Certificate Monitoring zabbix Agent 2

[z0x10]

Dear all

Got a question about customizing the cert monitoring on zabbix.
It works very well with the default template.

But is there a way to change the expiration date to expiration days until the certificate expires?
That would be cool addition

Thanks in advance...
z0x10

[kyus]

Hey! I think that certificates don't display this information, but Zabbix collects the "Not Before" and "Not After" fields of the certificate.

That said, you can create a calculated item inside your template that will calculate how many days are left before the certificate expires (that's essentialy what the trigger for this template already do).

Your formula for a calculated item will probably look like this:

(last(//cert.not_after)-now())/86400

[z0x10]

Ola, thanks for the hint

The thing is, I do not know how to add the formula to the template
My goal is to have a dashboard item that shows the remaining days till the cert expires.

[markfree]

Ola, thanks for the hint
The thing is, I do not know how to add the formula to the template
My goal is to have a dashboard item that shows the remaining days till the cert expires.

Check out how to create a calculated item here. You can simply add an item to the template.

[z0x10]

I got it know. I made a copy of the existing expiration item. And add then the mentioned formula to it.
And it shows now the correct numbers of days. Seems that it took a while until it showed the correct value.

Thanks for all the hints.

[mattyj2001]

Is there a way to put this type of item in a template? I seem to be running into a problem with user macros in this context.

If I use the above formula in the calculated item within a template, it says it can't find the key. Which I think is understandable because it doesn't reference a host.

If I put the literal text from the existing 'not_after' item in there, it works (URL's changed to protect the innocent):

(last(/example-host.com/cert.not_after["example.com, {HOST.IP}"]) - now()) / 86400

But since we're templating, we may want to use macros:

(last(/{HOST.HOST}/cert.not_after["{$WEBSITE.DOMAIN}, {HOST.IP}"]) - now()) / 86400

However, this last one does not work. It seem to not be able to find "{$WEBSITE.DOMAIN}", which is a user macro on the host.

Is this expected, and can anyone think of a clever way to make this work within a template? Is there some syntactical magic available to make it recognize a user macro from a templated calculated key?

Thanks!

[cyber]

What does nto work? where? Whatever you just showed here, I was able to put into template (item with key "cert.not_after["{$WEBSITE.DOMAIN}, {HOST.IP}"]" and calcualted item "(last(/{HOST.HOST}/cert.not_after["{$WEBSITE.DOMAIN}, {HOST.IP}"]) - now()) / 86400" ....
Or I just do not get exactly the point... which is nothing unusual ..

[mattyj2001]

Hmm. Yeah. That's pretty much exactly what I'm doing. After I add this to a template, the item is disabled and the info column tells me:

Cannot evaluate function: item "/[server_name]/cert.not_after["{$WEBSITE.DOMAIN}, {HOST.IP}"]" is not supported at "last(/{HOST.HOST}/cert.not_after["{$WEBSITE.DOMAIN}, {HOST.IP}"]) - now()) / 86400".

The {HOST.HOST} part is correct but it's still not evaluating {$WEBSITE.DOMAIN}. If I replace that with the actual (hard-coded) website URL, then it works (though then the template is only good for one host/website.)

{$WEBSITE.DOMAIN} is set as a regular macro on the host. We also use that for a simple web check, so I know it's working/expanding in some instances, just not this one for some reason.

Also worth noting is that currently I'm working around this by making an item specifically attached to the host for the check, but even in that case if I use {$WEBSITE.DOMAIN} instead of the hard-coded URL I'm checking, it fails but with a slightly different message:

Cannot evaluate function: item "/[server_name]/cert.not_after["{$WEBSITE.DOMAIN}, {HOST.IP}"]" does not exist at "last(/gitlab-rails-01.dolby.net/cert.not_after["{$WEBSITE.DOMAIN}, {HOST.IP}"]) - now()) / 86400".

The rest of the certificate monitoring is going through discovery, so all the keys automatically fill in the actual URL where {$WEBSITE.DOMAIN} should be.

Should {$WEBSITE.DOMAIN} be set someplace else?