How to monitor a server hidden behind firewall and unreacheable by the Zabbix Server

[douglascrp]

Hello everyone.

I am new here.

I have been running Zabbix to monitor some servers I take care. So far, so good.
But I have this specific server, that runs in the customer's infrastructure, and it is not publicly exposed.

The way I do maintenance on it is by connecting through SSH, and that is the only way I can reach the server.

Zabbix agent is already installed and running, but my Zabbix server can not communicate with the agent, but the reasons I mentioned before.
What is the right way to have this working? How to make the agent to send pro-actively the information Zabbix server needs to monitor it?

What I need to monitor is basically CPU, memory, disk and a set of services that I need to make sure are running, like Apache (http and https).

I hope someone can give me some tips on how to do so.

Thank you in advance.

[ingus.vilnis]

Hello and welcome to Zabbix forums!

Zabbix Agent active checks are exactly for this purpose as long as you can establish a TCP connection from that remote server to Zabbix server.

Here is more on the Active checks https://www.zabbix.com/documentation...#active_checks
And then you can use all the items available from here: https://www.zabbix.com/documentation...s/zabbix_agent

[DeltaCentral]

Hi Doug,

We monitor our servers using Zabbix and they are all behind firewalls. You will need port forward 10051 from your firewall to your zabbix server, then on the client workstation setup the zabbix client in active mode, you can use the guide in the link below.

https://www.deltacentral.co.uk/zabbix-mpa-agent-active/

You also need to create a copy of both (Template App Zabbix Agent) & (Template OS Windows) on the server side and call it (Template App Zabbix Agent ACTIVE) & (Template OS Windows ACTIVE) and carry out a "Mass Update" on all the items and change the "Type" value to "Zabbix Active" for both templates and assign these to your Host

When creating a Host, the Agent Interface IP will be the (External IP Address) of where the server is located and the port will be 10051. You can use the "Latest Data" located under the (Monitoring) section on Zabbix to see if data is being polled.

Don't forget to start the Zabbix service on the client server and check the logs.

Hope the above helps, J

[ingus.vilnis]

Don't forget that after the Mass Update on regular items you need to change the Discovery rules and item prototypes to agent (active) too.

And when creating the hosts in Zabbix frontend the IP really does not matter for active-only hosts. You can set it to whatever you want, but usually the real IP of the host can be used for consistency. The external IP is added automatically only when Active Agent Autoregistration action is used.

[DeltaCentral]

Yup, don't forget the discovery rules and item prototypes, as if not changed to agent (active) will result in RED [ZBX] Availability errors. In Active Monitoring the [ZBX] availability icon will never be lit green like the passive monitored items, please correct me if I'm wrong. Thanks for the additional information ingus.vilnis

[kloczek]

Yup, don't forget the discovery rules and item prototypes, as if not changed to agent (active) will result in RED [ZBX] Availability errors. In Active Monitoring the [ZBX] availability icon will never be lit green like the passive monitored items, please correct me if I'm wrong. Thanks for the additional information ingus.vilnis

Discovery rules are for passive agents.
For active one are autoregistration actions.

[ingus.vilnis]

Discovery rules are for passive agents.
For active one are autoregistration actions.

Not in context of this thread.

[kloczek]

Aaa .. you are talking about LLDs
Be aware that in this thread is discussed approach to monitor agents behind FW .. not what is monitored on exact host (behind or not FW)

[ingus.vilnis]

Yes, so Active checks are the way to go in the situation as described when you can't make passive connections.

Not said that the FW is letting outgoing connections to the Zabbix Server and that is a blocker then but we have no confirmation about that yet.

[douglascrp]

Sorry guys for my really late response.
I was not working on this project for some time already, but I will be back to it soon.
I will read carefully all the responses you gave me and will keep you informed about the results.

Thank you all.