Application discovery in a scale

[rockaut]

Heja guys,

I would have pretty specific question. I think about application discovery or template linking around this topic. We are 5.0 and 5.x then and for now talking about linux client mostly - windows later.

I would like to have some sort of central app discovery where a process, systemd unit or a simple file or even an port is getting recognised and then an template is assigned. That would be the wish/dream but it's not the current situation (I already created some ZBXNEXT issues (searching them and linking it later)).

So my workaround would be this:

• I create an App Template with a single / or multiple items which are doing the basic "recognition" (for example only every 6h).
  • lets say proc.num[nginx]
• A discovery rule in this App Template depends on this item and if result >= 1 creates the items to monitor.
• This Template is then linked to EVERY linux host. Not only the ones I know they have nginx running ... because actually I don't know which one has it running.

So what would you say? Imo this should be sensible in terms of performance additional metrics/burden.
Our load is currently not too high as we haven't rolled it out widely. We have around 6000 hosts and waaaaaayyy more containers but nicely spread across multiply proxies of course.

As an alternative I thought about an single item on each host ( system.sw.packages ) which are then "crawled" by an script (through zabbix-api) which links the appropriate templates.

Clarification:
I know the current "best way" would be with host meta data and actions. BUT: this would involve client side scripts which I would like to avoid or minimalize to the extreme. Like just some basic scripts Usermethods which I then never touch again.

As said above, I would dream about more dynamic action rules where we can't just react on hostname/proxy/hostmeta but also on tags for example.

[rockaut]

Hmm... I also thought about an item (system.sw.packages) which triggers an event like "NGINX found" which then executes an action with an remote command which adds the template.
But here I can't figure out how the automatic removal of the template might work?

Maybe I'm overthink that all way too much.

[isaqueprofeta]

First, try using Network Discovery and probing the application ports and/or zabbix_agent keys like your proc.num[nginx] for the process search. Then use Network Discovery Actions to add the templates based on the Discovery probed conditions.

[rockaut]

I forgot to mention that we drive only active agents because all nets are locked down. So no network dicovery either.

[isaqueprofeta]

Then, try using HostMetadata inside agent configuration, populate it with a list of comma-separated values (try using a shell script discovering the process or application directories). Then use Network Auto Registration to add the templates based on the HostMetadata list.

Reference 1 (HostMetadata on Agent): https://www.zabbix.com/documentation..._host_metadata
Reference 2 (HostMetadata on Actions): https://www.zabbix.com/documentation...ration_actions