Batch check versions of installed packages in Linux

[1berto]

I have a zabbix server monitoring a big number (7000+) of linux hosts, i had created an userparameter that get the version of a single package (rpm -qa | grep -i "$1"), and know that i can make a macro in the zabbix server with the 'correct' version for each specific package, something like {$FIREFOX_BROWSER_VERSION}=62. But to make this way i would need to create every item and macro and keep them updated.

One strategy would be to have an external source for the version of each package and keep each macro updated using the API, is this the best approach?

This could be easily done if there was a method to 'discover' the packages (like the disk partitions discovery) and a 'matrix' of macros to compare them

[brunohl]

I don't know if I got it right but

Do the packages in all the server must be in the same version?

If so I would use one server to store the current version of each package and on each host would check via trigger against the main one.

[1berto]

I can't understand what you called 'same version', there is just one zabbix server, the packages that i need to look at are the ones of the installed on the hosts.

There is just one correct version for each package,the trigger should be fired when the item gets a value that is different than the corret for any package.
If i create an item with the key:
package.version[php5-dom]

The item would read something like:
php5-dom-5.2.14-0.7.30.42.1

So if there is a macro define like:
{$PHP5-DOM_VERSION}=php5-dom-5.2.14-0.7.30.42.1

I could create a trigger like:
{package.version[php5-dom].value.(0)}<>{$PHP5-DOM_VERSION}

It would be easy for one package, but a pain for hundreds of them. If There is a 'package discovery' and a 'macro matrix' of values it would be easy.

As i said, i know how to do this using the API, but need to know if there is a better way to do it...

[brunohl]

Yeah, but in my option you would not check the value against a Macro inside the host, but against other server, that holds the correct version for each software, so you must only update in one place.
Something like this:

{HOST_1:package.version[php5-dom].last(0)} <> {ONE_HOST_WITH_ALL_VERSIONS:package.version[php5-dom].last(0)}
{HOST_2:package.version[php5-dom].last(0)} <> {ONE_HOST_WITH_ALL_VERSIONS:package.version[php5-dom].last(0)}
{HOST_3:package.version[php5-dom].last(0)} <> {ONE_HOST_WITH_ALL_VERSIONS:package.version[php5-dom].last(0)}

[1berto]

If i have a 'macro matrix/array' i would need to update only in this matrix...
If i use the API, the source of the information could be in any place (including another computer)...
Anyway i liked your idea, i could set up a host to work like a template (that i must keep updated) and compare the item against it...

[brunohl]

Yeah I guess both ways could work. Seems that if you don't need to go into API it will save you some time

[dbatechnologies]

Hi

I have faced the same problem, to have list of packages from linux and their versions, but didn't come to the point of checking if they are the right version and trigger the alert, but the bit I did may help you:

I've created regular expression:

Then discovery prototype item:

Then php script:

#!/usr/bin/php
<?php

$progname = "zabsw.php";
$version = "0.1";

// Check arguments number
$args_number = ($argc - 1);
if ($args_number < 2) {
        echo "At least 2 parameters needed: action hostname <option1> <option2> ... \n";
        exit();
}

$action = $argv[1];

// Some checks need at least 3 arguments
if ($action=="version") {
        if ($args_number < 3) {
                echo "At least 3 parameters needed for application version:\n";
                echo "version hostname appname\n";
                exit();
        }
$appname = $argv[3];
}

$hostname = $argv[2];

exec ("echo `date` Called hostname and action: ".$hostname." - ".$action." >> /tmp/zabsw.log");

$soft=getapps($hostname);
$i = count($soft);
if ($action == "discovery")
{
echo "{\n";
echo '"data":['."\n";

$c=0;
# print_r($soft);
foreach ($soft as $d)
{
        $c=$c+1;
        echo "  {\n";
        echo '    "{#APPNAME}":"'.$d["soft"].'"}';
        if ($c!=$i) { echo ",\n";} else { echo "\n"; }

#  - ".$d["version"]."\n"; }
}
echo "]\n}\n";
}

if ($action == "version")
{

foreach ($soft as $d)
{
        if ($d["soft"]==$appname)
        { echo $d["version"]; }
#       exit();

}
}

exit (0);

function getapps($hostname)
{
       exec ('zabbix_get -s '.$hostname.' -p 10050 -k system.sw.packages[all,all,short]', $sw_full);

$sw_fullstr = $sw_full[0];

$software = explode(", ", $sw_fullstr);
$i=0;

foreach($software as $s)
{

        preg_match('/-[0-9]/',$s,$match,PREG_OFFSET_CAPTURE);
        $verp = $match[0];
        $verpos = $verp[1];;
        $soft[$i] = array ($i, "soft" => substr($s,0,$verpos), "version" => substr($s, $verpos+1, strlen($s)-$verpos));
        $i=$i+1;
}
return $soft;
}

?>

And I've created application for it, called just "Software".

And it looks like:

[danil_]

Hi, it's very interesting, but how do you get the exact version of the package(s)?
Does "system.sw.packages[all,all,short]" key return any version that you have listed on your screenshot?

In my case it doesn't, as well as the "full" format..
I try on Debian and Ubuntu hosts.

[danil_]

I guess I got the reason now. It's disappointing..

https://support.zabbix.com/browse/ZBXNEXT-2580?focusedCommentId=281624&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-281624

Please confirm you both are not in Debian/Ubuntu..

Also - has anyone tried it with the 4.0/4.2 Agent version in Ubuntu?
Anything changed here since v4?

[1berto]

That's exactly the type of thing i was thinking of...
Will study those concepts and give it a try, thank you.

[dbatechnologies]

Yes, I only have RHEL and centos servers, so wasn't even aware of this problem in other distros.
This could probably be solved with some UserParameters.

[danil_]

Thank you!
I was eager to use only the zabbix-agent functions in my case..