UserParameter showing errors not seen in bash

[highway_fixer_man]

Hi,

I am having issues with a UserParameter - the bash works - but in Zabbix, I am getting garbage back.

It seems to be an issue on Agent2 - for my old debian 6 hosts on the old agent - its working fine.

Here you can see that the bash works OK...



Here you can see what I get back in Zabbix....



The permissions on the script are fine - I even tried setting them to 777. Still the same issue persists. This happens on all my debian 10 hosts with agent2 on them.

I tried this as a straight UserParameter, like this:

UserParameter=camara1.pingstatus,ping camara1 -q -c 1 -w 1 2>&1 >/dev/null; result=$?; if ! [[ $result > 0 ]]; then echo "Camera 1 is online"; else echo "Camera 1 is offline"; fi

But it produces the same result. This is why I tried moving it to a script in /usr/local/bin.

I would love some advice or insight here. Anything for me to check - I have struggled with this for days.

I am expecting to see only "Camera 1 is online" or "Camera 1 is offline" - nothing else. How can I trim this down? It should not be sending this to Zabbix, but it is. I am not even sure how it generates the garbage to begin with - as the script works without piping anything to stdout.

Any advice or tips appreciated.

[highway_fixer_man]

Adding:

Debian 6 has the shell for Zabbix user set to /bin/false

Debian 10 has the shell for Zabbix user set to /usr/sbin/nologin

I tried setting the Debian 10 shell to /bin/false and /bin/bash and get the same results.

With the shell set to bash I can execute the query as the zabbix user.

This is a stumper.

[Rayg00n]

Why do you use a separate bash-script to make ping's done when the "icmpping" has already included in zabbix keys?

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/simple_checks#icmpping

You can easily create an item with the same logic in your zabbix environment

[highway_fixer_man]

If I understand correctly (please correct me if I dont) the simple checks are run by the server - and not the agent - correct?

The server is not on the same network as the cameras - and does not have any direct access to "camara1" - I need to ping it FROM the host that the zabbix agent is installed from.

I did try this - and I keep getting "Unknown metric icmpping".

I would LOVE it if there was a built in function for this. But at the same time - it think my logic works - the same works on Debian 6. I would really like to know why this is different on Debian 10.

[Rayg00n]

Ok I see the problem.
From the host where your zabbix agent was installed try the commands as root:
1. su - zabbix
2. ping your_camara_ip
3. /usr/loca/bin/camara1ping
Return the result here
Check your selinux status by
4. sestatus
It must be disabled or there is no such command.

[highway_fixer_man]

Ok I see the problem.
From the host where your zabbix agent was installed try the commands as root:
1. su - zabbix
2. ping your_camara_ip
3. /usr/loca/bin/camara1ping
Return the result here
Check your selinux status by
4. sestatus
It must be disabled or there is no such command.

Thanks for the help - as requested:

admin@host:~$ sudo -i
root@host:~# ping 10.11.104.21
PING 10.11.104.21 (10.11.104.21) 56(84) bytes of data.
64 bytes from 10.11.104.21: icmp_seq=1 ttl=64 time=0.370 ms
^C
--- 10.11.104.21 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.370/0.370/0.370/0.000 ms
root@host:~#​
root@host:~# su - zabbix
root@host:~# /usr/local/bin/camara1ping
Camera 1 is online
root@host:~# sestatus
-bash: sestatus: command not found
root@host:~# whoami
root
root@host:~#

On this host as well:

root@host:~# cat /etc/passwd | grep zabbix
zabbix:x:109:117::/var/lib/zabbix/:/bin/false
root@host:~#

The shell was previously /usr/sbin/nologin - same results on both.

[Rayg00n]

Did your really changed user from root to zabbix before trying /usr/local/bin/camara1ping ?
I don't have Debian in my environment, but when I do 'su - zabbix' in Ubuntu the command 'whoami' shows me 'zabbix'

Did you restarted zabbix agent after updating shell variable?

[highway_fixer_man]

As default, the shell for Zabbix user on debian 10 is nologin. With this shell set, I cant login as zabbix.

With the shell set as false, I cant login either.

If I set it to bash, I can log in. This is not how its supposed to be. On debian 6, the shell is "false"

I have tried all three, and only on bash can I login.

/var/lib/zabbix also has to exist in order to log in - most of my hosts do not have this path.

[Rayg00n]

Try to change your /etc/passwd to complete login in a shell as user zabbix.
After that try to use your script from the shell.
I think the problem is about permisions to execute '/bin/bash' and 'ping' commands - zabbix user have no permissions to do it.
PS:
Check selinux as 'getenfoced' command - if you have it - may be you need to disable it.

[highway_fixer_man]

Try to change your /etc/passwd to complete login in a shell as user zabbix.
After that try to use your script from the shell.
I think the problem is about permisions to execute '/bin/bash' and 'ping' commands - zabbix user have no permissions to do it.
PS:
Check selinux as 'getenfoced' command - if you have it - may be you need to disable it.

I have tried this, but it does not return anything different when the Zabbix shell is set to /bin/bash

root@host:~# cat /etc/passwd | grep zabbix
zabbix:x:109:117::/var/lib/zabbix/:/bin/false
root@host:~# #usermod --shell /bin/bash zabbix
root@host:~# usermod --shell /bin/bash zabbix
root@host:~# cat /etc/passwd | grep zabbix
zabbix:x:109:117::/var/lib/zabbix/:/bin/bash
root@host:~# su - zabbix
zabbix@host:~$ camara1ping
Camera 1 is online
zabbix@host:~$ whoami
zabbix
zabbix@host:~$ logout
root@host:~# getenforce
-bash: getenforce: command not found
root@host:~# systemctl restart zabbix-agent2.service
root@host:~# su - zabbix
zabbix@host:~$ camara1ping
Camera 1 is online
zabbix@host:~$ logout
root@host:~#​

The result in Zabbix is still:

/usr/local/bin/camara1ping: 7: /usr/local/bin/camara1ping: cannot create 0: Permission denied
/usr/local/bin/camara1ping: 7: /usr/local/bin/camara1ping: [[: not found
Camera 1 is online​

The data doesn't even make sense. I am quite sure my bash is OK - so I really have no idea where the extra crap is coming from. The "Camera 1 is online" is there - there is just the extra, invalid stuff there. Its not like the bash is failing - the result is there, and correct.

[highway_fixer_man]

If I remove the "if" statement from the bash - I get no garbage. But then the bash is just echoing a test word for me to confirm.

Basically, something in my bash is not playing well with zabbix.

[highway_fixer_man]

I......I.....think I fixed it....

Maybe.

I changed my bash from:

ping camara1 -q -c 1 -w 1 2>&1 >/dev/null; result=$?; if ! [[ $result > 0 ]]; then echo "Camera 1 is online"; else echo "Camera 1 is offline"; fi

to:

ping camara1 -q -c 1 -w 1 > /dev/null 2>&1; result=$?; if [ $result -ne 0 ]; then echo "Camera 1 is offline"; else echo "Camera 1 is online"; fi;

And now - on Debian 10 at least - I get the result I need in Zabbix.

Yay!!!

I will update the rest of my hosts, and see if I spot any other oddities, and then close this with my findings.

[cyber]

Even if they say, that order of words and letters in a sentence does not matter, you still understand, does not work with programming .. Seeing all the correct words, but in wrong order...and no bells ringing..
redirecting is either ">/dev/null 2>&1" or "&>/dev/null" but not "2>&1 >/dev/null"

[highway_fixer_man]

What gets me - is that it worked on Debian 6.

Exact same on Debian 10 - and I picked up the error.

Very odd. A mistake in my bash, for sure - but strange that it worked on 6 and not 10.

I now have like 150 hosts to fix - and I don't have any config management in place. Sigh.

[cyber]

I now have like 150 hosts to fix - and I don't have any config management in place. Sigh.

tmux, many panes, join input... :P