TCP port monitoring template not working

[mcflurry]

I'm trying to get this template working without success...

https://share.zabbix.com/templates/operating-systems-linux-template-listening-tcp-port-discovery-and-monitoring/

I've followed discovery instructions for agent2:

Install UserParameter for zabbix-agent2:
echo 'UserParameter=ss.tcp.listening,netstat --tcp --listening --numeric-ports' | sudo tee /etc/zabbix/zabbix_agent2.d/ss.tcp.listening.conf

Restart Zabbix agent
systemctl restart zabbix-agent2

In this section replace Key:
system.run["ss --tcp --listening --numeric"]
with:
netstat.tcp.listening

I've imported the template and added it to a Linux host and there's no update about it. Is there anyway to debug this? Am I missing something????

server:/etc/zabbix/zabbix_agent2.d # ll
total 8
drwxr-xr-x 2 root root 4096 Jun 27 12:26 plugins.d
-rw-r--r-- 1 root root 73 Jun 30 14:43 ss.tcp.listening.conf
server:/etc/zabbix/zabbix_agent2.d # cat ss.tcp.listening.conf
UserParameter=ss.tcp.listening,netstat --tcp --listening --numeric-ports

[Markku]

Ok, oh well. As you saw from the beginning, the template is not very high quality (the contradicting information about using system.run/ss.tcp.listening/netstat/ss/whatever). So there is a problem in Filter: "Type of calculation" was set to "And/Or" which was in this case evaluated as "Or". Set it to "And", and the filtering starts working properly.



Markku

[vladimir_lv]

you have to use the same key in the item (ss.tcp.listening ) as described in UserParameter.

[mcflurry]

Uhm, well, i imported the template and then followed the documentation....

You mean that this:



Should be like this:



And "Key" in "Discovery rule" has to be as it says in the documentation (as it's set in op), Key: netstat.tcp.listening

[vladimir_lv]

Yes, should be like this. Is it working now?

[mcflurry]

I fear not... I've added the template to a linux host and nothings happens... i guess it should discover every open port for that host, or am I wrong?

I've tested the discovery rule of the template in Configuration -> Hosts and it returns: "Unknown metric netstat.tcp.listening"

But if i change that to ss.tcp.listening it returns this:

[{"{#PORT}":"25"},{"{#PORT}":"512"},{"{#PORT}":"513 "},{"{#PORT}":"514"},,{"{#PORT}":"199"},},{"{#PORT }":"21"}

Does that means that value "Key" in the discovery rule must meet the user parameter and the key in the item???

[vladimir_lv]

Does that means that value "Key" in the discovery rule must meet the user parameter and the key in the item???

Yes, exactly!

[mcflurry]

Updated everything and it doesn't discovers any port...

Running "zabbix_agent2 -t ss.tcp.listening" from cli returns all listening ports...

[vladimir_lv]

But if i change that to ss.tcp.listening it returns this:

[{"{#PORT}":"25"},{"{#PORT}":"512"},{"{#PORT}":" 513 "},{"{#PORT}":"514"},,{"{#PORT}":"199"},},{"{# PORT }":"21"}

Is this result what you wish to get?

[mcflurry]

Is this result what you wish to get?

Yes, and i guess the javascript will format those ports just to display the port number.

[vladimir_lv]

Because the result look like:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:10051 0.0.0.0:* LISTEN
tcp 0 0 localhost:199 0.0.0.0:* LISTEN

you need to use Type of information: Text

[mcflurry]

Because the result look like:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:10051 0.0.0.0:* LISTEN
tcp 0 0 localhost:199 0.0.0.0:* LISTEN

you need to use Type of information: Text

If I change that in the item prototype a message shows up: This type of information may not match the key.

This is a template, it should be configured almost oob.

[Markku]

There is now confusion about the discovery key and the item prototype key.

The discovery key seems to be ss.tcp.listening. The item prototype key is something else, whatever was configured in the template, don't edit if you don't know what you are doing.

But please clarify this:

I've imported the template and added it to a Linux host and there's no update about it.

How long did you wait for the items to be discovered? In the screenshot you showed us the discover interval is one day. Did you wait for one day or less?

(I'm currently on iPad so I cannot download the yaml file to see the original setup, sorry.)

Markku

[mcflurry]

There is now confusion about the discovery key and the item prototype key.

The discovery key seems to be ss.tcp.listening. The item prototype key is something else, whatever was configured in the template, don't edit if you don't know what you are doing.

But please clarify this:



How long did you wait for the items to be discovered? In the screenshot you showed us the discover interval is one day. Did you wait for one day or less?

(I'm currently on iPad so I cannot download the yaml file to see the original setup, sorry.)

Markku

You were right, it took hours to update... and i didn't change a thing, just importing the template works.

[Zablab]

Is there a Windows equivalent version of this? Or, rather, is there a way to monitor multiple ports via single key\template? I want to be able to monitor specific Ports on various Server types, for example:

445 on File Server
1433 on SQL Server
80, 443 on Web Server

I know about net.tcp.service[tcp,,{$TCP.PORT}] but that's only a single Port, I'd like to avoid creating a ton of different Marco's or Templates.
It doesn't appear I can use Regex for this single Macro, it seems I need to do a discover and filter?

From what I gather this version does a full port discovery & then you uses Regex\Java to filter out the ports you want or don't want, this is pretty much what I want to do in Windows, but unsure how to convert this, and I can't find a Windows version.

[mcflurry]

Is there a Windows equivalent version of this? Or, rather, is there a way to monitor multiple ports via single key\template? I want to be able to monitor specific Ports on various Server types, for example:

445 on File Server
1433 on SQL Server
80, 443 on Web Server

I know about net.tcp.service[tcp,,{$TCP.PORT}] but that's only a single Port, I'd like to avoid creating a ton of different Marco's or Templates.
It doesn't appear I can use Regex for this single Macro, it seems I need to do a discover and filter?

From what I gather this version does a full port discovery & then you uses Regex\Java to filter out the ports you want or don't want, this is pretty much what I want to do in Windows, but unsure how to convert this, and I can't find a Windows version.

I haven't found anything for windows like this one.

And about this one, I can't get to filter ports. It discover every listening port, so if there are random ports listening it discovers those too... and when the process stop using those ports it complaints about those.

I've been playing with the filter and it does nothing.

[Markku]

I've been playing with the filter and it does nothing.

The template documentation says that macros {$TCP.PORT.MATCHES} and {$TCP.PORT.NOT_MATCHES} (regular expressions) can be used for filtering. So, for example, to match only port 22, you could use ^22$ in {$TCP.PORT.MATCHES}. Or, ^(22|443|3306)$ matches 22, 443 or 3306.

^ matches start of string, $ matches end of string. Parenthesis and pipe (|) can be used as "or" grouping.

If you enter just 22, it will match any string that contains 22, like 10220. Or, plain (22|443) will match 12200 and 30443.

Markku