Windows machine behind a firewall - registers OK but doesn't report on problems

[gwynll]

Zabbix Server 6.0
Zabbix Agent (not Zabbix Agent 2) version 6.0.4

Hello,

Most of our Windows machines are on the same network as the Zabbix proxy, and these hosts all report to Zabbix without issue. But we also have a handful of Windows machines in our DMZ, on a segregated network behind a firewall. I'm trying to get these into Zabbix.

Our network team kindly opened the TCP ports 10050 and 10051 for us between these DMZ clients and the Zabbix proxy.

I've installed the Zabbix Agent on one of these DMZ clients, using the same client installer, and using the same config file apart from having a different 'HostMetadata' value.

The host got picked up fine by the Zabbix server, the ZBX button is lit green in Configuration > Hosts. The passive template for Windows got linked by the autoregistration action as configured, and since 'Windows services by Zabbix agent' is a linked template, this was also assigned to the host. The prototype did its job, and a list of all its Windows services are represented by Items and Triggers. All good. However, when I test this client out by stopping one of the 'Automatic' services, no problems are reported in Zabbix at all about it. I've checked that there is an Item and Trigger for this specific service on this host.

If I stop the same service on a Windows host that's within our main network, that has all the same templates, then it is flagged up in 'Problems' within a few minutes.

As a test, I changed the autoregistration action so that it assigns the Active templates instead of Passive, and then DMZ deleted the host and got it to re-register itself, which it did - and the same problem exists there as well.

So, do any ports need to be allowed through the firewall apart from 10050 and 10051?

Can you think of any other factor that might stop this agent from communicating this stopped service problem? Or any other ways I can troubleshoot?

Thanks.

[cyber]

Might be very obvious question, but even if items/triggers are created, is the data coming in? I cannot see the possibility to not fire, if data comes in correctly...

Just in case look into agent log file...

[cyber]

Might be very obvious question, but even if items/triggers are created, is the data coming in? I cannot see the possibility to not fire, if data comes in correctly...

Just in case look into agent log file...

[gwynll]

Hi cyber,

I'm not quite what's happened here, but it works now. The only thing I've done is to restart the service, so perhaps that was it.

One other question I have, indirectly related to the above. In my client config files I tend to specify a Server= address AND a ServerActive= address, even though I only use Passive templates. I figured it might come handy in the future if I start using Active checks. But even though I'm not using any Active templates currently, does specifying ServerActive= on the agent mean that it's consuming more resources on the host machine?

I notice in the agent log that the following line is written if ServerActive= is populated, and does not otherwise:

7816:20220916:091415.665 agent #5 started [active checks #1]

So I'm just wondering what the implications of the above are for the host machine.

Thanks for your advice.

[cyber]

If you start active agent it will periodically (RefreshActiveChecks parameter, default 120sec) check for active items from server/proxy, whichever is appointed to it... it is not resource hogging thing. You probably won't notice it at all...

[gwynll]

OK thanks for the info