UserParameter with multi-value object and dependend items.

[velartis-md]

Hey, I've read the related docs and configured a both a UserParameter and a few items.

The client here is Windows, though that mostly doesn't matter. Expect for Cmdline-quoting/escaping and the Active agent.
The UserParameter is configured like so:

UserParameter=filemon.example,C:\zbx-filemon.exe C:\Example\**\*.example

zbx-filemon.exe is a custom tool that returns a JSON object like:

{
  file_count: 1,
  total_size: 1000,
  globs: "C:\Some\Directory\**\*.example"
}

The tool, like you probably guessed, globs some files and sums the total size.

Now, the main item is setup like so:


with depended items (only showing one for brevity):



But the Zabbix server either never gets any data or discards it(?). That is "latest data" remains blank.
From the host, I know that the tool gets invoked by the Zabbix agent and it doesn't log any errors:



A note/rant about the UserParameter escape/quoting situation. This and/or this is, almost guaranteed not, what anyone wants.
It makes quoting a PITA or straight impossible.
The solution here is to call CreateProcessW and let the user worry about properly using UserParameter.
Whatever is the first (or only) value should be used passed as lpApplicationName and the rest (if any) is lpCommandLine, as is.
Should lpApplicationName contain spaces, then the user has to quote it.

Back on topic. Please tell me what I can fix or am missing.

[cyber]

Seems some pics did not make it...

Test it with zabbig_get from server. It also should leave something in agent log file...
Windows and its double quoting... urgh... I think you need to add some \\-s there...

[velartis-md]

No, all screenshots I made are there. I was trying to edit the post but with my account being new and the post needing to be reviewed, I couldn't.

Anyway, I wanted to clarify some things.
There are no seemingly no errors logged. The items just never get any data; latest data remains blank.
I can change some settings and produce errors, ala unit testing. Meaning I can produce errors when doing something intentionally wrong.

But right now, with everything configured correctly, as far as I know, latest data remains blank.

Is there's something specific I should include?


The quoting is just broken and I don't believe there is a fix possible. Other than simply not and never calling CMD.exe.
CMD.exe has its own quote/escaping rules. Technically every Windows application has its own rules here, but CMD.exe does not do what everyone would expect, say use backslash as the escape-character. No, it uses the hat-character(?) "^".
There have been (and surely will be more) CVEs caused by this, here's a fairly recent Rust one.
Edit: Here a good blog about this ^

[cyber]

This is what I see


But anyway.. Try to enable some debugging in agent, maybe it brings out something useful in logfile...

[velartis-md]

Oh wow, curious. I re-submitted the same images by Copy Image and pasting over them. Weird.

Didn't know there is a debug setting in the agent, will check it out – thanks.

[velartis-md]

Set logging to 4 (Debug) and got this:

6280:20240826:110233.478 execute_str_local() command:'C:\zbx-filemon.exe C:\Example\**\*.example' len:67 cmd_result:'{"fileCount":1,"tota'
6280:20240826:110233.480 for key [filemon.example] received value [{"fileCount":1,"totalSize":19,"globs":"C:\\Example\\**\\*.example"}]
6280:20240826:110233.482 In process_value() key:'**host-removed**:filemon.example' lastlogsize:null value:'{"fileCount":1,"totalSize":19,"globs":"C:\\Example\\**\\*.example"}'
6280:20240826:110233.484 In send_buffer() host:'**ip-removed**' port:10051 entries:29/100
6280:20240826:110233.486 In format_metric_results()
6280:20240826:110233.489 format_metric_results() now:1724662953 lastsent:1724662949 now-lastsent:4 BufferSend:5; will not send now
6280:20240826:110233.491 End of format_metric_results():FAIL
6280:20240826:110233.493 End of send_buffer():SUCCEED
6280:20240826:110233.495 buffer: new element 29
6280:20240826:110233.497 End of process_value():SUCCEED
6280:20240826:110233.499 In need_meta_update() key:filemon.example
6280:20240826:110233.501 End of need_meta_update():FAIL
6280:20240826:110233.503 In send_buffer() host:'**ip-removed**' port:10051 entries:30/100
6280:20240826:110233.504 In format_metric_results()
6280:20240826:110233.506 format_metric_results() now:1724662953 lastsent:1724662949 now-lastsent:4 BufferSend:5; will not send now
6280:20240826:110233.508 End of format_metric_results():FAIL
6280:20240826:110233.509 End of send_buffer():SUCCEED
...
6280:20240826:111425.377 In process_active_checks() server:'**ip-removed**' port:10051
6280:20240826:111425.479 execute_str_local() command:'C:\zbx-filemon.exe C:\Example\**\*.example' len:67 cmd_result:'{"fileCount":1,"tota'
6280:20240826:111425.481 for key [filemon.example] received value [{"fileCount":1,"totalSize":19,"globs":"C:\\Example\\**\\*.example"}]
6280:20240826:111425.482 In process_value() key:'**host-removed**:filemon.example' lastlogsize:null value:'{"fileCount":1,"totalSize":19,"globs":"C:\\Example\\**\\*.example"}'
6280:20240826:111425.484 buffer: new element 0
6280:20240826:111425.486 End of process_value():SUCCEED
6280:20240826:111425.487 In need_meta_update() key:filemon.example
6280:20240826:111425.489 End of need_meta_update():FAIL
6280:20240826:111425.490 In send_buffer() host:'**ip-removed**' port:10051 entries:1/100
6280:20240826:111425.492 In format_metric_results()
6280:20240826:111425.493 End of format_metric_results():SUCCEED

I checked the source and it seems to look alright.