LLD Scripts that run on zabbix server not agent

[Linwood]

Is there any way to do LLD scripts that run on the zabbix server not the zabbix agent?

That may sound silly at first, but I want to set up items and triggers based on what templates are already applied to a host.

Here's the use case: All servers discovered and have templates for all services that should be there. I want to discover if a service pops up that should NOT be there, e.g. a web server opening up on a firewall, or an FTP or SMTP server on a host that should not have it. Basically to catch configuration mistakes, or things that come unexpectedly with upgrades/updates.

In concept this is simple to do... have LLD have a list of services, and let it check the host's zabbix configuration to see if they are already monitored (either by template name, or dive into the expressions). If any are not already monitored, then monitor for "down" and alert if "up".

In practice I can't see a legitimate way to check for this. I could do this during discovery, and have a bunch of negative rules (e.g. if SNMP service not found link template "smtp must be down") but that's both ugly and requires discovery running all the time. I was hoping to separate it from discovery. LLD is a great time and concept in which to check it -- I just don't have access to current host configuration information, at least so far as I can see. Do I?

Which is why I got excited seeing scriptable LLD's, then I realized the script is only on the agent (i.e. host) not the server. I need to see Zabbix's configuration to do this in a script.

The best I can come up with is using SQL to generate these from configuration data, then either blow them in directly (probably not, likely to conflict somewhere with caching and identity numbers), or script calls to the restful interface to link up the necessary templates (i.e. "NOT SMTP" template).

Any thoughts on a more zabbix-like approach to this? Some LLD magic?

[viktorkho]

Is there any way to do LLD scripts that run on the zabbix server not the zabbix agent?

Short answer: Yes, you can use zabbix_trapper item to accept LLD-data.

For all other: did you thought about nmap?

[Linwood]

Short answer: Yes, you can use zabbix_trapper item to accept LLD-data.

For all other: did you thought about nmap?

Any chance I could talk you into a bit longer answer?

Or am I understanding -- your thought is to permit a trapper transmission that says in some format "service X is now open", and that would produce an alert. But that trap would have to come from the host being monitored.

I want to use Zabbix to monitor that host, and react if such a service appears. That is of course very easy.

I think I have what I need though. I've written a bunch of SQL for another purpose that scans hosts for specific structure of triggers, and when it finds certain things, it outputs commands (as input into a bash script) which then adds dependencies and templates appropriately. Using the API it is very easy.

So what I'll do is just query for devices (in certain groups probably) that LACK a certain template (say HTTP) and then generate a statement to link the "NON-HTTP" template or something similar.

I'm doing that in preference to modifying SQL directly, just to be safe. To me the SQL is MUCH easier to get data from (of a complex nature) than the API, but the API is very easy to do something like link a template.

The one thing I can't find is an easy way to remove a dependency. I can remove ALL dependencies, but removing one appears to require querying for the host and all associated items, and updating. I think.

Why isn't add-dependency symmetric with remove-dependency.

But that's subject for some other discussion.

Thanks.

PS. NMAP is obviously a good way to discover services in general, this is really a simple matter of zabbix setup, as opposed to some alternative technique.

[viktorkho]

Sorry, Linwood, I had no time for forum.
If I understand your task properly, some kind of solution could be based on next principals:

1. there are M count of hosts and there are N count of possible services
2. each service have possibility to appear on each host (independently from you)
3. any service location on any host is illegal, if you doesn't allow it

So you have to create discovery rule to look for N services on M hosts, action for all - attach template with the only (default) trigger "Service X found on {HOST.NAME}". Then if you think that this service should be present on this host, replace template with proper one (for this type of service).