Configure Agent2 to run as a different user than the Zabbix server

[sihedat256]

To configure Agent2 to run as a different user than the Zabbix server on Ubuntu Server 24.04, I did the following:

Create new user:

sudo useradd --system --no-create-home --shell /usr/sbin/nologin zabbix-agent

Set the new owner of the Agent2 files (also for the log file):

sudo chown zabbix-agent:zabbix-agent /etc/zabbix/zabbix_agent2.conf
sudo chown -R zabbix-agent:zabbix-agent /etc/zabbix/zabbix_agent2.d/
sudo chown zabbix-agent:zabbix-agent /var/log/zabbix/zabbix_agent2.log

sudo systemctl edit zabbix-agent2

[Service]
User=zabbix-agent
Group=zabbix-agent 

sudo systemctl daemon-reload
sudo systemctl restart zabbix-agent2

And what I get is "failed to open log file: open /var/log/zabbix/zabbix_agent2.log: permission denied":

sudo systemctl status zabbix-agent2

● zabbix-agent2.service - Zabbix Agent 2
Loaded: loaded (/etc/systemd/system/zabbix-agent2.service; enabled; preset: enabled)
Drop-In: /etc/systemd/system/zabbix-agent2.service.d
└─override.conf
Active: activating (auto-restart) (Result: exit-code) since Fri 2026-03-20 09:45:28 CET; 6s ago
Process: 95613 ExecStart=/usr/sbin/zabbix_agent2 -c $CONFFILE (code=exited, status=1/FAILURE)
Main PID: 95613 (code=exited, status=1/FAILURE)
CPU: 18ms 

sudo journalctl -u  zabbix-agent2.service

zabbix_agent2 [2087]: ERROR: Failed to run agent: cannot initialize logger: failed to open log file: open /var/log/zabbix/zabbix_agent2.log: permission denied. 

What am I doing wrong/forgetting?
Thanks for any help.

[troffasky]

What are perms on /var/log/zabbix/? I think Zabbix agent needs to be able to create/rename/delete files in here as agent itself handles log rotation, not sufficient to just be able to write one file there.

[sihedat256]

You're right troffasky, in fact, to resolve issues related to file rights I also had to carry out other interventions.

I report the complete procedure that in my case allows the execution of /usr/sbin/zabbix_agent2 without errors, but I'm new to Zabbix and not very familiar with Linux, so I'd appreciate it if someone could take a look.

I found it strange not to find any information about this online, given how widespread Zabbix is. Maybe I'm worrying too much about something that isn't that important?


This is a guide I wrote for myself:

useradd --system --no-create-home --shell /usr/sbin/nologin zabbix-agent

chown zabbix-agent:zabbix-agent /etc/zabbix/zabbix_agent2.conf
chown -R zabbix-agent:zabbix-agent /etc/zabbix/zabbix_agent2.d/​

Set directory for .log and .pid:

mv /var/log/zabbix/zabbix_agent2.log /var/log/zabbix_agent2.log
chown zabbix-agent:zabbix-agent /var/log/zabbix_agent2.log

vi /etc/zabbix/zabbix_agent2.conf

...
LogFile=/var/log/zabbix_agent2.log
...
PidFile=/tmp/zabbix_agent2.pid
... 

To run the systemd service with the new user, I created an override (which also required to set "ExecStop=" to avoid the error empty string: MAINPID):

systemctl edit zabbix-agent2

[Service]
User=zabbix-agent
Group=zabbix-agent
ExecStop= 

systemctl daemon-reload
systemctl restart zabbix-agent2