Count LLD Items

[michael.weber]

Hello,
i have SNMP LLD rule to check the IPsec Connections on a sonicwall:

SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.10514589 = Counter32: 18075
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.195043211 = Counter32: 18045
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.228091825 = Counter32: 18038
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.259005578 = Counter32: 18032
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.269493372 = Counter32: 18074
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.380647180 = Counter32: 18037
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.472413720 = Counter32: 18039
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.494952268 = Counter32: 18055
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.537395615 = Counter32: 18068
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.670594902 = Counter32: 18042
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.748188847 = Counter32: 18058
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.893409342 = Counter32: 18044
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.1053307404 = Counter32: 18063
SONICWALL-FIREWALL-IP-STATISTICS-MIB::sonicIpsecSaIndex.1257789062 = Counter32: 18078 [..]

as if the VPN Connections Closes and Comes up again the ID at the end changes.
Is there a zabbix integrated way to "Count" the LLD items.
So i can check "numberIPsecConnection" if the value changes.

Ofc the item key changes ..


i already tried it with a calculated item:

count(sonicIpsecSaIndex.*,#1)

but that does not work

Cannot evaluate function "count(#1)": item "<host>:sonicIpsecSaIndex.*" does not exist.

[Semiadmin]

Hi, michael.weber.

You can count LLD items by query to zabbix database (database monitor or UserParameter with request). Your request may be like this (for MySQL):

SELECT COUNT(itemid)-1 FROM items WHERE hostid IN (SELECT hostid FROM hosts WHERE host="{HOST.NAME}") AND key_ LIKE "sonicIpsecSaIndex%" AND status=0;

If you haven't disabled items, you don't need "AND status=0".

[Linwood]

If this works like Cisco ipsec tunnels on ASA you are going to make yourself nuts as I found there to be periods where tunnels would disappear entirely, and also appear in both places at the same time due to latency (whether in polling, updates inside the SNMP engine, or that's just how the timeout/restarts worked I do not know).

If you dig deeper my guess is you can follow the indexes in other items to find the end points. A better bet is to have the LLD generate items based on endpoint and monitor it. That means you are monitoring a different index all the time (I do that in an external check to make it simpler).

This becomes more complicated if endpoints have failover addresses that can change but still helpful.

What I also did was used Rancid to pull ASA configs, looked in them for endpoint definitions as well, and then could notice if a defined tunnel was not actually showing up in the SNMP tunnel list (which can indicate a misconfiguration).

[troffasky]

Time passes...SonicOS changes, Zabbix changes...., but we still have this problem.
Here is a typical entry:


The stupid thing is that sonicIpsecSAIndex bears no relation to this string "1509962646". The string changes whenever the tunnel renegotiates, every 8h by default. So how to approach this? The data is all available with SNMP, just missing one piece.

[troffasky]

Basically the only thing that doesn't change is "sonicSAStatUserName" so we need a way to take that value, relate it to the random string and then discover the stats [the *Count items, mostly] matching that string. And then persist that for a future rediscovery whenever the tunnel renegotiates. Which you can't know ahead of time because a) the SA lifetime is not known b) the tunnel could renegotiate at any time anyway. So the discovery would have to be running every few minutes. Urgh. Maybe this is not so easy after all!

[troffasky]

OMG, looks like this might actually be the answer!

https://www.zabbix.com/documentation/6.0/en/manual/config/items/itemtypes/snmp/dynamicindex

[Linwood]

That looks REALLY useful. Thanks for pointing it out, I have been rather out of touch in recent years.

[troffasky]

Yes, this actually worked! This tunnel has renegotiated many times since I added the template to this host and we have a contiguous series of data.