Unreliable ping response times in Zabbix-6.2?

[smcgraw]

I just "upgraded" my Zabbix machine from Ubuntu-18.04 to Ubuntu-22.04 from Zabbix-3.4 to Zabbix-6.2. ("upgrade" in quotes because it was really a fresh install/reconfig of both Ubuntu and Zabbix).

I have some monitoring items that use "Simple check / icmppingsec" keys to check ping response times to a half dozen ip addresses.

In the new Zabbix, these response times are larger (2-4x) and much more variable than in the old Zabbix.

I don't think the problem is the new OS because when I run fping manually, the times I see are consistent with the numbers from the old Zabbix. Additionally, I am running a clone of the old Ubuntu-18.04/Zabbix-3.4 machine in a VM on the upgraded machine. I can look at the ping time graphs of both Zabbixes side-by-side: the Zabbix-3.4 times are 1/2 to 1/4 of the Zabbix-6.2 times. For example, taking a look right now at one particular ip address with a 15s update interval:

Ping response times in mS

1 hour	Min	Avg	Max
Zabbix-6.2	2.7	13.7	72.4
Zabbix-3.4	2.9	3.7	15.4

I double checked the item definitions in both and I see no meaningful differences.

Is this a known problem? Is there anything I can do to identify the problem further?

[Markku]

What you could do is take a tcpdump capture of that particular ping on the Zabbix server. Then after a while you can look at the latest values in Zabbix and if you see suspicious values, compare them to the captured packets (in Wireshark you can use for example a delta time column to easily see the response times).

Markku

[smcgraw]

Thanks Markku for that suggestion. However I think I found the problem though other means.

Per the Zabbix doc for "Simple Checks", I increased the server DebugLevel to 4 for "icmp pinger" processes which then print details about how they run fping. Since my icmppingres keys for all 7 addresses specify only the address and all other options are defaults, they are grouped together into a single fping invocation per update (as documented).

The difference between Zabbix-3.4 and -6.2 appears to be the latter gives fping a "-i0" option but the former doesn't. I can reproduce the slower and more variable Zabbix-6.2 response times by manually running fping commands including that option. Without it, or using -i10 (fping's default), I get response times consistent with the Zabbix-3.4 results which seems more correct.

But I see no way to control the -i option given to fping via configuration parameters. The doc says Zabbix tries 0, 1 and 10 and thereafter uses the first value that worked. Is there some way to override that behavior?

(I guess I could provide an fping wrapper that ignores the -i option, or tweak the config so that separate fpings are used for each address but those options seem unnecessarily inefficient, complicated and hackish.)

[Markku]

I suggest you describe your symptoms, circumstances and tests, and then open an issue in https://support.zabbix.com . That's the way to possibly add more configurability for fping invocation.

Markku

[smcgraw]

https://support.zabbix.com/browse/ZBX-21757