Chapter 7: Using Discovery for Automatic Creation

This chapter is going to be all about making sure that you as a Zabbix administrator are doing as little work as possible on host and item creation. We are going to learn how to perform (or perfect, maybe) automatic host creation. Check out the recipes featured here to see just what we are going to discover.

In this chapter, we will first learn how to set up Zabbix discovery with Zabbix agent and Simple Network Management Protocol (SNMP). We will then set up active agent autoregistration. Later, we will also cover the automatic creation of Windows performance counters and Java Managements Extension (JMX) items.

In this chapter, we will cover the following recipes:

• Setting up Zabbix agent discovery
• Setting up Zabbix SNMP discovery
• Working with active agent autoregistration
• Using the new Windows performance counter discovery
• Discovering JMX objects

Technical requirements

As this chapter is all about host and item discovery, besides our Zabbix server we will need one new Linux host and a Windows host. Both these hosts will need Zabbix agent 2 installed, but not configured just yet.

Furthermore, we are going to need our JMX host, as configured in Chapter 3, Setting Up Zabbix Monitoring, and a new host with SNMP set up. To learn more about setting up an SNMP-monitored host, check out the Working with SNMP monitoring recipe in Chapter 3, Setting Up Zabbix Monitoring.

Setting up Zabbix agent discovery

A lot of Zabbix administrators use Zabbix agent extensively and thus spend a lot of time creating Zabbix agent hosts by hand. Maybe they don't know how to set up Zabbix agent discovery, maybe they didn't have time to set it up yet, or maybe they just prefer it this way. If you are ready to get started with Zabbix agent discovery, in this recipe we will learn just how easy it is to set it up.

Getting ready

Besides our Zabbix server, in this chapter's introduction I mentioned that we will need two (empty) hosts with Zabbix agent 2 installed: one Windows host and one Linux host. If you don't know how to install Zabbix agent 2, check out Chapter 3, Setting Up Zabbix Monitoring, or see the Zabbix documentation at https://www.zabbix.com/documentation/current/en/manual/concepts/agent2.

Let's give the servers the following hostnames:

• lar-book-disc-lnx: For the Linux host (use Zabbix agent 2)
• lar-book-disc-win: For the Windows host (use Zabbix agent 2)

How to do it…

1. Let's get started by logging in to our lar-book-disc-lnx Linux host and editing the following file:

   vim /etc/zabbix/zabbix_agent2.conf

2. Now, make sure your Zabbix agent 2 configuration file contains at least the following line:

   Hostname=lar-book-disc-lnx

3. For your Windows Zabbix agent, it's important to do the same. Edit the following file:

   C:Program Filesabbix Agent 2zabbix_agent2.conf

4. Now, change the hostname by editing the following line:

   Hostname=lar-book-disc-win

5. Next up, in our Zabbix frontend, navigate to Configuration | Discovery, and on this page, we are going to create a rule with the following settings:

Figure 7.1 – Discovery rules page for Zabbix agent hosts

Important note

We are using an Update interval of 1 minute in this example. As this might take up a lot of resources on your server, make sure to adjust this value for your production environment. For example, 1 hour is a much better production value.

6. Click the blue Add button to move on.
7. After setting up the discovery rule, we will also need to set up an action to actually create the host with the right template. Navigate to Configuration | Actions | Discovery actions:

Figure 7.2 – Main-menu at Configuration | Actions

8. Here, we will click the Create action button in the top-right corner and fill out the next page with the following information:

Figure 7.3 – Create Discovery action page for Zabbix agent hosts

Tip

When creating Zabbix actions, it's important to keep the order of creation for Conditions in mind. The labels seen in the preceding screenshot will be added in order of creation. This means that it's easier to keep track of your Zabbix actions if you keep the order of creation the same for all actions.

9. Next up, click the Operations tab. This is where we will add the following:

Figure 7.4 – Create Discovery action | Operations page for Zabbix agent hosts

10. That's it for the Linux agent. Click the blue Add button, and let's continue to our Windows discovery rule.
11. Navigate to Configuration | Host groups. Create a host group for our Windows hosts by clicking Create host group in the top-right corner and filling out the group name:

Figure 7.5 – Create host group page for Windows server hosts

12. Click the blue Add button and navigate to Configuration | Actions.
13. Go to Discovery actions again and click Create action. We will fill out the same thing but for our Windows hosts this time:

Figure 7.6 – Create Discovery action page for Windows Zabbix agents

14. Before clicking Add, let's also fill out the Operations page with the Operations shown in the following screenshot:

Figure 7.7 – Create Discovery action Operations page for Windows Zabbix agents

15. Now, we can click the blue Add button, and our second discovery action is present.
16. Move on to Monitoring | Discovery. This is where we can see if and when our hosts are discovered:

Figure 7.8 – Monitoring | Discovery page

Tip

Use the Monitoring | Discovery page to keep a close eye on the hosts you expect to show up in your Zabbix setup. It's very useful to track new hosts coming in and see which Zabbix discovery rule was used to create the host.

How it works…

Network discovery might not be very hard to set up initially, but there are loads of options to configure. For this example, we made the choice to use the agent.hostname key as our check. We create the Zabbix hostname based on what's configured in the Zabbix agent config file.

What happens is that Zabbix network discovery finds our hosts and performs our check. In this case, the check is: What is the hostname used by the Zabbix agent? This information, plus our IP address, is then triggering the action. Our action then performs our configured checks:

• Does the hostname contain lnx or win?
• Is the discovery status UP?
• Is the service type Zabbix Agent?

If all of those checks are true, our action will then create our newly discovered host with the following:

• Our configured host group plus the default Discovered hosts host group
• Our template as configured in our action

We will end up with two newly created hosts, with all the right settings:

Figure 7.9 – Configuration | Hosts page with our new hosts, Windows and Linux

There's more…

Creating the host by using the configuration file settings isn't always the right way to go, but it's a solid start to working with network discovery.

If you want a more flexible environment where you don't have to even touch the Zabbix agent configuration file, then you might want to use different checks on the discovery rule. Check out which keys we can use to build different discovery rules in the Zabbix documentation at https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent.

Setting up Zabbix SNMP discovery

If you work with a lot of SNMP devices but don't always want to set up monitoring manually, network discovery is the way to go. Zabbix network discovery uses the same functionality as Zabbix agent discovery, but with a different configuration approach.

Getting ready

To get started with network discovery, we are going to need a host that we can monitor with SNMP. If you don't know how to set up a host such as this, check out the Working with SNMP monitoring recipe in Chapter 3, Setting Up Zabbix Monitoring. We'll also need our Zabbix server.

How to do it…

1. First, log in to your new SNMP-monitored host and change the hostname to the following:

   hostnamectl set-hostname lar-book-disc-snmp

2. Then, restart the SNMP daemon using the following command:

   exec bash

   systemctl restart snmpd

3. Now, navigate to Configuration | Discovery and click on Create discovery rule in the top-right corner.
4. We are going to create a new SNMP discovery rule, with an SNMP Object Identifier (OID) check type. Fill out the Name and IP range fields first, like this:

Figure 7.10 – Configuration | Discovery, discovery rule creation page for SNMPv2 agents

5. Make sure to fill out your own IP range in the IP range field.
6. Now, we are going to create our SNMP check. Click on Add next to Checks, and you'll see the following pop-up screen:

Figure 7.11 – Configuration | Discovery, discovery check creation pop-up window

7. We want our Check type to be SNMPv2 agent and we want to fill it with our community and a useful OID, which in this case will be the OID for the system name. Fill it out like this:

Figure 7.12 – Configuration | Discovery, discovery check creation pop-up window filled for SNMPv2 agents

Important note

Please note that our check type is not SNMP version-independent. We have three SNMP versions and thus three different check types to choose from, unlike with our new SNMP interface selection on the Zabbix 6 host screen.

8. After clicking Add again, fill out the rest of the page, as follows:

Figure 7.13 – Configuration | Discovery page for SNMPv2 agents

9. Last, but not least, click the Add button at the bottom of the page. This concludes creating our Zabbix discovery rule.
10. We will also need an action for creating our hosts from the discovery rule. Navigate to Configuration | Actions, and after using the dropdown to select Discovery actions, click on Create action.
11. We will fill out the page with the following information:

Figure 7.14 – Configuration | Actions, action creation page for SNMPv2 agents

12. Before clicking Add, navigate to Operations and fill out this page with the following details:

Figure 7.15 – Configuration | Actions, action creation Operations tab for SNMPv2 agents

13. Now, click Add and navigate to Monitoring | Discovery to see if our host gets created:

Figure 7.16 – Monitoring | Discovery page for SNMPv2 agents

How it works…

In this recipe, we've created another discovery rule, but this time for SNMP. As you've noticed, the principle remains the same, but the application is a bit different.

When we created this Zabbix discovery rule, we gave it two checks instead of the one check we did in the previous recipe. We created one check on SNMP OID .1.3.6.1.2.1.1.5.0 to retrieve the hostname of the device through SNMP. We then put the hostname retrieved from the system into Zabbix as the Zabbix hostname of the system.

We also created a check on SNMP OID .1.3.6.1.2.1.25.1.4.0. This check will retrieve the following string, if present:

"BOOT_IMAGE=(hd0,gpt2)/vmlinuz-4.18.0-193.6.3.el8_2.x86_64 root=/dev/mapper/cl-root ro crashkernel=auto resume=/dev/mapper/cl-swa"

If the string is present, it means that the boot image is Linux on this host. This is a perfect example of how we can retrieve multiple OIDs to do multiple checks in our Zabbix discovery rules. If we'd been monitoring a networking device, for instance, we could have picked an OID to see if it was a Cisco or a Juniper device. We would replace .1.3.6.1.2.1.25.1.4.0 with any OID and poll it. Then, we would create our action based on what we received (Juniper or Cisco) and add our templates accordingly.

Important note

General knowledge of SNMP structure is very important when creating Zabbix discovery rules. We want to make sure we use the right SNMP OIDs as checks. Make sure to do your research well, utilize SNMP walks, and plan out what OIDs you want to use to discover SNMP agents. This way, you'll end up with a solid monitoring infrastructure.

Working with active agent autoregistration

Using discovery to set up your Zabbix agents is a very useful method to automate your host creation. But what if we want to be even more upfront with our environment and automate further? That's when we use a Zabbix feature called active agent autoregistration.

Getting ready

For this recipe, we will need a new Linux host. We will call this host lar-book-lnx-agent-auto. Make sure to install the Zabbix agent 2 to this host. Besides this new host, we'll also need our Zabbix server.

How to do it…

1. Let's start by logging in to our new lar-book-lnx-agent-auto host and change the following file:

   vim /etc/zabbix/zabbix_agent2.conf

2. We will then edit the following line in the file. Make sure to enter your Zabbix server IP on this line:

   ServerActive=10.16.16.152

3. We can also change the following line in the file if we want to set our hostname in the file manually:

   Hostname=lar-book—lnx-agent-auto

This is not a requirement though, as Zabbix agent will use the system hostname if it is not filled out.

4. Next up, we will navigate to our Zabbix frontend, where we'll go to Configuration | Actions.
5. Use the drop-down menu to go to Autoregistration actions, as in the following screenshot:

Figure 7.17 – Configuration | Actions page drop-down menu

6. Now, we will click the blue Create action button in the top-right corner to create a new action.
7. Fill out Name and then click on the Add text link:

Figure 7.18 – Configuration | Actions, create new action page

8. We can set up a condition here to only register hosts with a certain hostname. Let's do this by filling out the window like this:

Figure 7.19 – Create action page, New condition window for host lar-book-lnx

Your page should now look like this:

Figure 7.20 – Create action page, filled with our information for host lar-book-lnx

Tip

We can set up conditions for different types of hosts. For instance, if we want to add Windows hosts, we set up a new action with a different hostname filter. This way, it is easy to maintain the right groups and templates, even with autoregistration.

9. Before clicking the blue Add button, let's go to the Operations tab.
10. Click on the Add text link, and you will see the following window:

Figure 7.21 – Create action operations page, new operation window, Send message for host lar-book-lnx

11. Create an action to add the host to the Linux servers host group:

Figure 7.22 – Create action operations page, new operation window, Add to host group, lar-book-lnx

12. Create an action to add the host to the Template OS Linux by Zabbix agent active template:

Figure 7.23 – Create action operations page, new operation window, Link to template, lar-book-lnx

13. Your finalized Operations page should now look like this, and we can click the blue Add button:

Figure 7.24 – Create action operations page, filled with our information, lar-book-lnx

14. Navigate to Configuration | Hosts, and we can see our new active autoregistered host:

Figure 7.25 – Configuration | Hosts page with host lar-book-lnx-agent-auto

How it works…

Active agent autoregistration is a solid method to let a host register itself. Once the ServerActive= line is set up with the Zabbix server IP, the host agent will start requesting configuration data from the Zabbix server. The Zabbix server will receive these requests, and if there is an action set up in Zabbix (as we just did in this recipe), the host autoregisters to Zabbix:

Figure 7.26 – Host autoregistration process

We can do a bunch of cool automations with this functionality. We could create a script to fill up our Zabbix agent configuration file with the right ServerActive= line on our hosts in a certain IP pool.

It would also be super-easy to set up new hosts with Ansible. We can automate the Zabbix agent installation with Ansible and we can add the ServerActive= line in the /etc/zabbix/zabbix_agent2.conf file using Ansible as well. Our Zabbix server autoregistration action will take care of the rest from here.

Zabbix agent autoregistration is a perfect way to get a zero-touch monitoring environment that's always up to date with our latest new hosts.

There's more…

Not every company uses hostnames that reflect the machine's OS or other attributes. This is when Zabbix HostMetadata can come in very useful. We can add this field to the active Zabbix agent configuration to reflect the attributes of the machine.

Afterward, we can use this HostMetadata in our Zabbix discovery action to do the same kind of filtering we did on the hostname.

We also have the HostInterface and HostInterfaceItem parameters in the Zabbix agent configuration file, which are used for autoregistration. The host will use the specified IP or DNS name as its Zabbix agent interface IP or DNS, as seen in the Zabbix frontend. We can also use this functionality to enable passive agent monitoring while using autoregistration to create the host.

Check out this link for more information:

https://www.zabbix.com/documentation/current/manual/discovery/auto_registration#using_host_metadata

Using the new Windows performance counter discovery

In Zabbix 6, it is possible to discover Windows performance counters. In this recipe, we will go over the process of discovering Windows performance counters to use in our environments.

Discovering Windows performance counters might seem to be a little tricky at first, as it uses both Windows- and Zabbix-specific concepts. But once we finish this recipe you'll know exactly how to set it up.

Getting ready

In this chapter, we added the lar-book-disc-win host to our setup, which is the host used in our Zabbix agent discovery process. We can reuse this host to discover Windows performance counters easily.

Of course, we'll also need our Zabbix server.

How to do it…

1. Let's start by navigating to Configuration | Templates and creating a new template by clicking Create template in the top-right corner.
2. Create the following template:

Figure 7.27 – Configuration | Templates, Create template page, Windows performance by Zabbix agent

3. Click on the blue Add button, which will bring you back to Configuration | Templates. Select the new template.
4. Now, before continuing with our template, navigate to your Windows frontend and open perfmon.exe:

Figure 7.28 – Windows search bar, perfmon.exe

5. This will open the following window:

Figure 7.29 – Windows perfmon.exe

6. Let's click on Performance Monitor and then on the green + icon. This will show you all the available Windows performance counters.
7. Let's start by using the Processor counter.
8. Go back to the Configuration | Template page in Zabbix and edit our new Template Module Windows performance by Zabbix agent template.
9. When you are at the Edit template page, click on Discovery rules in the bar next to your template name.
10. Click on Create new discovery rule in the top-right corner and add the following rule:

Figure 7.30 – Create Low-Level Discovery (LLD) rule page, Discover counter Processor

Important note

We are using an Update interval of 1 minute in this example. As this might take up a lot of resources on your server, make sure to adjust this value to your production environment. For example, 1 hour is a much better production value.

11. Click the blue Add button at the bottom and click our new Discover counter Processor discovery rule.
12. Click on Item prototypes, and in the top-right corner click on Create item prototype. We will then create the following item prototype:

Figure 7.31 – Create LLD item prototype page, CPU instance C1 time

13. On the Tags tab, do not forget to add some new tags as follows:

Figure 7.32 – Create LLD item prototype page tag tab, CPU instance C1 time

14. Save the new Item prototype, go to Configuration | Hosts, and click on lar-book-disc-win.
15. Add our Windows performance by Zabbix agent template:

Figure 7.33 – Create LLD item prototype page, add Templates for lar-book-disc-win

16. After clicking on the blue Update button, we can navigate to Monitoring | Latest data. Add the following filters:

Figure 7.34 – Latest data filter on host lar-book-disc-win

17. We can now see our three newly created items:

Figure 7.35 – Monitoring | Latest data page for our host lar-book-disc-win

How it works…

Windows performance counters have been around for a long time and they are very important to anyone who wants to monitor Windows machines with Zabbix. Using Low-Level Discovery (LLD) in combination with Windows performance counters makes it a lot easier and more flexible to build solid Windows monitoring.

In this recipe, we created a very simple but effective Windows performance counter discovery rule by adding the discovery rule with the perf_instance.discovery[Processor] item key. The [Processor] part of this item key directly correlates to the perfmon.exe window we saw. If we look at the following screenshot, we already see Processor listed:

Figure 7.36 – perfmon.exe | Add Counters, Processor

When our discovery rule polls this item key, Zabbix agent will return the following value for our host:

[{"{#INSTANCE}":"0"},{"{#INSTANCE}":"1"},{"{#INSTANCE}":"_Total"}]

This value means that Zabbix will fill the {#INSTANCE} macro with three values:

• 0
• 1
• _Total

We can then use these three values by using the {#INSTANCE} macro in our Item prototype, like we did here:

Figure 7.37 – Our created Item prototype, CPU C1 time

It will then create three items with our macro values, with the right keys to monitor the second part of our counter—% C1 time. If you expand the window in your perfmon.exe file, you can see all the different counters we could add to our item prototypes to monitor more Windows performance counters:

Figure 7.38 – Perfmon.exe | Add Counters, Processor expanded

Discovering JMX objects

In Chapter 3, Setting Up Zabbix Monitoring, we went over setting up JMX monitoring in the recipe titled Setting up JMX monitoring. What we didn't cover yet though was discovering JMX objects.

In this recipe, we will go over how to set up JMX objects with LLD, and after you've finished this recipe, you'll know just how to set it up.

Getting ready

For this recipe, we will need the JMX host that you set up for the Setting up JMX monitoring recipe in Chapter 3, Setting Up Zabbix Monitoring. Make sure to finish that recipe before working on this one.

We will also need our Zabbix server with our Zabbix JMX host titled lar-book-jmx.

How to do it…

1. Let's start this recipe off by logging in to our Zabbix frontend and navigating to Configuration | Templates.
2. Create a new template by clicking on Create template in the top-right corner. Fill in the following fields:

Figure 7.39 – Configuration | Templates, Create new template page, Apache Tomcat JMX discovery

3. After clicking the blue Add button, you will be taken back to Configuration | Templates. Click on your new Template App Apache Tomcat JMX discovery template.
4. We will now add our JMX discovery rule. Click on Discovery rules next to our template name.
5. Now, click on Create discovery rule and fill in the following fields:

Figure 7.40 – Configuration | Templates, create new template page, Discover JMX object MemoryPool

6. Click on the blue Add button at the bottom of the page. Then, click on Item prototypes next to your newly created Discover JMX object MemoryPool discovery rule.
7. We will now click on the Create item prototype button in the top-right corner and create the following item prototype:

Figure 7.41 – Item prototype creation page, MemoryPool Memory type

8. Also make sure that on the Tags tab you add a new tag as component | memory pool:

Figure 7.42 – Item prototype creation page tag tab, MemoryPool Memory type

9. Let's click on the blue Add button and move on.
10. Go to Configuration | Hosts and click on lar-book-jmx. We will add our template to this host.
11. Click on Templates and add the template, like this:

Figure 7.43 – Configuration | Hosts, add template to host lar-book-jmx

12. Click on the blue Update button.
13. When we navigate to Monitoring | Latest data now, we will filter on Hosts | lar-book-jmx and Tag | component with Value | memory pool, like this:

Figure 7.44 – Monitoring | Latest data page filters, host lar-book-jmx

14. We will then see the following results:

Figure 7.45 – Monitoring | Latest data page for host lar-book-jmx with our results

How it works…

Monitoring JMX applications can be quite daunting at first, as there is a lot of work to figure out while building your own LLD rules. But now that you've built your first LLD rule for JMX, there is a clear structure in it.

First, for our discovery rule, we've picked the item key:

jmx.discovery[beans,"*:type=MemoryPool,name=*"]

MemoryPool is what we call an MBean object in Java. We poll this MBean object for several JMX objects and fill the macros accordingly.

We picked the name=* object to fill the {#JMXNAME} macro in this discovery rule. Our macro is then used in our item prototype to create our items.

Our items are then created, like this:

Figure 7.46 – Items on our JMX-monitored host

If we look at the keys of the items, we can see that we poll the Type JMX attribute on every MemoryPool with different names.

That's how we create JMX LLD rules with ease.

There's more…

If you are not familiar with MBeans objects, then make sure to check out the Java documentation. This will explain to you a lot about what MBeans are and how they can be used for monitoring JMX attributes: https://docs.oracle.com/javase/tutorial/jmx/mbeans/index.html

Tip

Before diving deeper into using JMX object discovery, dive deeper into the preceding JMX object documentation. There's a lot of information in it and it will greatly improve your skills in creating these LLD rules.