Simple check tcp

[rsterenb]

Hi,

Zabbix-3.2.7.

I have created a couple of "simple check" items for 2 tcp ports for 2 servers:

net.tcp.service[tcp,,4505]
net.tcp.service[tcp,,4506]

I can access those ports from the Zabbix server, checked this with nmap.

When I try using zabbix_get, I get the reply that the ports are up:

$ zabbix_get -s <server1> -k 'net.tcp.service[tcp,,4505]'
1
$ zabbix_get -s <server1> -k 'net.tcp.service[tcp,,4506]'
1
$ zabbix_get -s <server2> -k 'net.tcp.service[tcp,,4505]'
1
$ zabbix_get -s <server2> -k 'net.tcp.service[tcp,,4506]'
1

However, in the "latest data" page these show up as Down (0), and a trigger happens.
In the "host configuration" page I don't see an issue with these items.
In the Zabbix server log I see that the items became supported, and there is no additional logging about these items after this:

4610:20170816:105547.754 item "server1:net.tcp.service[tcp,,4505]" became supported
4606:20170816:105548.756 item "server2:net.tcp.service[tcp,,4505]" became supported
4607:20170816:105550.766 item "server1:net.tcp.service[tcp,,4506]" became supported
4610:20170816:105551.774 item "server2:net.tcp.service[tcp,,4506]" became supported

I don't see what's going wrong here, and I'm hoping to get enlightened here..

[allexpetrov]

Hi rsterenb,

can you please show us your item config (screenshot) ?

Regards,
Alex

[rsterenb]

Attached screenshot.

This is one of the items that the host got from the template that is assigned to it.

[allexpetrov]

rsterenb ,

could you please perform telnet from server to your device using your port ?

e.g. telnet <ip> <port> ?

P.S. - stupid thing, but have you managed to Enable the item ?

Regards,
Alex!

[rsterenb]

Well, yes both items are enabled, and I just double-checked this. I can send a screenshot about that, but I hope you believe me when I say it. Besides, if the item was disabled then it should show up as such, but it does not.


=========
# nmap -nsT -Pn -p4505,4506 server1

Starting Nmap 6.40 ( http://nmap.org ) at 2017-08-16 17:16 CEST
Nmap scan report for server1 (ip.ad.dr.es)
Host is up (0.00037s latency).
PORT STATE SERVICE
4505/tcp open unknown
4506/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds
=========
And, of course, telnet also works..


What I just noticed in the screenshot is that "Host interface" says: "nmo-slt-001:10050", which feels a bit odd because I don't want to use the agent at all for this item. The template is assigned to nmo-slt-001, because we want the Zabbix server to test the port on that server. That is the correct way for an item like this, right?


I found this post from 2013 about an https simple check, which I think displays a similar issue: https://www.zabbix.com/forum/showthread.php?t=39023. There was no solution that made the net.tcp.service check work.

[rsterenb]

Is there no one who can shed any light on this issue I experiencing?

[allexpetrov]

Hi, sorry for delay!

So, actually about interface - it is ok. Try to recreate item, please and, just try to check another port, like SSH for example.

[rsterenb]

Hi, tx for the followup..

I've actually recreated these items several times now, but they never work as expected. So: they are enabled, I see no errors about these items in the GUI or log (the log is actually saying they became available), zabbix_get says the result is 1, Zabbix says the result is 0 in the Latest data.

A colleague converted the original items to an actual Zabbix Agent item and use ntp.tcp.port instead, but IMO that is not the same as doing a net.tcp.service Simple Check from the Zabbix server: it's overkill to use the Zabbix Agent for this, and this way it becomes a local check instead of a remote check.
Since then I've created a new Simple Check using net.tcp.service and that one again doesn't work.

Also, we already have a similar ssh item that works fine. (I can create screenshots of it if you really want me to.)

[allexpetrov]

Hi rsterenb,
what kind of application it is? Is it something you developed ? I could check it in my own test environment

Regards,
Alex

[rsterenb]

Hi.

No this is not something we develop: this is a Salt server that we want to monitor.
https://en.wikipedia.org/wiki/Salt_(software)

https://github.com/saltstack/salt

https://saltstack.com/

We just want to check if the 2 ports mentioned are accepting tcp connections. You can simply telnet to them to see if they work, so as far as I'm concerned they could as well be a simple telnet port, and I figured a net.tcp.service item would be appropriate. If you want to test this, I guess you'd have to install your own Salt server.

[allexpetrov]

Hi.

No this is not something we develop: this is a Salt server that we want to monitor.
https://en.wikipedia.org/wiki/Salt_(software)

https://github.com/saltstack/salt

https://saltstack.com/

We just want to check if the 2 ports mentioned are accepting tcp connections. You can simply telnet to them to see if they work, so as far as I'm concerned they could as well be a simple telnet port, and I figured a net.tcp.service item would be appropriate. If you want to test this, I guess you'd have to install your own Salt server.

Hi there,
I've just performed test in my own sandbox and:

1. Installed salt on Ubuntu 16.04.3 xenial
2. Service is up
3. Created a host and item with simple check like:
net.tcp.service[tcp,,4505]
net.tcp.service[tcp,,4506]

and they both gave me result Up (1)...

Let's do one more thing, let's check your database:

select your zabbix db and perform query:

SELECT hostid,itemid,type,key_,error,name,templateid FROM items where key_ like 'net.tcp.service[tcp,,%';

P.S. - in my sanbox I'm not using any firewall rules on Ubuntu 16.04 as well there is no any changes in salt config file(straight on defaults).

[rsterenb]

Okay.. Well, I don't know what to say now..

This the result of the query:

[zabbix]> SELECT hostid,itemid,type,key_,error,name,templateid FROM items WHERE key_ LIKE 'net.tcp.service[tcp,,%';
+--------+--------+------+----------------------------+-------+-----------------------------------------+------------+
| hostid | itemid | type | key_ | error | name | templateid |
+--------+--------+------+----------------------------+-------+-----------------------------------------+------------+
| 10130 | 136264 | 3 | net.tcp.service[tcp,,4505] | | Salt Publisher state (port 4505/tcp) | NULL |
| 10160 | 136265 | 3 | net.tcp.service[tcp,,4505] | | Salt Publisher state (port 4505/tcp) | 136264 |
| 10821 | 136266 | 3 | net.tcp.service[tcp,,4505] | | Salt Publisher state (port 4505/tcp) | 136264 |
| 10130 | 136267 | 3 | net.tcp.service[tcp,,4506] | | Salt Communicator state (port 4506/tcp) | NULL |
| 10160 | 136268 | 3 | net.tcp.service[tcp,,4506] | | Salt Communicator state (port 4506/tcp) | 136267 |
| 10821 | 136269 | 3 | net.tcp.service[tcp,,4506] | | Salt Communicator state (port 4506/tcp) | 136267 |
+--------+--------+------+----------------------------+-------+-----------------------------------------+------------+
6 rows in set (0.05 sec)


I checked against the hosts table:
- hostid 10130 is the template.
- hostid 10160 is server2.
- hostid 10821 is server1.
So I think this looks fine.

I also queried the history_uint table for all items assigned to server1 and server2, where value == 1:

[zabbix]> SELECT * FROM history_uint WHERE (itemid=136265 OR itemid=136266 OR itemid=136268 OR itemid=136269) AND value=1;
Empty set (0.06 sec)


When I do "AND NOT value=1" (or "AND value=0"), I get 5804 records returned.

[rsterenb]

Hi,

I'm not sure how to proceed from the results in my last post. Is there something obvious that I've missed? Is there something else I can do or test?

[rsterenb]

Should I conclude there is no more that I can do?

[kloczek]

Are you aware of this that simple checks are about checking from zabbix server or proxy (if host is monitored over proxy) and you should be checking using for example nmap or telnet command from server/proxy host?