What to put in discovery rule key value?

[erasedhammer]

I'm trying to make a template for Debian/Ubuntu package versions (since Zabbix's system.sw.package does not get versions from dpkg) and I am having some trouble finding what a discovery rule key value should be.

Both the server and agent are Debian 11, Zabbix server version is 6.0.4, Agent version is 6.0.6

So far this is my template configuration:
Macro:
{$SYSTEM.PACKAGE.MATCHES} .* Filter of system packages by name

Discovery rule:
Name: Package Version Discovery
Key: system.sw.package.version
Filters: {#PKG} matches {$SYSTEM.PACKAGE.MATCHES}

Item prototype:
Name: {#PKG} Version
Key: system.sw.package.version["{#PKG}"]

On the Zabbix agent I have a custom parameter defined:
UserParameter=system.sw.package.version[*],/bin/dpkg-query --show '--showformat=${Version}\n' $1 2>/dev/null | sed -e 's/+.*//g' 2>/dev/null | sed -e 's/1://g' 2>/dev/null | sed -e 's/~.*//g' 2>/dev/null
(ignore my terrible way of getting the package version isolated in the dpkg-query command....)


On other templates, the discovery rule has a specific [value] on the key. For example the systemd template (https://www.zabbix.com/integrations/systemd) has its discovery rule key look like this: systemd.unit.discovery[service]
But [service] is not referenced anywhere else in the template, and since systemd is monitored naively through zabbix-agent2, I don't really know what [service] is doing on the agent side.

So with a custom userparameter for the key, what do I need to add to the discovery rule key to act similar in function to the systemd template?
The end goal here is to apply the template to a host, and define a macro (in this case {$SYSTEM.PACKAGE.MATCHES} ) with a list of packages to get versions for (for example, openssh-server|apache2|dnsmasq), and have a discovery rule create items for each package name in the macro.

Can anyone help me with this?

[Markku]

"systemd.unit.discovery[service]" is here just a key. If you see the systemd page you linked, there is also "systemd.unit.discovery[socket]". It depends on the implementation if they are just two strings or if it is one UserParameter with one parameter (using $1).

I'd recommend naming your discovery key with ".discovery", to keep it separate from the actual item keys.

Markku

[erasedhammer]

So the discovery key has to be a real key on the system, so should I just add a user parameter for lets say system.sw.package.version.discovery? If so, what should that key even do?
I am kinda confused as to the point of requiring the discovery key at all, because for my purposes all the "discovery" that is taking place is the user macro specifying packages. But I can't use a regular item with user macros, so I have to use item prototypes under discovery.

[Markku]

The discovery rule key must be something that exists, like something that Zabbix can "execute" to receive the raw data for LLD. Either use a built-in key or your own UserParameter.

If I understand your case correctly, you can use systemd.unit.discovery[service] as the key (= it returns the list of services).

You can test it with "/usr/sbin/zabbix_agent2 -t systemd.unit.discovery[service]" command to see what LLD macros it produces. You then configure your item prototype as you wish.

Markku

[erasedhammer]

The discovery rule key must be something that exists, like something that Zabbix can "execute" to receive the raw data for LLD. Either use a built-in key or your own UserParameter.

If I understand your case correctly, you can use systemd.unit.discovery[service] as the key (= it returns the list of services).

You can test it with "/usr/sbin/zabbix_agent2 -t systemd.unit.discovery[service]" command to see what LLD macros it produces. You then configure your item prototype as you wish.

Markku

I see. I have misunderstood the use of discovery rules.
My particular use case is simply having static item prototypes where the only "discoverable" part is the user macro provided in each host configuration. But it looks like I actually need to use the discovery rule... ha.

I have created another user parameter:
UserParameter=system.sw.package.discovery[*],/bin/dpkg-query --show '--showformat=${Package}\n' 2>/dev/null

And have added a preprocessing rule to convert csv to json.
For reference, the discovery rule now returns something like this (obviously a longer list since it has all the packages):
[{"1":"acpi-support-base"},{"1":"acpid"},{"1":"adduser"},{"1":"adwaita-icon-theme"},{"1":"apache2"}]

I have an LLD Macro that looks like this:
LLD Macro JSONPath
{#PKG} $.1.name

I am definitely lost on how I should use LLD macro and filter to deliver the package name to the item prototypes.

When trying the discovery rule out, I get the error "Cannot accurately apply filter: no value received for macro "{#PKG}"."
I think I'm not using the LLD macros correctly to match fields in the discovery output?

[erasedhammer]

I have gotten it working now!
I used a replace preprocessing to replace "1" with "{#PKG}" and then the filter rule was able to use my macro to filer out the packages and create the item template.

Definitely a learning curve here.

[erasedhammer]

The discovery rule key must be something that exists, like something that Zabbix can "execute" to receive the raw data for LLD. Either use a built-in key or your own UserParameter.

If I understand your case correctly, you can use systemd.unit.discovery[service] as the key (= it returns the list of services).

You can test it with "/usr/sbin/zabbix_agent2 -t systemd.unit.discovery[service]" command to see what LLD macros it produces. You then configure your item prototype as you wish.

Markku

Quick question about macro matching. I couldn't find anything in the documentation regarding user macro match exactly. The discovery filter is set to "match" but the user macro list is apparently wildcarding around each string I give it.

for example:
The macro {$SYSTEM.PACKAGE.MATCHES} with value of php|nginx would create dozens of items because it is looking up *php* or *nginx*. How can I make the macro only match the exact string?

[Markku]

The filters use regular expressions. See: https://www.zabbix.com/documentation...scovery#filter

Markku