net.tcp.listen[443] reported as 'Unsupported item key' by server, but tests from host

[sscotter]

Hi,

I'm using Zabbix 6.0.19 on the server, proxy and agent.

We have a server which is hosted on a VPS on the internet.

We have a proxy which hosted on the perimeter to one of our networks.

I want to monitor a host to check if a webserver which is running on port 443 is up as it's fallen over a few times recently.

The host in question has a proxy between itself and the proxy. The firewall allows 10050/tcp through but not 443 (and I'm not allowed to make that change by policy). As a result can't use net.tcp.service[https], which would test is HTTPS is up from the proxy (according to the docs 5 Simple checks (zabbix.com) states.... Note that Zabbix agent is not needed for simple checks. Zabbix server/proxy is responsible for the processing of simple checks (making external connections, etc).)

So, I thought I'd try using net.tcp.listen[443], which would mean the agent would check if something is bound to 443.. however this is reporting as Unsupported item key on the server.



I added the net.tcp.listen[10050] item for testing only as I occurred to be it could be a permission based problem issue due to 443 a privileged port (i.e., less than 1024). That item also comes back as Unsupported item key.

If I do a zabbix_agentd -t net.tcp.listen[443] while su'd to zabbix user on the host it comes back as expected (ie, a 1 for up). If I do a zabbix_get -s 10.0.5.222 -k net.tcp.listen[443] from the proxy it also comes back as expected.

I've run out of ideas as to why this item is reporting as Unsupported item key on the server.

Anyone else have any suggestions?

Thanks

Steve

[Hamardaban]

There are keys with very similar (even identical) names but different types : "zabbix agent" and "Simple checks"

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#net.tcp.serviceserviceipport

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/simple_checks#nettcpservice

zabbix_agentd shows "ZAbbix agent" type keys

[Atsushi]

For Simple checks you cannot use net.tcp.listen[] item key, and if you are monitoring via a proxy you should use Zabbix agent as item type.

[sscotter]

Being doing a bit more research... I increased the logging level on both proxy and the agent and performed a test of net.tcp.listen[443] from the server. Heres what i got.

Agent

637:20230720:103131.614 zbx_setproctitle() title:'listener Forum [processing request]'
637:20230720:103131.615 Requested [net.tcp.listen[443]]
637:20230720:103131.615 Sending back [1]
637:20230720:103131.615 zbx_setproctitle() title:'listener Forum [waiting for connection]'

Proxy

2229:20230720:113430.224 In zbx_trapper_item_test_run()
2229:20230720:113430.224 In get_value() key:'net.tcp.listen[443]'
2229:20230720:113430.224 In get_value_simple() key_orig:'net.tcp.listen[443]' addr:'10.0.5.222'
2229:20230720:113430.224 End of get_value_simple():NOTSUPPORTED
2229:20230720:113430.224 Item [:net.tcp.listen[443]] error: Unsupported item key.
2229:20230720:113430.224 End of get_value():NOTSUPPORTED
2229:20230720:113430.224 End of zbx_trapper_item_test_run():FAIL


So if I'm reading the logs correctly it seems the Agent is returning a 1 to say the ports listening., but the proxy is recording NOTSUPPORTED. The question is, why?

Also, I noticed the times seems to be out between the proxy and host.. but doing a manually date on both indicates they're the same.

[sscotter]

Hamardaban and Atsushi thank for you for responses. Changing the item type to Zabbix agent fixed the issue for me. The root cause was I had cloned the Template App HTTPS Service template and simply (pun intended) changed net.tcp.service to net.tcp.listening. Completely my mistake.



Thank you soo much for taking the time to reply and help me.

Regards

Steve