NTP monitoring: Comparing SNMP-based time offset with Zabbix system time

[HideOnBush]

Good morning everyone,

I’m writing this post after about two weeks of tests without really finding a solution, so I’m turning to you, who are more experienced than me.

Activity: I have two Cisco routers that function as NTP servers (therefore, Zabbix Agent cannot be installed).

I would like to monitor these two NTP servers using Zabbix. To achieve this, I have created two items:

First item: NTP.time

snmp[".1.3.6.1.2.1.197.1.2.9.0"]

This first item simply prints the time from the NTP server. The time format, of course, is not compatible with Zabbix, so I have set up a preprocessing step using JavaScript to split all parts of the time and convert them into a usable format.
The JavaScript preprocessing splits the SNMP-provided time into year, month, day, hour, minute, and second, converting it into a Unix timestamp.
So far, so good.

Second item: NTP.convert (dependent on NTP.time)

ntp.convert

Trigger: NTP Sync diff with Zabbix Server

fuzzytime(/NTP_SNMP/ntp.convert, 15) = 0

Leaving aside the fact that the trigger name is incorrect (since fuzzytime does not function to calculate the time difference between the NTP server and the Zabbix server), my question is precisely about this.
I need to detect if there is a time difference greater than 15 seconds between my NTP server and the Zabbix server’s time, and if so, I need a trigger to notify me (and I am not really sure this trigger is working).

I have tried creating a new item within the template with a key of localtime, like the predefined Zabbix Server template, and then created a trigger using the expression:

last(NTP) - last(Zabbix Server)

However, I realized that this expression is incorrect and not supported by Zabbix.

Current status:

• Both ntp.offset and system.localtime are successfully collecting data, and I can see their values correctly in Latest Data. The problem lies in how to configure Zabbix to correctly compare and trigger an alert based on these two values.
• I understand that Zabbix doesn’t support direct mathematical expressions like last(NTP) - last(Zabbix Server) in triggers. I’ve also tried using calculated items but encountered issues configuring them properly. Therefore, I am looking for guidance on the best approach to achieve this.

Questions:

1. Is there a correct way to compare ntp.offset with the server’s system.localtime directly?
2. Should I be using a calculated item or another approach to get this difference working properly?
3. Any guidance or examples on how to set up a trigger for monitoring this time difference effectively?

Finally, if anyone has experience setting up reliable NTP monitoring in Zabbix using SNMP, I would appreciate any advice on best practices, especially when it comes to handling time conversions and comparisons.

I appreciate any help you can provide. Thank you!

[HideOnBush]

Sorry for upping this, but I really need help

[HideOnBush]

Upp (Version Zabbix: 6.4)

[cyber]

Just so you know you are not ignored... Just noone has something useful to say, including me...
But I would try to use ntpq or ntpstat on your Zabbix server. It probably syncs time from those same ntp servers? So you can get direct info, how far it is from your time servers...

[kyus]

So you have one item that collects NTP time in Unix timestamp and one item (default one) that collects system localtime also in Unix timestamp.

I understand that Zabbix doesn’t support direct mathematical expressions like last(NTP) - last(Zabbix Server) in triggers.

Well, in fact you can use mathematical expressions in your triggers. So for your example it would be something like:

last(/host/ntp.convert)-last(/host/system.localtime)>15 or last(/host/ntp.convert)-last(/host/system.localtime)<-15

I believe that the ntp.convert is the item that store your NTP time in Unix timestamp, if not, just adjust for your needs.

[HideOnBush]

So you have one item that collects NTP time in Unix timestamp and one item (default one) that collects system localtime also in Unix timestamp.


Well, in fact you can use mathematical expressions in your triggers. So for your example it would be something like:

last(/host/ntp.convert)-last(/host/system.localtime)>15 or last(/host/ntp.convert)-last(/host/system.localtime)<-15

I believe that the ntp.convert is the item that store your NTP time in Unix timestamp, if not, just adjust for your needs.

Okay, it was really easy to solve the expression, in the meantime I thank you, I will do some more tests to see if it works.

[HideOnBush]

So you have one item that collects NTP time in Unix timestamp and one item (default one) that collects system localtime also in Unix timestamp.


Well, in fact you can use mathematical expressions in your triggers. So for your example it would be something like:

last(/host/ntp.convert)-last(/host/system.localtime)>15 or last(/host/ntp.convert)-last(/host/system.localtime)<-15

I believe that the ntp.convert is the item that store your NTP time in Unix timestamp, if not, just adjust for your needs.

The query is right, but probably the ‘sysem.localtime’ is not working properly, as the trigger gives me this error on the host I have hooked up to ‘Cannot evaluate function last(/ntpserver_time_sync/system.localtime): not enough data.’

I'm trying to solve the problem because the ‘system.localtime’ usually has interface ‘127.0.0.1’, I instead entered the exact IP.. Is it possible to use the expression using a different host?
Like: last(/NTP/ntp.convert)-last(/ZabbixServer/system.localtime)>15

[HideOnBush]

I added among the linked templates, the generic Zabbix template ‘Template OS Linux by Zabbix Agent’, kept only the item ‘system.localtime’ and then set the trigger to make the expression. So far so good, but when I go to ‘latest data’ I see that it doesn't collect the ‘system.localtime’ data, I suppose it's a problem with the interfaces, but using the linked template should automatically fetch the IP of Zabbix Server without conflicting with the IP of the ‘NTP’ host which is different, right?

[kyus]

...but using the linked template should automatically fetch the IP of Zabbix Server without conflicting with the IP of the ‘NTP’ host which is different, right?

If you added it to your NTP host it will use the interface configured in that host.

Is it possible to use the expression using a different host?
Like: last(/NTP/ntp.convert)-last(/ZabbixServer/system.localtime)>15

Yes, it is possible to have a trigger that uses items from different hosts.

[HideOnBush]

Yes, it is possible to have a trigger that uses items from different hosts.

I tried to create the expression with two triggers from two different hosts, but it does not seem to collect any data on ‘Latest Data’.

[kyus]

It looks like there are some things mixed up.

I tried to create the expression with two triggers from two different hosts...

To create this trigger you need to use items from different hosts, not their triggers.

...but it does not seem to collect any data on ‘Latest Data’.

I'm not sure about what you meant here, but if you can't see data being collected you need to check your item configuration.

If the item isn't working properly then your trigger also won't work. You can always test your items (unless they're active items)

[HideOnBush]

I was using two different items of two different hosts, and created a trigger with that. Everything okay, but when I went to "Latest Data" in Monitoring for check, no data was collecting

[kyus]

Then your items aren't working, you'll have to find out why. Check if there are any errors being displayed on the item, or try to test them to see if it returns any value.

[HideOnBush]

I will try to explain myself better.
I have created a host ‘snmp_KVZNTPAP01_ntpserver_time_sync’ where I have connected both the personal NTP Server template and the template ‘Template Module Linux generic by Zabbix agent’; created the trigger which I have attached, unfortunately it does not collect any data.

Checked both template items and they work perfectly, the ‘system.localtime’ on its default host (zabbix server) works, same for the other item ‘ntp.convert’.

[HideOnBush]

The problem is obvious, the ‘system.localtime’ does not retrieve the data from Zabbix Server, but from the host interface to which it is connected.

How can I retrieve the data from Zabbix Server?