Problem with "Get Overall Health VC State

[Hanjo]

We use Zabbix with vcenter. All values are picked up except one: Get Overall Health VC State. And i cannot understand why. From the zabbix_proxy.log debug log i can see that zabbix manage to get the system information, but fails on get status:
SUCCESS:
1664703:20241105:152732.351 [ VMware vCenter ] Received response with status code 200: {"value":{"summary":"Patch for VMware vCenter Server 8.0","install_time":"2024-10-16T11:48:40.967Z","product":"VMware vCenter Server","build":"24305161","releasedate":"October 09, 2024","type":"vCenter Server with an embedded Platform Services Controller","version":"8.0.3.00300"}}
FAIL:
1664703:20241105:152732.411 [ VMware vCenter ] Received response with status code 403: {"error_type":"UNAUTHORIZED","messages":[{"args":[],"default_message":"Unable to authorize user","id":"vapi.security.authorization.invalid"}]}
1664703:20241105:152732.411 [ VMware vCenter ] ERROR: Cannot connect to VMware vCenter. Check debug log for more information.

So, in some way zabbix can connect, but in other ways it cannot? Any clues??

Zabbix version: 7.0.5
Vmware template from release/7.0 https://git.zabbix.com/projects/ZBX/...Frelease%2F7.0

[Hanjo]

I have read a little bit more on this and the check that fail is a script check where zabbix runs a javascript where it tries to login to vcenter on a different url (/api/session instead of /sdk) and tries to login to vcenter with basic auth. Could there be a new port that is used in some way and blocket by the firewall?

[Hanjo]

Here is a longer snippet. For me it seems like i can authenticate to the /api/session endpoint (in the script from the template javascript login function)and get a session, but then it fails later in the getHealthStatus: function

1664572:20241106:162100.522 [ VMware vCenter ] Received response with status code 200: {"value":{"summary":"Patch for VMware vCenter Server 8.0","install_time":"2024-10-16T11:48:40.967Z","product":"VMware vCenter Server","build":"24305161","releasedate":"October 09, 2024","type":"vCenter Server with an embedded Platform Services Controller","version":"8.0.3.00300"}}
1664572:20241106:162100.524 [ VMware vCenter ] Sending request: https://SERVER-FQDN/api/appliance/health/system
1664983:20241106:162100.572 zbx_setproctitle() title:'icmp pinger #3 [getting values]'
1664983:20241106:162100.572 In get_pinger_hosts()
1664983:20241106:162100.572 In zbx_dc_config_get_poller_items() poller_type:3
1664983:20241106:162100.572 End of zbx_dc_config_get_poller_items():0
1664983:20241106:162100.572 End of get_pinger_hosts():0
1664983:20241106:162100.572 In process_pinger_hosts()
1664983:20241106:162100.572 End of process_pinger_hosts()
1664983:20241106:162100.572 In zbx_dc_config_get_poller_nextcheck() poller_type:3
1664983:20241106:162100.572 End of zbx_dc_config_get_poller_nextcheck():1730906463
1664983:20241106:162100.572 zbx_setproctitle() title:'icmp pinger #3 [got 0 values in 0.000145 sec, idle 3 sec]'
1664572:20241106:162100.577 content_type 'application/json'
1664572:20241106:162100.577 [ VMware vCenter ] Received response with status code 403: {"error_type":"UNAUTHORIZED","messages":[{"args":[],"default_message":"Unable to authorize user","id":"vapi.security.authorization.invalid"}]}
1664572:20241106:162100.577 [ VMware vCenter ] ERROR: Cannot connect to VMware vCenter. Check debug log for more information.

[Hanjo]

Ok, for everyone else who encounters this problem. its not enough to add the vcenter user to the read only group. you have to add the user to the SystemConfiguration.ReadOnly group also. Vcenter->Administration->single sign on->users and groups->groups->find (type in the group name) and add the vcenter zabbix user to that group. This little detail fixed the problem

[Jencek123]

It seems you fixed your problem. Thank you for posting solution, it helps also in our case.