OpenStack Nova by HTTP

Overview

This template is designed for the effortless deployment of OpenStack Nova monitoring by Zabbix via HTTP and doesn't require any external scripts.

Requirements

Zabbix version: 6.4 and higher.

Tested versions

This template has been tested on:

• OpenStack Yoga release and OpenStack built from sources (27568ea3):

  • Compute API v2.1

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

This template is not meant to be used independently. A host with the OpenStack by HTTP template will discover the Nova service automatically and create a host prototype with this template assigned to it.

If needed, you can specify an HTTP proxy for the template to use by changing the value of {$OPENSTACK.NOVA.HTTP.PROXY} user macro.

For tenant usage statistics, it is possible to choose a custom time period for which the data will be queried. This can be set with the {$OPENSTACK.NOVA.TENANT.PERIOD} macro value. The value can be one of the following:

• y - current year until now;

• m - current month until now (default value);

• w - current week until now;

• d - current day until now;

This template discovers servers (instances) present in the project and monitors their statuses, but, depending on different use cases, most likely it is not necessary to monitor all servers. To filter which servers to monitor, set the {$OPENSTACK.SERVER.DISCOVERY.NAME.MATCHES} and {$OPENSTACK.SERVER.DISCOVERY.NAME.NOT_MATCHES} macro values accordingly. This logic also applies to other low-level discovery rules.

OpenStack configuration

For the OpenStack monitoring user to be able to access the API resources used in this template, it is needed to configure the policy file for OpenStack Nova.

On the OpenStack server, open the /etc/nova/policy.json file in your favorite text editor.

In this file, assign the following target resources to the role that the monitoring user uses:

{
  "os_compute_api:servers:index": "role:monitoring",
  "os_compute_api:servers:show": "role:monitoring",
  "os_compute_api:os-services:list": "role:monitoring",
  "os_compute_api:os-hypervisors:list-detail": "role:monitoring",
  "os_compute_api:os-availability-zone:detail": "role:monitoring",
  "os_compute_api:os-simple-tenant-usage:list": "role:monitoring"
}

If some role is already assigned to the target, it is possible to add another role with or, for example, role:firstRole or role:monitoring.

Note that a restart of OpenStack Nova services might be needed for these new changes to be applied.

Macros used

Items

Triggers

LLD rule Nova: Servers discovery

Item prototypes for Nova: Servers discovery

Trigger prototypes for Nova: Servers discovery

LLD rule Nova: Compute services discovery

Item prototypes for Nova: Compute services discovery

Trigger prototypes for Nova: Compute services discovery

LLD rule Nova: Hypervisor discovery

Item prototypes for Nova: Hypervisor discovery

Trigger prototypes for Nova: Hypervisor discovery

LLD rule Nova: Availability zones discovery

Item prototypes for Nova: Availability zones discovery

Trigger prototypes for Nova: Availability zones discovery

LLD rule Nova: Tenant discovery

Item prototypes for Nova: Tenant discovery

OpenStack by HTTP

Overview

This template is designed for the effortless deployment of OpenStack monitoring by Zabbix via HTTP and doesn't require any external scripts.

Requirements

Zabbix version: 6.4 and higher.

Tested versions

This template has been tested on:

• OpenStack Yoga release and OpenStack built from sources (27568ea3):

  • Identity API v3
  • Compute API v2.1 (for OpenStack Nova by HTTP template)

Configuration

Zabbix should be configured according to the instructions in the Templates out of the box section.

Setup

This is a master template that needs to be assigned to a host, and it will discover all OpenStack services supported by Zabbix automatically.

Before using this template it is recommended to create a separate monitoring user on OpenStack that will have access to specific API resources. Zabbix uses OpenStack application credentials for authorization, as it is a more secure method than a username and password-based authentication.

Below are instructions and examples on how to set up a user on OpenStack that will be used by Zabbix. Examples use the OpenStack CLI (command-line interface) tool, but this can also be done from OpenStack Horizon (web interface).

If using the CLI tool, make sure you have the OpenStack RC file for your project with a user that has rights to create other users, roles, etc., and source it, for example, . zabbix-admin-openrc.sh.

The OpenStack RC file can be obtained from Horizon.

The project that needs to be monitored is assumed to be already present in OpenStack. In the following examples, a project named zabbix is used:

# openstack project list
+----------------------------------+--------------------+
| ID                               | Name               |
+----------------------------------+--------------------+
| 28d6bb25d62b4e7e8c2d59ce056a0334 | service            |
| 4688a19e02324c42a34220e9b6a2407e | admin              |
| bc78db4bb2044148a0abf90be512fa12 | zabbix             |
+----------------------------------+--------------------+

1. After the project name is noted, a monitoring user needs to be created. This can be done by executing an openstack user create command:

# openstack user create --project zabbix --password-prompt zabbix-monitoring
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field               | Value                            |
+---------------------+----------------------------------+
| default_project_id  | bc78db4bb2044148a0abf90be512fa12 |
| domain_id           | default                          |
| enabled             | True                             |
| id                  | abd3eda9a29244568b1801e4825b6d71 |
| name                | zabbix-monitoring                |
| options             | {}                               |
| password_expires_at | None                             |
+---------------------+----------------------------------+

2. When the monitoring user is created, it needs to be assigned a role. But first, a monitoring-specific role needs to be created:

# openstack role create --description "A role for Zabbix monitoring user" monitoring
+-------------+-----------------------------------+
| Field       | Value                             |
+-------------+-----------------------------------+
| description | A role for Zabbix monitoring user |
| domain_id   | None                              |
| id          | 93577a7f13184cf7af76f7bdecf7f6ee  |
| name        | monitoring                        |
| options     | {}                                |
+-------------+-----------------------------------+

3. Then assign this newly created role to the monitoring user created in Step 1:

# openstack role add --user zabbix-monitoring --project zabbix monitoring

4. Verify that the role has been assigned correctly. There should be one role only:

# openstack role assignment list --user zabbix-monitoring --project zabbix --names
+------------+---------------------------+-------+----------------+--------+--------+-----------+
| Role       | User                      | Group | Project        | Domain | System | Inherited |
+------------+---------------------------+-------+----------------+--------+--------+-----------+
| monitoring | zabbix-monitoring@Default |       | zabbix@Default |        |        | False     |
+------------+---------------------------+-------+----------------+--------+--------+-----------+

5. Get the OpenStack RC file for the monitoring user in this project, source it, and generate application credentials:

# openstack application credential create --description "Application credential for Zabbix monitoring" zabbix-app-cred
  +--------------+----------------------------------------------------------------------------------------+
  | Field        | Value                                                                                  |
  +--------------+----------------------------------------------------------------------------------------+
  | description  | Application credential for Zabbix monitoring                                           |
  | expires_at   | None                                                                                   |
  | id           | c8087b91354249f3b157a50fc5ecfb3c                                                       |
  | name         | zabbix-app-cred                                                                        |
  | project_id   | bc78db4bb2044148a0abf90be512fa12                                                       |
  | roles        | monitoring                                                                             |
  | secret       | E1kC-s8QTWUaIpmexF18GW-FL3TI9-HXoexdExvGsw7uOhb3SEFW1zDa1qTs80Vqn-2xgviIPRuYOCDp2NDVUg |
  | system       | None                                                                                   |
  | unrestricted | False                                                                                  |
  | user_id      | abd3eda9a29244568b1801e4825b6d71                                                       |
  +--------------+----------------------------------------------------------------------------------------+

While creating the application credential, it is also possible to define access rules using the --access-rules flag, which offers even more fine-grained access to various API endpoints. This is optional and up to the user to decide if such rules are needed.

Once the application credential is created, the values of id and secret need to be set as user macro values in Zabbix:

• value of id in {$APP.CRED.ID} user macro;
• value of secret in {$APP.CRED.SECRET} user macro.

At this point, the monitoring user will not be able to access any resources on OpenStack, therefore some access rights need to be defined. Access rights are set using policies. Each service has its own policy file, therefore further steps for setting up policies, are mentioned in the template documentation of each supported service, e.g., OpenStack Nova by HTTP.

Macros used

Items

LLD rule OpenStack: Nova discovery

Feedback

Please report any issues with the template at https://support.zabbix.com

You can also provide feedback, discuss the template, or ask for help at ZABBIX forums