BunkerWeb by HTTP | Zabbix 7.0 WAF monitoring template
Hi everyone,
I work on BunkerWeb at Bunkerity, and we have recently published a Zabbix template for monitoring BunkerWeb, an open-source Web Application Firewall and reverse proxy based on NGINX.
The template is called BunkerWeb by HTTP and targets Zabbix 7.0 LTS and later 7.x releases.
It monitors BunkerWeb directly through its Prometheus exporter endpoint. Zabbix performs a single HTTP scrape per interval, while the remaining metrics and discovery rules are implemented as dependent items using Prometheus preprocessing.
This means that no Zabbix agent needs to be installed on the BunkerWeb instance, and no separate Prometheus server is required.
WHAT IT MONITORS
• BunkerWeb version and exporter availability
• Connections and request rates
• Blocked attacks
• HTTP response codes
• Request latency
• Bandwidth
• Upstream/backend behavior
• Cache status
• TLS protocol usage
• Metric collection errors
• NGINX shared dictionary usage
The template also automatically discovers BunkerWeb services and NGINX shared dictionaries.
It includes triggers for conditions such as:
• Prometheus exporter unavailability
• Monitoring plugin not initialized
• Metric collection errors
• Sustained 5xx rates
• Elevated attack rates
• Failing upstreams
• Deprecated TLS versions
• Projected shared-dictionary exhaustion
Connection parameters, discovery filters and alert thresholds are exposed as macros, so they can be adjusted per host without modifying the template.
HOW THE COLLECTION WORKS
The master HTTP item requests the BunkerWeb exporter endpoint using the host connection details and template macros.
Default values:
{$BUNKERWEB.EXPORTER.SCHEME} = http
{$BUNKERWEB.EXPORTER.PORT} = 9113
{$BUNKERWEB.EXPORTER.PATH} = /metrics
{$BUNKERWEB.EXPORTER.INTERVAL} = 1m
All the other items and discovery rules are derived from that single scrape.
BUNKERWEB CONFIGURATION
The metrics endpoint requires the BunkerWeb Monitoring and Prometheus exporter PRO plugins.
Minimal configuration:
USE_MONITORING=yes
USE_PROMETHEUS_EXPORTER=yes
PROMETHEUS_EXPORTER_ALLOW_IP=<Zabbix server/proxy IP or network>
The Zabbix template itself is public and released under the MIT license.
For clustered deployments, one Zabbix host should be created for each BunkerWeb instance, because the exporter exposes per-instance metrics rather than aggregating the whole BunkerWeb cluster.
REPOSITORY AND DOCUMENTATION
Template source, releases and installation instructions:
BunkerWeb Prometheus exporter documentation:
The latest release contains an importable template_bunkerweb.yaml file.
I would be interested in feedback from people running Zabbix 7.x, particularly on larger BunkerWeb deployments.
If you encounter an issue with discovery, preprocessing, triggers, or have metrics you think would be useful to add, feedback is welcome here or through the GitHub repository.
I work on BunkerWeb at Bunkerity, and we have recently published a Zabbix template for monitoring BunkerWeb, an open-source Web Application Firewall and reverse proxy based on NGINX.
The template is called BunkerWeb by HTTP and targets Zabbix 7.0 LTS and later 7.x releases.
It monitors BunkerWeb directly through its Prometheus exporter endpoint. Zabbix performs a single HTTP scrape per interval, while the remaining metrics and discovery rules are implemented as dependent items using Prometheus preprocessing.
This means that no Zabbix agent needs to be installed on the BunkerWeb instance, and no separate Prometheus server is required.
WHAT IT MONITORS
• BunkerWeb version and exporter availability
• Connections and request rates
• Blocked attacks
• HTTP response codes
• Request latency
• Bandwidth
• Upstream/backend behavior
• Cache status
• TLS protocol usage
• Metric collection errors
• NGINX shared dictionary usage
The template also automatically discovers BunkerWeb services and NGINX shared dictionaries.
It includes triggers for conditions such as:
• Prometheus exporter unavailability
• Monitoring plugin not initialized
• Metric collection errors
• Sustained 5xx rates
• Elevated attack rates
• Failing upstreams
• Deprecated TLS versions
• Projected shared-dictionary exhaustion
Connection parameters, discovery filters and alert thresholds are exposed as macros, so they can be adjusted per host without modifying the template.
HOW THE COLLECTION WORKS
The master HTTP item requests the BunkerWeb exporter endpoint using the host connection details and template macros.
Default values:
{$BUNKERWEB.EXPORTER.SCHEME} = http
{$BUNKERWEB.EXPORTER.PORT} = 9113
{$BUNKERWEB.EXPORTER.PATH} = /metrics
{$BUNKERWEB.EXPORTER.INTERVAL} = 1m
All the other items and discovery rules are derived from that single scrape.
BUNKERWEB CONFIGURATION
The metrics endpoint requires the BunkerWeb Monitoring and Prometheus exporter PRO plugins.
Minimal configuration:
USE_MONITORING=yes
USE_PROMETHEUS_EXPORTER=yes
PROMETHEUS_EXPORTER_ALLOW_IP=<Zabbix server/proxy IP or network>
The Zabbix template itself is public and released under the MIT license.
For clustered deployments, one Zabbix host should be created for each BunkerWeb instance, because the exporter exposes per-instance metrics rather than aggregating the whole BunkerWeb cluster.
REPOSITORY AND DOCUMENTATION
Template source, releases and installation instructions:
BunkerWeb Prometheus exporter documentation:
The latest release contains an importable template_bunkerweb.yaml file.
I would be interested in feedback from people running Zabbix 7.x, particularly on larger BunkerWeb deployments.
If you encounter an issue with discovery, preprocessing, triggers, or have metrics you think would be useful to add, feedback is welcome here or through the GitHub repository.