Ad Widget

Collapse

Zabbix script HttpRequest only can query port 80,443 (Proxmox Template not working)

Collapse
This topic has been answered.
X
X
 
  • Time
  • Show
Clear All
new posts
  • leewp14
    Junior Member
    • May 2023
    • 13

    #1

    Zabbix script HttpRequest only can query port 80,443 (Proxmox Template not working)

    Hi everyone. This is my first posting on this forum, and your help is much appreciated. I have been banging my head for the entire day and no progress is made at all.

    My situation is that I'm am currently setting up to monitor Proxmox VE through HTTP.
    The setup is unsuccessful and after looking around and testing the Proxmox API numerous times, I am dead certain that the API is reachable and working with data returned, no matter from which host I'm querying.
    Hence, this excludes the API permission issue from the problem, which is what faced generally by other people who are trying to do the same thing.
    However, the script execution of the official Proxmox template in Zabbix always fail, saying that:
    Code:
    Cannot execute script: Error: cannot get URL: Couldn't connect to server.
    at [anon] (httprequest.c:369) internal
    at [anon] () native strict preventsyield
    at [anon] (function:5) preventsyield
    So after many many many many hours of research, I can now narrow down the issue to specifically the javascript HttpRequest thingy, or the problem of Zabbix.
    Here's my findings:

    I have tried to host simple html server on the target host (which is the Proxmox hypervisor) on multiple ports, ie. 80, 443, 1000, 2000, 8007, and so on.
    I am able to open the simple html server page from other devices, including the host itself where zabbix agent is installed, using curl, via http.
    However, Zabbix is unable to fetch this page via agent.
    This is my test script: (you may only focus on the second last line)
    Click image for larger version

Name:	image.png
Views:	2478
Size:	23.5 KB
ID:	465494
    So, the test results is like this:
    Click image for larger version

Name:	image.png
Views:	2293
Size:	19.0 KB
ID:	465495

    And this happens to every other pages, ***EXCEPT 80 and 443. ***
    Which means, no matter is http or https, if the page is on port 80 and 443, it will work. Below is example using port 443 but through http:

    Click image for larger version

Name:	image.png
Views:	2415
Size:	24.7 KB
ID:	465497
    Click image for larger version

Name:	image.png
Views:	2295
Size:	22.5 KB
ID:	465498

    So do you know what's the issue here? It's most certainly not firewall because the host itself can access the page via curl and even other devices can access it. It's only that through Zabbix agent script, it won't work. On a side note, no firewall is configured on the host too.
    Much appreciated for any suggestions or advice. I really have no idea and I might end up diving into the big sea if I cannot solve this problem TT
    If really no choice, I think I will just use nginx to redirect to port 8006 through port 80/443. However, this is production server, hence I don't see the feasibility to setup a reverse proxy just to make this monitoring thing work (trying to touch less things as possible)

    Thanks in advance!
    Attached Files
  • Answer selected by leewp14 at 07-06-2023, 17:00.
    cyber
    Senior Member
    Zabbix Certified SpecialistZabbix Certified Professional
    • Dec 2006
    • 4807

    Check your selinux settings... https://www.systutorials.com/docs/li...abbix_selinux/
    you need this
    If you want to determine whether zabbix can connect to all TCP ports, you must turn on the zabbix_can_network boolean. Disabled by default.

    setsebool -P zabbix_can_network 1

    Comment

    • leewp14
      Junior Member
      • May 2023
      • 13

      #2
      Click image for larger version  Name:	image.png Views:	0 Size:	45.2 KB ID:	465553

      I actually found this in the codebase and it seems to explain why the query only works using port 80 and 443.
      Could anyone reproduce this or verify that this is intentional behaviour?
      I have just verified that on another Zabbix server, it is working as intended. Though that server is not under my administrative control, hence I'm still pending the admin to check on the curl version.

      Click image for larger version

Name:	image.png
Views:	2256
Size:	61.9 KB
ID:	465554

      Using the same script on both sides, port left intact at 8006.
      Click image for larger version

Name:	image.png
Views:	2255
Size:	74.9 KB
ID:	465555


      My zabbix version is 6.4.2 and the another working Zabbix server is 6.2.3.
      My curl version is 7.61.1 on the server side. Provided that another server works, I now able to narrow the issue to just the Zabbix server.
      However, it seems like in release/6.0, this code does exists too. Can only confirm it's the problem once I get the curl version from the other admin.
      Last edited by leewp14; 07-06-2023, 04:48.

      Comment

      • cyber
        Senior Member
        Zabbix Certified SpecialistZabbix Certified Professional
        • Dec 2006
        • 4807

        #3
        Check your selinux settings... https://www.systutorials.com/docs/li...abbix_selinux/
        you need this
        If you want to determine whether zabbix can connect to all TCP ports, you must turn on the zabbix_can_network boolean. Disabled by default.

        setsebool -P zabbix_can_network 1

        Comment

        • leewp14
          Junior Member
          • May 2023
          • 13

          #4
          Originally posted by cyber
          Check your selinux settings... https://www.systutorials.com/docs/li...abbix_selinux/
          you need this

          Dang. This is the resolution. Thank you very much!!!

          For those who want to know why this works, recommended to read up on https://docs.rockylinux.org/guides/s...arning_selinux
          There is something called SELinux boolean objects, which is basically where the 'zabbix_can_network' flag resides (I don't see anywhere else mentioning where this flag came from).
          -P flag is required to persist the change.

          Thanks again cyber! I never thought it was SELinux. It's just my first few times dealing with these kind of SELinux based distros.

          Comment

          Working...