Custom Scripts Mass Deployment

[Brewer]

Zabbix Version = 7.4.0

New to Zabbix, as will come apparent in the following lines.

MAIN QUESTION:
How in the world do you have a custom monitoring script run on multiple machines without copying the script to each machine's local storage?

EXAMPLE:
Let's say I have 50 Win11 machines and they all have Zabbix Agent 2 (Passive) on them.
The Zabbix Server is running on Linux (take your pick of Linux OS as I don't think it is relevant to my question).
The goal is to run a PowerShell script on all 50 machines that returns a string as the result (Forget value mapping and all that gibberish for now, I just want the raw data to show up on my Zabbix Server's Dashboard.)

MY CURRENT PROCESS:
Based on everything I'm finding, this is only accomplished the following way:
1. Place the PowerShell script on the endpoint device (let's say "C:\Program Files\Zabbix Agent 2\Scripts\MyScriptName.ps1")
2. Modify the agent config file ("C:\Program Files\Zabbix Agent 2\zabbix_agent2.conf") on the endpoint device
2a. Insert a one liner under "####### USER-DEFINED MONITORED PARAMETERS #######" that follows the following format: UserParameter=<key>,<shell command>
Example: UserParameter=MyScriptKeyName,powershell.exe -NoProfile -ExecutionPolicy bypass -File "C:\Program Files\Zabbix Agent 2\Scripts\MyScriptName.ps1"
3. Restart the Zabbix Agent 2 Service on the endpoint device.
4. Locate the endpoint device on your Zabbix Server Web UI within the "Data Collection > Hosts" page.
5. To the right of your Hostname in the list of available hosts, click "Items" followed by "Create Item"
6. Give it a name.
7. Give it the same key you used under 2a (MyScriptKeyName)
8. "Type of information" = Text (This is specific to my example since I said it returned a string).
9. Finish by clicking "Add".

PROBLEM:
This works... but what about the 49 other machines?
Do I go to each machine and perform the same steps?
What happens when I need to update the script? Does that involve going to each machine and modifying it?

WHAT I WANT:
The file would need to live on the Zabbix Server or some form of shared storage within the intranet of the company.
It would need to be remotely executed from the server side in case the endpoint device was not actively on the same network as the storage method (for example a Laptop sitting at someone's house).
Processing would be done on the endpoint device.

WRAP UP:
I must be missing something simple but every video tutorial or documentation I find points to doing custom scripts this way.
I imagine templates come into play here but I can't find the connection between them and custom scripts if I can't place the script on the Zabbix Server (which I tried).

I've rubbed my 2 brain cells together for far too long on this, please help me understand. Thanks!

[Brewer]

This is the information I was looking for:

https://academy.zabbix.com/

Find the course that's called Extend Zabbix (it's free).
This talks about how to run scripts centrally from the Zabbix Server, using the 'externalscripts' directory. But it does mention this isn't the preferred way due to performance impact.
It then goes on to talk about the method from my original post, using UserParameter and/or System.Run[].

Long story shortish,
If you want to hold scripts in one place, you need to put it in the '/lib/zabbix/externalscripts' directory that lives on the Zabbix Server and can be called upon by creating an Item that uses Type "External Check" followed by the filename of your script in the "Key" field (with extension, ex. myScriptName.ps1).
Based on the video explanation, this is not preferred as it requires a forked process to kick off on the Server. The more of these scripts you have, the worse your Server Performance will become.

Long story shortest,
You can't place scripts in a single location and have it executed by the agent on the endpoint host without impacting the Zabbix Server's performance.

Thanks for the replies from everyone.

[Markku]

This is a frequent observation, and the answer has this far been that you have you use your device management systems to deploy the necessary configurations to the devices.

Device/endpoint management is a whole complex topic of itself, and it has traditionally been so that Zabbix concentrates on what they are good at (= monitoring), and some other vendors deal with the device/endpoint configuration management implementations.

If you have 50 Windows machines, usually you already have some management system to keep them in good shape.

That said, one hint for the Zabbix agent custom configuration: usually it is easier to add a new .conf file in the directory set in the default configuration file, so that you don't have to edit the default config file at all. It can make upgrading the agent also much easier (because the config files in the include directory as preserved).

Markku

[Brewer]

Thanks for your reply!

For context, I have Pulseway as a management tool and am switching over from PRTG to Zabbix for my monitoring tool.

If I'm understanding correctly, you are stating that I need to use Pulseway to mass deploy the scripts onto the endpoint devices and also to modify their config files?

I definitely can and will be taking that approach given there seems to be no other option.


Maybe I'm just spoiled from previous tools but it does seem slightly silly that another tool is required if I want to implement custom monitoring for a tool that is specifically made for monitoring.

I'm not advocating for PRTG here, as it has many of its own problems, but they do allow me to take a script, place it on the server, and run it against multiple machines.

If this is truly the only way, why wouldn't I just use my remote management tool (Pulseway) to run the script and alert on the data since I'm already placing all the configuration on it? What am I gaining from pushing the config through Pulseway just so I can monitor it through Zabbix? Perhaps if I realllllly needed a graph but other than that, I don't see the upside of having config in two places for 1 alert check?

Not expecting a reply, just venting
Marking your comment as the answer.

Thanks again!!!

[PavelZ]

A good reason to study ansible.

[hertell]

I run Puppet on all our servers.

[troffasky]

Hmm, I did not realise that I can "answer" a thread despite it not being my question. I have downgraded to a "like".

[Markku]

If I'm understanding correctly, you are stating that I need to use Pulseway to mass deploy the scripts onto the endpoint devices and also to modify their config files?

Yes (if you need scripts and config file modifications that are not possible with the MSI parameters).

One of the reasons for this (in addition to the hugely added software development and management overhead as mentioned that is totally unrelated to the monitoring tasks) is that Zabbix does not need root/admin access to the monitored devices for its own operations. I, for one, would not be comfortable installing new Zabbix agents here and there if they would run as root/administrator on every single endpoint (which would most probably be required if the Zabbix system/component would handle its own installations and deployments).

Of course, if your monitoring scenarios need root/admin access on the monitored device, you are still free to configure the Zabbix agent to run with elevated privileges.

(please don't use the comment feature for actual conversation, it makes quoting harder)

Markku

[Markku]

I'm not advocating for PRTG here, as it has many of its own problems, but they do allow me to take a script, place it on the server, and run it against multiple machines.

Forgot to comment this. If you mean running commands on the agents during the monitoring (like automated preventative or corrective operations), yes, that is possible with Zabbix agent, without deploying the scripts with external tools. But in this context, maybe you meant the initial installation efforts.

Markku

[Brewer]

This is the information I was looking for:

https://academy.zabbix.com/

Find the course that's called Extend Zabbix (it's free).
This talks about how to run scripts centrally from the Zabbix Server, using the 'externalscripts' directory. But it does mention this isn't the preferred way due to performance impact.
It then goes on to talk about the method from my original post, using UserParameter and/or System.Run[].

Long story shortish,
If you want to hold scripts in one place, you need to put it in the '/lib/zabbix/externalscripts' directory that lives on the Zabbix Server and can be called upon by creating an Item that uses Type "External Check" followed by the filename of your script in the "Key" field (with extension, ex. myScriptName.ps1).
Based on the video explanation, this is not preferred as it requires a forked process to kick off on the Server. The more of these scripts you have, the worse your Server Performance will become.

Long story shortest,
You can't place scripts in a single location and have it executed by the agent on the endpoint host without impacting the Zabbix Server's performance.

Thanks for the replies from everyone.