need help with Zabbix server

Mike Davis

First let me say that I have very little experience with linux, so I'm probably missing something obvious. I built a Zabbix server on CentOS. It seemed to be working and I went through the initial web config. Then I went to configuration and Hosts and enabled the Zabbix server. As far as I remember everything was green in the dashboard, so I downloaded an agent, installed it on a Windows box and pointed it towards my Zabbix server. I went back to the dashboard and at the bottom it's saying "Zabbix server is not running: the information displayed may not be current."

I ran this to see if the zabbix service was running:

systemctl status zabbix-server -l

output
● zabbix-server.service - Zabbix Server
Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2016-10-20 05:03:48 UTC; 9h ago
Process: 1112 ExecStart=/usr/sbin/zabbix_server -c $CONFFILE (code=exited, status=0/SUCCESS)
Main PID: 1141 (zabbix_server)
CGroup: /system.slice/zabbix-server.service
└─1141 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf

Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: Starting Zabbix Server...
Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Oct 20 05:03:48 vny-lnx-zabbix systemd[1]: Started Zabbix Server.
Oct 20 05:08:58 vny-lnx-zabbix systemd[1]: Started Zabbix Server.

coliver

There should be a log file somewhere for Zabbix. @dafyre should know better. That would give you some more info toward the potential issue. What enforcement is SELinux set to? You can type getenforce to see.

hobbit666

Try disabling SELINUX and Firewalld/iptables

art_of_shred

/var/log/zabbix_agentd.log

It said 127.0.0.1 was refusing connection. I took that to mean that something was referencing the server by localhost IP. It uses the file: /etc/zabbix/zabbix_agentd.conf for that function, and all of the srver IP's in that file show 127.0.0.1, which seemed odd to me. Shouldn't it have the public IP in there somewhere?
Just my thoughts...

coliver

@art_of_shred said in need help with Zabbix server:

/var/log/zabbix_agentd.log

It said 127.0.0.1 was refusing connection. I took that to mean that something was referencing the server by localhost IP. It uses the file: /etc/zabbix/zabbix_agentd.conf for that function, and all of the srver IP's in that file show 127.0.0.1, which seemed odd to me. Shouldn't it have the public IP in there somewhere?
Just my thoughts...

From the little research I've done this looks like it could be related to SELinux. Try the following command.

sudo setsebool httpd_can_connect_zabbix 1

Mike Davis

from the /var/log/zabbix/zabbix_server.log file:
] Access denied for user 'zabbix'@'xx.xx.14.212' (using password: YES)
1141:20161020:143621.388 cannot set MySQL character set to "utf8"
1141:20161020:143621.388 database is down: reconnecting in 10 seconds

coliver

@Mike-Davis said in need help with Zabbix server:

from the /var/log/zabbix/zabbix_server.log file:
] Access denied for user 'zabbix'@'xx.xx.14.212' (using password: YES)
1141:20161020:143621.388 cannot set MySQL character set to "utf8"
1141:20161020:143621.388 database is down: reconnecting in 10 seconds

Ah, you need to grant either 'zabbix'@* or 'zabbix'@'xx.xx.14.212 permission to the mysql database.

GRANT ALL TO 'zabbix'@'xx.xx.14.212' IDENTIFIED BY 'yourpassword';

Or something similar to that.

Mike Davis

when I run:
sudo getenforce
it returns:
Disabled

Do I need to enable it so those rules apply?

The guide I was following said to run these commands:
sudo setsebool -P httpd_can_network_connect=1
sudo setsebool -P httpd_can_connect_zabbix=1
sudo setsebool -P zabbix_can_network=1

dafyre

Sorry been away in meetings recently...

@coliver is right about the GRANT command...

Is your mysql server on the same server as Zabbix or on a different one?

dafyre

@Mike-Davis said in need help with Zabbix server:

when I run:
sudo getenforce
it returns:
Disabled

Do I need to enable it so those rules apply?

The guide I was following said to run these commands:
sudo setsebool -P httpd_can_network_connect=1
sudo setsebool -P httpd_can_connect_zabbix=1
sudo setsebool -P zabbix_can_network=1

If SELinux id disabled, then those commands won't have any affect until you enable it again.

Mike Davis

coliver

@Mike-Davis said in need help with Zabbix server:

database on the same server. If I log in to the database, and run:
select user, host from mysql.user;
it returns:
MariaDB [(none)]> select user, host from mysql.user;
+--------+--------------------+
| user | host |
+--------+--------------------+
| zabbix | % |
| root | 127.0.0.1 |
| root | ::1 |
| root | localhost |
| zabbix | localhost |
| zabbix | xx.xx.14.212 |
+--------+--------------------+
6 rows in set (0.00 sec)

The user may exist but it may not have the granted permissions. You can run:

SHOW GRANTS FOR 'zabbix'@'xx.xx.14.212';

To see what that user has access to.

Mike Davis

I think we have a bingo.

ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212'

Mike Davis

Shouldn't this work:

GRANT ALL PRIVILEGES ON zabbix.* TO zabbix@xx.xx.14.212 IDENTIFIED BY 'mySecurePasswordHere';

coliver

@Mike-Davis said in need help with Zabbix server:

Shouldn't this work:

GRANT ALL PRIVILEGES ON zabbix.* TO zabbix@xx.xx.14.212 IDENTIFIED BY 'mySecurePasswordHere';

If the user already exists drop the IDENTIFIED BY part. But yes the syntax should work. Don't forget the single quotes around the username and IP address.

Mike Davis

When I run it, I get:
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> show grants for [email protected]; ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212'

Do the single quotes matter when running these commands?

Mike Davis

MariaDB [(none)]> show grants for [email protected];
ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212'
MariaDB [(none)]> show grants for zabbix
-> ;
+-------------------------------------------------------------------------------------------------------+
| Grants for zabbix@% |
+-------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON . TO 'zabbix'@'%' IDENTIFIED BY PASSWORD 'F7B59hashhereC9667D7D09DC' |
| GRANT ALL PRIVILEGES ON zabbix. TO 'zabbix'@'%' |
+-------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

Do I have too many zabbix users configured? Should I just have the one with the external host IP?

coliver

@Mike-Davis said in need help with Zabbix server:

MariaDB [(none)]> show grants for [email protected];
ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212'
MariaDB [(none)]> show grants for zabbix
-> ;
+-------------------------------------------------------------------------------------------------------+
| Grants for zabbix@% |
+-------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON . TO 'zabbix'@'%' IDENTIFIED BY PASSWORD 'F7B59hashhereC9667D7D09DC' |
| GRANT ALL PRIVILEGES ON zabbix. TO 'zabbix'@'%' |
+-------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

Do I have too many zabbix users configured? Should I just have the one with the external host IP?

I'm not sure, I don't think so I thought '%' was equivalent to local host.

travisdh1

@coliver said in need help with Zabbix server:

@Mike-Davis said in need help with Zabbix server:

MariaDB [(none)]> show grants for [email protected];
ERROR 1141 (42000): There is no such grant defined for user 'zabbix' on host 'xx.xx.14.212'
MariaDB [(none)]> show grants for zabbix
-> ;
+-------------------------------------------------------------------------------------------------------+
| Grants for zabbix@% |
+-------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON . TO 'zabbix'@'%' IDENTIFIED BY PASSWORD 'F7B59hashhereC9667D7D09DC' |
| GRANT ALL PRIVILEGES ON zabbix. TO 'zabbix'@'%' |
+-------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

Do I have too many zabbix users configured? Should I just have the one with the external host IP?

I'm not sure, I don't think so I thought '%' was equivalent to local host.

% is everything, like * would be in other places.

Mike Davis

@coliver I think % is the wildcard from what I read. Not good practice, but I was trying to get it working.