net.tcp.service(tcp,<IP>,<port>) simple check not work for most of the ports from GUI

[Bdolnik]

net.tcp.service(tcp,<IP>,<port>) simple check does not work for most of the ports from GUI Zabbix 6.0 - only for selected ports

I am trying to add MSSQL template and getting error MSSQL: Service is unavailable. Checking deeper - this error caused by simple check net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}] where the port is specified by macro as 1433
Next step was to create simple check standalone in gui and test. It indeed does not work (returns 0). I also run tcpdump and do not see any packets sent.
To test it further I played with the port net.tcp.service[tcp,{HOST.CONN},<port>]. I see packet sent if I set port to 21, 80, 443 or 10050 but NOT SENT to 22, 1433 (MSSQL) or 3389 (rdp windows). If the packet is sent and the service is up I am getting 1 (correct behavior). If packet is not sent (as for port 1433 or 3389) I always getting 0.
Interestingly the field "host address" in test item window does not mater - it could be any bogus address, the result is the same.

Then I tested the same key from the server console using zabbix_get
./zabbix_get -s 127.0.0.1 -k "net.tcp.service[tcp,10.2.2.101,<port>]" (10.2.2.101 is my client)
In this case I can check ALL PORTS (22, 1433, 3389 etc) and get the correct result. For example for 1433 and 3389 I got 1 because those ports are opened on my client.
I also see tcp packets sent in tcpdump.
More interesting - when I run ./zabbix_get -s 10.2.2.101 -k "net.tcp.service[tcp,10.2.2.101,<port>]" and the zabbix agent is installed I am getting correct response but do not see packet sent. It seems that zabbix_get uses -s (server) as a server that is opening tcp session. If first communicates with the agent and the agent starts tcp.

I saw some posts about the problem but do not see the solution.

https://www.zabbix.com/forum/zabbix-help/421423-monitoring-if-tcp-3389-is-up

But I do not see solution

Note that the firewall has the ports opened but it should not matter (console works as expected, just GUI does not)

It is very important to be able to check tcp.service on some specific ports (1443, 3389 or some custom ports) even the agent is not installed

I am using the latest zabbix 6

Benny

[Atsushi]

Try changing the item type to Zabbix agent.

[Bdolnik]

yes, when I configure it as Zabbix agent it works for all ports. For test I gave the IP address of the Zabbix server as an agent (127.0.0.1).

But this does not solve my problem as for MSSQL the pre-defined trigger uses "simple check" and not Zabbix agent - therefore it reports the port is not active.
This is the configuration of the MSSQL trigger in Zabbix:


As you can see, it is set as Simple check.

Therefore, it seems there is a defect as Simple check is implemented unless there is some secret configuration to unblock ports.
The idea is that the simple check should work directly without agents
Thanks
Benny

[Atsushi]

Items of type simple check cannot be checked with zabbix_get command. If Zabbix server cannot connect from Zabbix server with the port number specified for monitoring, it cannot be checked.(When using Simple check) Check if the network configuration and settings are such that Zabbix server can connect.

[Bdolnik]

After intensive search I found the solution. By default Zabbix server blocks all the ports except some (22,80,433). To change the behavior in RH8 you need to grant it permission to the can_network by doing following:

setsebool -P zabbix_can_network on

Works like a charm after this !

thanks
Benny