New to Zabbix and trying to use this

[astrugatch]

Hi,

I'm relatively new to Zabbix so there is a good chance I'm missing something. We monitor most of our hosts via SNMP and don't have the agent installed (mostly because we are still in a testing phase and I don't want an agent left behind if we go another way).

So since we aren't using the agent, I would like to monitor SSL certs on some of the hosted sites via script instead.

I've put the script in /usr/local/bin and made it executable.

I've put the conf file in /etc/zabbix/zabbix_agentd.d

I've imported the basic example template.

But when I go to assign to a host it wants it to be an agent host rather than SNMP. Is the agent required or can I modify the template in some way to make this work in our scenario.

Thanks for your help in advance.

[astrugatch]

reading back over what I wrote and realizing that it obviously requires the agent. sigh. Back to the drawing board.

[selivan]

@astrugatch You can use the agent on Zabbix server itself, if it has access to hosts and ports that require TLS cert monitoring.

See the example in zabbix_integration_examples:

• template_ssl_advanced.xml - zabbix template
• userparameters_ssl_cert_discovery.conf - userparameters for monitoring agent
• ssl_cert_list.json - list of hosts, ports and domain names to monitor

[astrugatch]

OK. I think I'm 95% of the way there. I've got the JSON filled out and in place, the conf files in place, and the template imported and applied to the Zabbix host. But under discovery rules the status shows as Unsupported item key. instead of enabled.

[selivan]

@astrugatch Seems that zabbix agent didn't read userparameters from userparameters_ssl_cert_discovery.conf.

You should place that file somewhere in /etc/zabbix/zabbix_agentd.conf.d or /etc/zabbix/zabbix_agentd.d or whatever Include= directive in your /etc/zabbix/zabbix_agentd.conf says. Than you should restart zabbix agent.

You can check if userparameter became available by running sudo -u zabbix zabbix_agentd -t ssl_cert_list.
Running from root without sudo also works, but than you can miss problems like file premissions.

[astrugatch]

Thanks for your reply.
Without changing anything sudo -u zabbix zabbix_agentd -t ssl_cert_list returns my JSON.
/etc/zabbix/zabbix_agentd.d is the location set by Include=

Contents of /etc/zabbix/zabbix_agentd.d

zabbixadmin@zabbix:/etc/zabbix/zabbix_agentd.d$ ls
ssl_cert_list.json                  userparameters_ssl_cert_discovery.conf
userparameters_ssl_cert_check.conf

[astrugatch]

I see in another thread with a similar issue that someone moved the script int /etc/zabbix/zabbix_agentd.d as well. I'm assuming I would need to modify the conf files to match the script location.

[astrugatch]

moving the script worked.

Is the hostname variable in the json the server host name or the host name expected in the certificate? I'm having servers with a wildcard installed returning as invalid.

[astrugatch]

Disregard. It's a config issue. Missing an intermediate cert. Browsers don't seem to mind but openssl seems to care.

[selivan]

{#IPADDR} is network endpoint to connect to looking for certificate(DNS hostname or IP address), {#SSLDOMAIN} is hostname expected in the certificate.

Glad I could help.