Can't figure out why Zabbix won't see elasticsearch

[DerekinGeorgia]

I've been fighting this for a few hours and thought it was time to ask for help.

I've set up a server whose only role will be to run elasticsearch, and I'd like to start monitoring before I start using it.

So far:

• Zabbix server and the server running elasticsearch are running on the same subnet, and can ping each other.
• Zabbix is seeing the agent running on the server and is happily collecting data, it just thinks elasticsearch isn't running.
• From the zabbix server command line, running 'curl -u <myusername> http://<serverip>:9200 reports as you would expect if elasticsearch is running. Node, cluster name, and all that stuff are reported.

So the service is up, and the servers can talk, but it's not showing up in the dashboard.

For the server configuration in the dashboard:

• Elasticsearch Cluster by HTTP is selected in templates
• For value mapping I've got {$ELASTICSEARCH.PASSWORD} and {$ELASTICSEARCH.USERNAME} configured with the correct information. No quotes or anything.
• I added the search.port and search.scheme mappings as well in case that was causing the problem, but nope.

I'm not sure where to go next. It's still displaying ES: Service is down, Under latest data I have red ! markers next to ES services and when I hover it says Cannot perform request: couldn't connect to the server.

I'm at a loss here. Any ideas?

[LenR]

Do the simple check items in the template show data?

Try running tcpdump on the elastic server to see if you're getting traffic from Zabbix. That will tell you which way look.

[DerekinGeorgia]

Thanks. I tried to update this last night and was unable to. SElinux was the culprit - I disabled it and everything ran cleanly. Don't really understand why, to be honest, but I got it working about as expected.

[cyber]

Don't disable it... SELinux is there for a reason. Change its config according to your needs. You are most probably stumbling on the default option, that Zabbix is not allowed to connect to "unknown ports" ...

If you want to determine whether zabbix can connect to all TCP ports, you must turn on the zabbix_can_network boolean. Disabled by default.

setsebool -P zabbix_can_network 1

https://man.linuxreviews.org/man8/zabbix_selinux.8.html

[DerekinGeorgia]

Thanks, Cyber. I'll reconfigure that.