ZABBIX Agent : log[] only accessible as an active check?

[Crazy Marty]

I've given this some thought, and I cannot come up with any reason why this should be limited to active checks only.

For a lot of good reasons, I cannot permit my monitored clients to connect to the Zabbix server (the net the Zabbix server is on has a much higher level of trust). I cannot put a Zabbix server on each of the client nets (hosting costs would put me out of business).

Can someone enlighten me as to why this is limited?

[bbrendon]

Not sure, but I would argue ONLY USE ACTIVE CHECKS

... and thats my argument (one line).

[Crazy Marty]

I can't use any active checks: the monitored clients are on an untrusted (and actually, untrustable) network. That is a constraint I cannot change: these are public-facing web servers I need to monitor.

[bbrendon]

So, you're saying that because the servers are untrusted, you don't want them contacting you, but you can contact them?

Hmmm... whatever suits you. Did you consider the data isn't even encrypted?

I suppose zabbix is probably not the most tested/secure daemon, but my paranoia doesn't stretch that far. IP security is "good enough" for me.

I have loads of unsecure/untrusted servers checking into my zabbix box and only use IP security. I guess one of those servers could get hacked and someone could try to hack me through the zabbix 10051 port. Hmm... nope, still not worried.

You may have some policy/legal reasons, but personally, I think the risk is acceptable.

Regarding the logs, thats a limitation. There are other benefits you get (because you're not using active checks) that others using active checks don't. No one gets their cake and can eat it too with the current zabbix... I'm pretty sure all of us die-hard zabbix users have found that out many times by now

...but we all love zabbix!

[Crazy Marty]

After all that, the question still remains: What is the reason that the log[] parameter is available only for active checks?

[Alexei]

Can someone enlighten me as to why this is limited?

There are no technical reasons behind this. I believe the limitation will disappear at some point.