Active checks and log key

[guest6936]

Hello,

I am having some issues with the log key and I am not getting my head around it. I have created a Item that looks like this. For my testing instance I have done chmod 777 on /var/log/syslog.




Despite this I am getting an alert that says: the "log" key is not supported in test or single passive check mode
Fine, I googled this and I saw that I am required to use Active Checks so I updated my ServerActive and hostname parameters in the /etc/zabbix/zabbix-agent2.conf file accordingly.

I have replaced our server IP-addresses to 8.8.8.8 and the hostname to myhiddenhostname.com

# This is a configuration file for Zabbix agent 2 (Unix)

# To get more information about Zabbix, visit http://www.zabbix.com




############ GENERAL PARAMETERS #################




### Option: PidFile

# Name of PID file.

#

# Mandatory: no

# Default:

# PidFile=/tmp/zabbix_agent2.pid




PidFile=/var/run/zabbix/zabbix_agent2.pid




### Option: LogType

# Specifies where log messages are written to:

# system  - syslog

# file    - file specified with LogFile parameter

# console - standard output

#

# Mandatory: no

# Default:

# LogType=file




### Option: LogFile

# Log file name for LogType 'file' parameter.

#

# Mandatory: yes, if LogType is set to file, otherwise no

# Default:

# LogFile=/tmp/zabbix_agent2.log




LogFile=/var/log/zabbix/zabbix_agent2.log




### Option: LogFileSize

# Maximum size of log file in MB.

# 0 - disable automatic log rotation.

#

# Mandatory: no

# Range: 0-1024

# Default:

# LogFileSize=1




LogFileSize=0




### Option: DebugLevel

# Specifies debug level:

# 0 - basic information about starting and stopping of Zabbix processes

# 1 - critical information

# 2 - error information

# 3 - warnings

# 4 - for debugging (produces lots of information)

# 5 - extended debugging (produces even more information)

#

# Mandatory: no

# Range: 0-5

# Default:

# DebugLevel=3

DebugLevel=4

### Option: SourceIP

# Source IP address for outgoing connections.

#

# Mandatory: no

# Default:

# SourceIP=




##### Passive checks related




### Option: Server

# List of comma delimited IP addresses, optionally in CIDR notation, or DNS names of Zabbix servers and Zabbix proxies.

# Incoming connections will be accepted only from the hosts listed here.

# If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally

# and '::/0' will allow any IPv4 or IPv6 address.

# '0.0.0.0/0' can be used to allow any IPv4 address.

# Example: Server=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.example.com

#

# Mandatory: yes, if StartAgents is not explicitly set to 0

# Default:

# Server=




Server=8.8.8.8




### Option: ListenPort

# Agent will listen on this port for connections from the server.

#

# Mandatory: no

# Range: 1024-32767

# Default:

# ListenPort=10050




### Option: ListenIP

# List of comma delimited IP addresses that the agent should listen on.

# First IP address is sent to Zabbix server if connecting to it to retrieve list of active checks.

#

# Mandatory: no

# Default:

# ListenIP=0.0.0.0




### Option: StatusPort

# Agent will listen on this port for HTTP status requests.

#

# Mandatory: no

# Range: 1024-32767

# Default:

# StatusPort=




##### Active checks related




### Option: ServerActive

# Zabbix server/proxy address or cluster configuration to get active checks from.

# Server/proxy address is IP address or DNS name and optional port separated by colon.

# Cluster configuration is one or more server addresses separated by semicolon.

# Multiple Zabbix servers/clusters and Zabbix proxies can be specified, separated by comma.

# More than one Zabbix proxy should not be specified from each Zabbix server/cluster.

# If Zabbix proxy is specified then Zabbix server/cluster for that proxy should not be specified.

# Multiple comma-delimited addresses can be provided to use several independent Zabbix servers in parallel. Spaces are allowed.

# If port is not specified, default port is used.

# IPv6 addresses must be enclosed in square brackets if port for that host is specified.

# If port is not specified, square brackets for IPv6 addresses are optional.

# If this parameter is not specified, active checks are disabled.

# Example for Zabbix proxy:

# ServerActive=127.0.0.1:10051

# Example for multiple servers:

# ServerActive=127.0.0.1:20051,zabbix.domain,[::1]:30051,::1,[12fc::1]

# Example for high availability:

# ServerActive=zabbix.cluster.node1;zabbix.cluster.node2:20051;zabbix.cluster.node3

# Example for high availability with two clusters and one server:

# ServerActive=zabbix.cluster.node1;zabbix.cluster.node2:20051,zabbix.cluster2.node1;zabbix.cluster2.node2,zabbix.domain

#

# Mandatory: no

# Default:

# ServerActive=




ServerActive=8.8.8.8




### Option: Hostname

# List of comma delimited unique, case sensitive hostnames.

# Required for active checks and must match hostnames as configured on the server.

# Value is acquired from HostnameItem if undefined.

#

# Mandatory: no

# Default:

# Hostname=




Hostname=myhiddenhostname.com




### Option: HostnameItem

# Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.

# Does not support UserParameters or aliases.

#

# Mandatory: no

# Default:

# HostnameItem=system.hostname




### Option: HostMetadata

# Optional parameter that defines host metadata.

# Host metadata is used at host auto-registration process.

# An agent will issue an error and not start if the value is over limit of 255 characters.

# If not defined, value will be acquired from HostMetadataItem.

#

# Mandatory: no

# Range: 0-255 characters

# Default:

# HostMetadata=




### Option: HostMetadataItem

# Optional parameter that defines an item used for getting host metadata.

# Host metadata is used at host auto-registration process.

# During an auto-registration request an agent will log a warning message if

# the value returned by specified item is over limit of 255 characters.

# This option is only used when HostMetadata is not defined.

#

# Mandatory: no

# Default:

# HostMetadataItem=




### Option: HostInterface

# Optional parameter that defines host interface.

# Host interface is used at host auto-registration process.

# An agent will issue an error and not start if the value is over limit of 255 characters.

# If not defined, value will be acquired from HostInterfaceItem.

#

# Mandatory: no

# Range: 0-255 characters

# Default:

# HostInterface=




### Option: HostInterfaceItem

# Optional parameter that defines an item used for getting host interface.

# Host interface is used at host auto-registration process.

# During an auto-registration request an agent will log a warning message if

# the value returned by specified item is over limit of 255 characters.

# This option is only used when HostInterface is not defined.

#

# Mandatory: no

# Default:

# HostInterfaceItem=




### Option: RefreshActiveChecks

# How often list of active checks is refreshed, in seconds.

#

# Mandatory: no

# Range: 60-3600

# Default:

# RefreshActiveChecks=120




### Option: BufferSend

# Do not keep data longer than N seconds in buffer.

#

# Mandatory: no

# Range: 1-3600

# Default:

# BufferSend=5




### Option: BufferSize

# Maximum number of values in a memory buffer. The agent will send

# all collected data to Zabbix Server or Proxy if the buffer is full.

# Option is not valid if EnablePersistentBuffer=1

#

# Mandatory: no

# Range: 2-65535

# Default:

# BufferSize=100




### Option: EnablePersistentBuffer

# Enable usage of local persistent storage for active items.

# 0 - disabled, in-memory buffer is used (default); 1 - use persistent buffer

# Mandatory: no

# Range: 0-1

# Default:

# EnablePersistentBuffer=0




### Option: PersistentBufferPeriod

# Zabbix Agent2 will keep data for this time period in case of no

# connectivity with Zabbix server or proxy. Older data will be lost. Log data will be preserved.

# Option is valid if EnablePersistentBuffer=1

#

# Mandatory: no

# Range: 1m-365d

# Default:

# PersistentBufferPeriod=1h




### Option: PersistentBufferFile

# Full filename. Zabbix Agent2 will keep SQLite database in this file.

# Option is valid if EnablePersistentBuffer=1

#

# Mandatory: no

# Default:

# PersistentBufferFile=




############ ADVANCED PARAMETERS #################




### Option: Alias

# Sets an alias for an item key. It can be used to substitute long and complex item key with a smaller and simpler one.

# Multiple Alias parameters may be present. Multiple parameters with the same Alias key are not allowed.

# Different Alias keys may reference the same item key.

# For example, to retrieve the ID of user 'zabbix':

# Alias=zabbix.userid:vfs.file.regexp[/etc/passwd,^zabbix:.:([0-9]+),,,,\1]

# Now shorthand key zabbix.userid may be used to retrieve data.

# Aliases can be used in HostMetadataItem but not in HostnameItem parameters.

#

# Mandatory: no

# Range:

# Default:




### Option: Timeout

# Spend no more than Timeout seconds on processing

#

# Mandatory: no

# Range: 1-30

# Default:

# Timeout=3




### Option: Include

# You may include individual files or all files in a directory in the configuration file.

# Installing Zabbix will create include directory in /usr/local/etc, unless modified during the compile time.

#

# Mandatory: no

# Default:

# Include=




Include=/etc/zabbix/zabbix_agent2.d/*.conf




# Include=/usr/local/etc/zabbix_agent2.userparams.conf

# Include=/usr/local/etc/zabbix_agent2.conf.d/

# Include=/usr/local/etc/zabbix_agent2.conf.d/*.conf




### Option:PluginTimeout

# Timeout for connections with external plugins.

#

# Mandatory: no

# Range: 1-30

# Default: <Global timeout>

# PluginTimeout=




### Option:PluginSocket

# Path to unix socket for external plugin communications.

#

# Mandatory: no

# Default:/tmp/agent.plugin.sock

# PluginSocket=




####### USER-DEFINED MONITORED PARAMETERS #######




### Option: UnsafeUserParameters

# Allow all characters to be passed in arguments to user-defined parameters.

# The following characters are not allowed:

# \ ' " ` * ? [ ] { } ~ $ ! & ; ( ) < > | # @

# Additionally, newline characters are not allowed.

# 0 - do not allow

# 1 - allow

#

# Mandatory: no

# Range: 0-1

# Default:

# UnsafeUserParameters=0




### Option: UserParameter

# User-defined parameter to monitor. There can be several user-defined parameters.

# Format: UserParameter=<key>,<shell command>

# See 'zabbix_agentd' directory for examples.

#

# Mandatory: no

# Default:

# UserParameter=




### Option: UserParameterDir

# Directory to execute UserParameter commands from. Only one entry is allowed.

# When executing UserParameter commands the agent will change the working directory to the one

# specified in the UserParameterDir option.

# This way UserParameter commands can be specified using the relative ./ prefix.

#

# Mandatory: no

# Default:

# UserParameterDir=




### Option: ControlSocket

# The control socket, used to send runtime commands with '-R' option.

#

# Mandatory: no

# Default:

# ControlSocket=




ControlSocket=/tmp/agent.sock




####### TLS-RELATED PARAMETERS #######




### Option: TLSConnect

# How the agent should connect to server or proxy. Used for active checks.

# Only one value can be specified:

# unencrypted - connect without encryption

# psk         - connect using TLS and a pre-shared key

# cert        - connect using TLS and a certificate

#

# Mandatory: yes, if TLS certificate or PSK parameters are defined (even for 'unencrypted' connection)

# Default:

# TLSConnect=unencrypted




### Option: TLSAccept

# What incoming connections to accept.

# Multiple values can be specified, separated by comma:

# unencrypted - accept connections without encryption

# psk         - accept connections secured with TLS and a pre-shared key

# cert        - accept connections secured with TLS and a certificate

#

# Mandatory: yes, if TLS certificate or PSK parameters are defined (even for 'unencrypted' connection)

# Default:

# TLSAccept=unencrypted




### Option: TLSCAFile

# Full pathname of a file containing the top-level CA(s) certificates for

# peer certificate verification.

#

# Mandatory: no

# Default:

# TLSCAFile=




### Option: TLSCRLFile

# Full pathname of a file containing revoked certificates.

#

# Mandatory: no

# Default:

# TLSCRLFile=




### Option: TLSServerCertIssuer

# Allowed server certificate issuer.

#

# Mandatory: no

# Default:

# TLSServerCertIssuer=




### Option: TLSServerCertSubject

# Allowed server certificate subject.

#

# Mandatory: no

# Default:

# TLSServerCertSubject=




### Option: TLSCertFile

# Full pathname of a file containing the agent certificate or certificate chain.

#

# Mandatory: no

# Default:

# TLSCertFile=




### Option: TLSKeyFile

# Full pathname of a file containing the agent private key.

#

# Mandatory: no

# Default:

# TLSKeyFile=




### Option: TLSPSKIdentity

# Unique, case sensitive string used to identify the pre-shared key.

#

# Mandatory: no

# Default:

# TLSPSKIdentity=




### Option: TLSPSKFile

# Full pathname of a file containing the pre-shared key.

#

# Mandatory: no

# Default:

# TLSPSKFile=




####### PLUGIN-SPECIFIC PARAMETERS #######




### Option: Plugins

# A plugin can have one or more plugin specific configuration parameters in format:

#     Plugins.<PluginName>.<Parameter1>=<value1>

#     Plugins.<PluginName>.<Parameter2>=<value2>

#

# Mandatory: no

# Range:

# Default:




### Option: Plugins.Log.MaxLinesPerSecond

# Maximum number of new lines the agent will send per second to Zabbix Server

# or Proxy processing 'log' and 'logrt' active checks.

# The provided value will be overridden by the parameter 'maxlines',

# provided in 'log' or 'logrt' item keys.

#

# Mandatory: no

# Range: 1-1000

# Default:

# Plugins.Log.MaxLinesPerSecond=20




### Option: AllowKey

# Allow execution of item keys matching pattern.

# Multiple keys matching rules may be defined in combination with DenyKey.

# Key pattern is wildcard expression, which support "*" character to match any number of any characters in certain position. It might be used in both key name and key arguments.

# Parameters are processed one by one according their appearance order.

# If no AllowKey or DenyKey rules defined, all keys are allowed.

#

# Mandatory: no




### Option: DenyKey

# Deny execution of items keys matching pattern.

# Multiple keys matching rules may be defined in combination with AllowKey.

# Key pattern is wildcard expression, which support "*" character to match any number of any characters in certain position. It might be used in both key name and key arguments.

# Parameters are processed one by one according their appearance order.

# If no AllowKey or DenyKey rules defined, all keys are allowed.

#       Unless another system.run[*] rule is specified DenyKey=system.run[*] is added by default.

#

# Mandatory: no

# Default:

# DenyKey=system.run[*]




### Option: Plugins.SystemRun.LogRemoteCommands

# Enable logging of executed shell commands as warnings.

# 0 - disabled

# 1 - enabled

#

# Mandatory: no

# Default:

# Plugins.SystemRun.LogRemoteCommands=0




### Option: ForceActiveChecksOnStart

# Perform active checks immediately after restart for first received configuration.

# Also available as per plugin configuration, example: Plugins.Uptime.System.ForceActiveChecksOnStart=1

#

# Mandatory: no

# Range: 0-1

# Default:

# ForceActiveChecksOnStart=0




# Include configuration files for plugins

Include=./zabbix_agent2.d/plugins.d/*.conf
​

Logs

2023/02/07 12:39:12.123332 [101] In refreshActiveChecks() from [8.8.8.8:10051]
2023/02/07 12:39:12.167572 [101] End of refreshActiveChecks() from [8.8.8.8:10051]
2023/02/07 12:39:12.168785 [101] processing update request (0 requests)
2023/02/07 12:39:12.168807 [101] skipping empty update for unregistered client

Versions
Zabbix 6.0.3
Agents running zabbix_agent2 (Zabbix) 6.0.12

Any help is appreciated.

[guest6936]

Now I realised my mistake, and it was a stupid one. I didn't select the Active agent in my item.

I will leave this for others to learn by my stupidity.

2023/02/07 12:55:20.125056 [101] In refreshActiveChecks() from [8.8.8.8:10051]
2023/02/07 12:55:20.166606 [101] End of refreshActiveChecks() from [8.8.8.8:10051]
2023/02/07 12:55:20.166639 [101] processing update request (1 requests)
2023/02/07 12:55:20.166647 [101] registering new client
2023/02/07 12:55:20.166692 [101] adding new request for key: 'log[/var/log/syslog,asterisk]'
2023/02/07 12:55:20.166797 [101] created exporter task for plugin 'Log' itemid:45009 key 'log[/var/log/syslog,asterisk]'

However, I am still having the the "log" key is not supported in test or single passive check mode in the GUI.


Update: now it appears to be doing stuff

2023/02/07 13:00:09.001168 executing exporter task for itemid:45009 key 'log[/var/log/syslog,asterisk]'
2023/02/07 13:00:09.001701 In process_logrt() flags:0x07 filename:'/var/log/syslog' lastlogsize:0 mtime:0
2023/02/07 13:00:09.001740 In add_logfile() filename:'/var/log/syslog' mtime:0 size:10331431
2023/02/07 13:00:09.001754 add_logfile() logfiles:0x7f066c001670 logfiles_alloc:64
2023/02/07 13:00:09.001763 End of add_logfile()
2023/02/07 13:00:09.002163 process_logrt() old file list:
2023/02/07 13:00:09.002191    file list empty
2023/02/07 13:00:09.002204 process_logrt() new file list: (mtime:0 lastlogsize:0 start_idx:0)
2023/02/07 13:00:09.002221    nr:0 filename:'/var/log/syslog' mtime:0 size:10331431 processed_size:0 seq:0 copy_of:-1 incomplete:0 dev:66308 ino_hi:0 ino_lo:272801 md5_block_size:512 first_block_md5:391dd1848323b79b3169847fe4c5b4bb last_block_offset:10330919 last_block_md5:18dd4d0bd32005abb7be2419bec15375
2023/02/07 13:00:09.002232 In process_log() filename:'/var/log/syslog' lastlogsize:0 mtime:0 seek_offset:0
2023/02/07 13:00:09.004267 End of process_log() filename:'/var/log/syslog' lastlogsize:31406 mtime:0 ret:SUCCEED processed_bytes:31406
2023/02/07 13:00:09.004293 End of process_logrt():SUCCEED
2023/02/07 13:00:09.004325 executed exporter task for itemid:45009 key 'log[/var/log/syslog,asterisk]'
2023/02/07 13:00:13.123614 [101] upload history data, 1/100 value(s)

[guest6936]

I can see the logs now in my GUI. So I guess this one is solved. I hope someone can find joy in my misfortune.


Anyhow I have one question, how should I solve so that the zabbix agent have permission to read from /var/log/syslog? For Ubuntu bases OS I just added the user zabbix to the group adm, perhaps this is the best approach.