Ad Widget

Collapse

New VPS with Ubuntu 20.04 and iRedmail can't monitor

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • akarim
    Member
    • Aug 2008
    • 33
    #1

    New VPS with Ubuntu 20.04 and iRedmail can't monitor

    I have a problem that is not resolved on a new Ubuntu 20.04 machine
    When I activate the monitoring it fails because of the ping.

    Code:
    tail -f /var/log/zabbix/zabbix_server.log | grep  -i albarid
2589713:20220703:080446.482 Zabbix agent item "agent.ping" on host "smtp.mydomain.es" failed: first network error, wait for 30 seconds
2589732:20220703:080546.531 temporarily disabling Zabbix agent checks on host "smtp.mydomain.es": host unavailable
    I made some checks
    • Check firewall in VPS and Zabbix server. Is open (fulll ports for test problem). Open
    • Check ping from server zabbix to monitorized VPS. Works
    • Check telnet connnection. Some issues

    From VPS to server
    Code:
    root@smtp:~# telnet zabbix.server.tld 10050   
Trying 51.15.158.217...
Connected to zabbix.server.tld.
Escape character is '^]'.

root@smtp:~# telnet zabbix.server.tld 10051
Trying 51.15.158.217...
Connected to zabbix.server.tld.
Escape character is '^]'.
    From server to VPS
    Code:
    [root@monitor01 ~]# telnet smtp.mydomain.tld 10050
Trying 37.59.219.193...

[root@monitor01 ~]# telnet smtp.mydomain.tld 10050
Trying 37.59.219.193...
    From VPS to Server
    Code:
    root@smtp:~# telnet zabbix.server.tld 10050
Trying 51.15.158.217...
Connected to zabbix.server.tld.
Escape character is '^]'.

Connection closed by foreign host.
root@smtp:~# telnet zabbix.server.tld 10051
Trying 51.15.158.217...
Connected to zabbix.server.tld.
Escape character is '^]'.

Connection closed by foreign host.
    Config zabbix client
    Code:
    PidFile=/run/zabbix/zabbix_agentd.pid
LogFile=/var/log/zabbix/zabbix_agentd.log
LogFileSize=50
DebugLevel=3
Server=server.zabbix.ip
StartAgents=5
ServerActive=server.zabbix.ip
Hostname=smtp.mydomain.tld
Include=/etc/zabbix/zabbix_agentd.d/*.conf


    Selinux is disable in zabbix client

    Code:
    setenforce disabled
setenforce: SELinux is disabled
    Client is 6.X
    Server zabbix is 5.X


    Tags: ping
    • markfree
      Senior Member
      • Apr 2019
      • 868
      #2
      The way you described it, it seems your VPS can start a connection but your server cannot. So, you may have a networking issue.
      Maybe some firewall rule that prevents your Server from starting a connection to your VPS.

      Just to be sure, is Your Zabbix Server version 5 and your VPS Zabbix Agent version 6?

      Maybe you should switch to Zabbix Agent version 5 on the VPS machine.
      Next, try Netcat instead of Telnet between your Server and VPS.
      Code:
      nc -zv smtp.mydomain.tld 10050
      Then, try switching your Agent from passive to active and see if your Server can receive new item values (other items, not "agent.item").

        Comment

        • akarim
          Member
          • Aug 2008
          • 33
          #3
          Always when I get issues, the first action is to disable the firewall, to check if the problem is about the firewall.

          The problem persists even when there is no active firewall on either of the two machines, server and client.

          Client
          Code:
          root@smtp:~# nc -zv zabbix.server.tld 10050
Connection to zabbix.server.tld 10050 port [tcp/zabbix-agent] succeeded!
          Server
          Code:
          [root@monitor01 ~]# nc -zv smtp.mydomain.tld 10050 
Ncat: Version 7.70 ( https://nmap.org/ncat )
          Not response.

          With others clients

          Code:
          [root@monitor01 ~]# nc -zv srv105.machine.net 10050
Ncat: Version 7.70 ( https://nmap.org/ncat )
Ncat: Connected to 5.135.1.1:10050.
Ncat: 0 bytes sent, 0 bytes received in 0.03 seconds.
          That's why I think the problem is another.


          I've tried change to passive, but same result.

          Code:
          2589715:20220727:072053.080 Zabbix agent item "net.if.in[eth0]" on host "smtp.mydomain.tld" failed: first network erro
r, wait for 30 seconds
          But no error in communication of ping, sshd, etc.

            Comment

            • Markku
              Senior Member
              Zabbix Certified SpecialistZabbix Certified ProfessionalZabbix Certified Expert
              • Sep 2018
              • 1781
              #4
              Looks like something prevents 10050/tcp connections from server to VPS. Does your VPS platform (not the server) have a firewall?

              Also, since your agent (VPS) can connect to the server at 10051 (= active agent connections would work), what is your use case that requires use of passive checks (= server connects to agent 10050)?

              When the connectivity issue is resolved, also note that as mentioned you should not use agent version 6 with Zabbix server version 5. Some things may work but not all.

              Markku

                Comment

                • akarim
                  Member
                  • Aug 2008
                  • 33
                  #5
                  Hi.

                  Yes, I have a firewall.
                  Yes, i deactivate two firewall (server zabbix and host zabbix agent) for check problem
                  Yes, verified is not acitve selinux or apprmor other mechanism of bock port.
                  Yes, I've check during test, logs on VPS client zabbix for chek any issues (security, or other)
                  Yes, also change zabbix agent to version 5 (zabbix-agent amd64 1:5.0.26-1+focal)
                  Yes deactivate active check. because active check configuration update from [x.x.x.x:10051] started to fail (cannot connect to [[x.x.x.x.]:10051]: [111] Connection refused)


                  Code:
                  root@smtp:~# tail -f /var/log/zabbix/zabbix_agentd.log  
1184453:20220729:053410.519 **** Enabled features ****
1184453:20220729:053410.519 IPv6 support:          YES
1184453:20220729:053410.519 TLS support:           YES
1184453:20220729:053410.519 **************************
1184453:20220729:053410.519 using configuration file: /etc/zabbix/zabbix_agentd.conf
1184453:20220729:053410.523 agent #0 started [main process]
1184456:20220729:053410.523 agent #1 started [collector]
1184457:20220729:053410.523 agent #2 started[listener #1]
1184458:20220729:053410.524 agent #3 started[listener #2]
1184459:20220729:053410.524 agent #4 started[listener #3]
                  Yes in logs, get a error network, but any port open in VPS agent fail to nc test.

                  Yes, I'm desesperated.
                  Last edited by akarim; 29-07-2022, 07:38.

                    Comment

                    • Markku
                      Senior Member
                      Zabbix Certified SpecialistZabbix Certified ProfessionalZabbix Certified Expert
                      • Sep 2018
                      • 1781
                      #6
                      Are you the administrator of the network in the Zabbix server side and in the Zabbix agent side?

                      I'm asking because you haven't said anything about the network details in either side, and this sounds like an underlying network problem so you need other help.

                      You have said that ping and SSH works, but Zabbix ports don't work.

                      Example questions for you to continue troubleshooting internally:
                      1. What kind of firewalls or other network-level middleboxes there are in either side? (You still insisted on commenting on the host firewalls but not the network firewalls)
                      2. What kind of network address translations (NAT) are used in either side?
                      3. Since both sides are public cloud platforms (based on the IP addresses you showed), what kind of logging do they offer to help you?
                      4. What kind of network security groups or access control lists do they offer and how are they currently configured?

                      Markku

                        Comment

                        • akarim
                          Member
                          • Aug 2008
                          • 33
                          #7
                          Yes.

                          i'm an administrator or Zabbix Server and Zabbix VPS Agent, but not an admin of the network. Server Zabbix is on Online.net and VPS is on OVH.
                          Only admin block of Zabbix client at a level for know if there some firewall (not firewall, on block IP of client Zabbix.
                          On Online net is the same. Not firewall, and I know if there are some issues o restrictions.
                          Any restrictions on any port or ip.

                          1. Firewall is CSF Firewall. For debugging problems, deactivate firewalls on two sides. Problem persists
                          2. THere are NOT network firewalls on the network. But now I put a ticket in two providers for confirmation.
                          3. If check from other servers and from my local machine without firewall active, check ncat to Zabbix Agent to 10050 and 10051 and no work. In all Zabbix agents work perfectly `Connection to srv109.xxx.xxxx (x.x.x.x.x) 10050 port [tcp/zabbix-agent] succeeded`!
                          4. All systems are machines in my infrastructure in OVH and Scaleway. I use bare-metal servers and use KVM for all VPS over Proxmox. I've more 100 vps, and 10 bare metals. All with Zabbix for monitoring with active and passive mode (all Linux in differents distros)
                          5. Security on all is with Csf Firewall. Some machines have AppArmor, others SELinux, other nothing.

                          For all in the post, I think a mistake in the Client but I don't see it.
                          I've checked all.
                          - Firewalls
                          - Other tools for security
                          - Search in etc some about 10050 and 10051 but are declared in /etc/services
                          - Not acls in network or system

                          Best regards and a lot of thanks


                            Comment

                            • akarim
                              Member
                              • Aug 2008
                              • 33
                              #8
                              Agg...
                              Oh my good.

                              F**ing iredmail use an internal service nftables.service and this close all port except mail port and web. Is not compatible with CSF Firewall, because of starts after CSF in the boot system.

                              Deactivate this daemon and now works fine.

                              Ohhhh

                                Comment

                                • markusPLA
                                  Junior Member
                                  • Aug 2022
                                  • 1
                                  #9
                                  Just edit /etc/nftables.conf

                                  and add rules:

                                  tcp dport 10050 accept

                                  and restart service by:
                                  sudo service nftables restart
                                  or
                                  sudo systemctl restart nftables.service

                                  thats all

                                    Comment

                                    Previous template Next
                                    Working...