cant get system.hw.chassis[serial] to work.

[batchen_regev]

Hey,
we have zabbix server runing throw docker xxl, zabbix server 3.4


now im tring to make an item to get all linux machines serial number.
the machine has AllowRoot=1 at agent

and when i run on the machine localy :
:~ # zabbix-agentd -t system.hw.chassis[serial]
system.hw.chassis[serial] [s|VMware-42 a ac 57 af f2]

works.
if i do it in an item (atteched)

goes "zabbix unsupported"

if i run from server zabbix_get :


[root@0e828539a924 /]# zabbix_get -I 172.18.0.4 -p 10050 -s 10.16.x.x -k "system.hw.chassis[serial]"
ZBX_NOTSUPPORTED

or

[root@0e828539a924 /]# zabbix_get -I 172.18.0.4 -p 10050 -s 10.16.x.x -k "system.run[zabbix-agentd -t system.hw.chassis[serial]]"
system.hw.chassis[serial] [m|ZBX_NOTSUPPORTED]

why ?

LOG :
16944:20181029:164102.568 Requested [system.hw.chassis[serial]]
16944:20181029:164102.568 Sending back [ZBX_NOTSUPPORTED]

[LenR]

It needs root permission. We were using facter prior to zabbix, so I setup userparameters and sudo access for zabbix to get root only facts, I think before this item even existed.

[batchen_regev]

but it have root premmition wehn i added the AllowRoot=1 to conf file.
how else should i do it ?

[batchen_regev]

somone ? can you help ?

[batchen_regev]

======UP======
still havent found any solution..

[kloczek]

Just disable or provide proper set of rules for SELinux.

[batchen_regev]

i dont have SELinux active , i found the issue - the item does work on all my linux machine except of SUSE machines.
any idea way ? i gusse for suse the AllowRoot=1 not working ? somone knows ?

thanks

[batchen_regev]

===up===
+++++++

[batchen_regev]

AllowRoot doesnt work at suse at all (all dist) only if i go to /etc/passwd and replace zabbix user group to 0 (as root user)
there must be somthing im missing here..

another info :
when stopping zabbix systemctl stop zabbix-agentd.service
and starting it like this :
/usr/sbin/zabbix-agentd -f

all works.

[batchen_regev]

well i managed to get a workaround so i post here if somonw will need,
the issue with allow root is only in SUSE machines, so the other solution to check serial is this :

go to /etc/sudoers
and added :

zabbix ALL=(ALL) NOPASSWD:ALL

and the item should be insted of : system.hw.chassis[serial]
system.run[sudo cat /sys/class/dmi/id/product_serial]

i hope somday zabbix team fix this.

[cvee.it]

I came across the same issue, on Centos 8.x zabbix_agentd (daemon) (Zabbix) 4.4.4

Your fix worked.

I also found part of the problem is the service file, it depicts zabbix as the running user in the service config. That is why when you run the agent process manually it works, but via the service, it does not.
Not sure why the Allowroot=1 isn't doing its job, the service configuration file is taking precedence.

I still like your solution better, both pose the same risk profile imo.


cat /usr/lib/systemd/system/zabbix-agent.service
[Unit]
Description=Zabbix Agent
After=syslog.target
After=network.target

[Service]
Environment="CONFFILE=/etc/zabbix/zabbix_agentd.conf"
EnvironmentFile=-/etc/sysconfig/zabbix-agent
Type=forking
Restart=on-failure
PIDFile=/run/zabbix/zabbix_agentd.pid
KillMode=control-group
ExecStart=/usr/sbin/zabbix_agentd -c $CONFFILE
ExecStop=/bin/kill -SIGTERM $MAINPID
RestartSec=10s
User=zabbix
Group=zabbix
#User=root
#Group=root
[Install]
WantedBy=multi-user.target