic but most of what I found was using Zabbix to monitor their cloud resources.

I did have another question, I haven't used a proxy device yet so I am going to build one to complete my proof of concept. IOT monitor SNMP devices, do i install SNMP Tools on the server or proxy?

[syndeysider]

This is not related as much to Zabbix as it is to your understanding of "cloud" concepts, or even Application Architecture.

Zabbix Server / Proxy communication is TCP based. SSL secures the transmission of TCP/IP communication. Zabbix proxy and server have port requirements (firewall) that are stipulated in the documentation. Just like any other application. If you security harden your Zabbix Server and Proxies you should, theoretically, be fine.

The only obvious issue here is trying to run Zabbix Proxy on a raspberry pi which wouldn't be able to handle requests past (x) number of items.

[jluvs2ride]

Thank you for your response.

I had seen information indicating a RPi would be suitable for a proxy, but perhaps a proxy running on a vm would be a better choice.

[jluvs2ride]

Hardware for Zabbix Proxies

I wonder what the most popular platform for for proxies is.

[toine7m]

I'm doing almost the same project atm. But I used a different approach for security concern.

We've some clients with a zabbix server, and we don't want to open ports for it, so I'll use the port 80 or 443.

I collect the datas (the alerts in my case) with a php script which does some API calls, then the datas are sent via HTTP REST to the central Zabbix. After that, another script will send datas via the zabbix API to put data back in our main zabbix !

Because of the JSON format of the data, I use a simple JSON-RPC client/server to send the data to my main server.

I hope you'll understand me, my english isn't that good :3

If you've any question, I'll help you as much as I can

[jluvs2ride]

Thanks for your response.

I'm doing almost the same project atm. But I used a different approach for security concern.

We've some clients with a zabbix server, and we don't want to open ports for it, so I'll use the port 80 or 443.

I collect the datas (the alerts in my case) with a php script which does some API calls, then the datas are sent via HTTP REST to the central Zabbix. After that, another script will send datas via the zabbix API to put data back in our main zabbix !

Because of the JSON format of the data, I use a simple JSON-RPC client/server to send the data to my main server.

I hope you'll understand me, my english isn't that good :3

If you've any question, I'll help you as much as I can

Your English seems fine.

I have somewhat of a lab set up, working on proof of concept.

The problem I am having at the moment is communications between the proxy and the agents.

This is an example of the error;

cannot send list of active checks to "127.0.0.1": host [rpiproxy] not found

In this case it's the agent on the proxy itself. I would like each proxy to be a monitored host so I could be alerted of problems with the remote proxy.

[jluvs2ride]

So far;

I have a Zabbix Server running on MS Azure, a Zabbix Proxy and agent running on a Raspberry Pi, and a Zabbix agent running on a MS Server 2012 machine.

On the server I added the Remote Proxy, created a Discovery Rule linked to the Proxy, and a couple of actions linked to the Discovery Rule.

The Discovery Rule found the MS Server and the Proxy, the Actions successfully added them to appropriate groups, and linked them to the appropriate templates for monitoring.

However, In the zabbix_proxy.log I have this;

cannot send list of active checks to "192.168.1.211": host [rpiproxy] not found
cannot send list of active checks to "192.168.1.125": host [PROMETHEUS] not found

In the zabbix_agentd.log (on the remote proxy server) I have this;

no active checks on server [192.168.1.211:10051]: host [rpiproxy] not found

I have done a significant amount of searching GOOGLE, and this forum in an attempt to understand these errors.

I have also noticed that the MS Server has the IP Address as the Host Name rather than the actual Host Name.

Any ideas?

[toine7m]

I think that your problem is coming from your Hostname.

In the zabbix_agentd, the hostname match the computer hostname ? No uppercase/lowercase mismatch ?

It looks like your Zabbix doesn't know things about your hosts because he doesn't recognize them

[onallion]

First of all - are you even using active checks? Check the items on your hosts and see if they are passive or active. If you're not using any active checks, there's no need to define an active server in the agent configuration. Just leave it commented.

If you ARE using active checks, the host name in the Zabbix Server and the Zabbix Agent need to be the same.

[jluvs2ride]

Thanks for your help.

First of all - are you even using active checks? Check the items on your hosts and see if they are passive or active. If you're not using any active checks, there's no need to define an active server in the agent configuration. Just leave it commented.

If you ARE using active checks, the host name in the Zabbix Server and the Zabbix Agent need to be the same.

Well, I need to research the difference between active and passive checks. You may be correct that I may not need this.

Also I am using HostnameItem=system.hostname to define the host name.

[jluvs2ride]

So far.

I commented out server active in the agent config files and I no longer get the errors.

Discovery seems to work well. I plan to build another RPI proxy to use at another location to continue testing.

I have noticed that I get a few high Disc I/O alerts. I'm using an older RPI and a cheap card I had lying around. So, I think an RPI 3 and a faster card would resolve this.

[toine7m]

Yes or get a BananaPI or something more powerful

[jluvs2ride]

I think this is very promising.

The Cloud Server runs fine and the Proxy seems to work well. Granted, this is a small site for testing, but I think this proves the concept is not only practical but a good solution.

[jluvs2ride]

I am pleased with the way this is turning out.

I have added another site using a Raspberry Pi 2 as the proxy. This seems to perform better Except for trapper processes going high.

Network discovery works on the equipment I have the agent installed on except that it creates the hosts with the IP addresses for the Host Names. Seems odd, because discovery on the original site was able to bring over the DNS names for the individual items.

Next week I will be adding a third site, this time using a Raspberry Pi 3.

Stay tuned.