dkirwan/infra-ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

Zabbix: Cleanup, defaults, and MGMT interface items

Browse source 
Fairly big commit, this does:
- Any host including zabbix_agent will now register iteself with the server
  This means we can drop auto-registration once it's tested
- Any host with a "bmc:" entry in host_vars will add items/triggers to monitor it
  This means we don't need separate "hosts" for the MGMT interfaces
- Reverted to a single base template
  The split ones were overkill, we can handle the builders with host macros
- Added defaults to the roles
  This lets us override the connection vars from host/group vars (useful for testing)
- Lint & minor cleanup

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
This commit is contained in:
Greg Sutcliffe 2025-07-18 12:01:07 +01:00
commit 75609617d3
Signed by: gwmngilfen
SSH key fingerprint: SHA256:dNHcz65ApR68w2TkCIAXDBdt4oNL62Fyx48U7dXWuk0
20 changed files with 6546 additions and 2175 deletions
Download patch file Download diff file Expand all files Collapse all files

2
playbooks/groups/zabbix.yml
View file

@ -21,7 +21,7 @@
- collectd/base
- sudo
- { role: zabbix/zabbix_server, tags: zabbix_server }
# - zabbix/zabbix_agent
- { role: zabbix/zabbix_agent, tags: zabbix_agent }
- { role: openvpn/client, when: env != "staging" }
pre_tasks:

14
roles/zabbix/zabbix_agent/defaults/main.yml
View file

@ -1,10 +1,22 @@
---
# Defaults variables for role zabbix-agent
zabbix_server: "zabbix01{{env_suffix}}.rdu3.fedoraproject.org"
zabbix_server: "{{ (env == 'staging') | ternary(zabbix_stg_hostname, zabbix_hostname) }}"
zabbix_agent_hostname: "{{ ansible_hostname }}"
zabbix_base_templates:
- Linux by Zabbix agent active
# TLS/PSK settings to encrypt between agent and proxy/server
zabbix_tls_connect: "psk"
zabbix_tls_accept: "psk"
zabbix_tls_psk_identity: "Fedora" # OVERRIDEME
zabbix_tls_psk_file: "/etc/zabbix/fedora.psk" # `openssl rand -hex 32` Overridden in ansible private repo
# Zabbix API params - these are used in API-call blocks, eg configure_api.yml
# We define them here with zabbix names, so we can easily override them when testing the role
zabbix_auth_key: "{{ (env == 'staging') | ternary(zabbix_stg_apikey, zabbix_apikey) }}" # ansible-private repo
zabbix_network_os: community.zabbix.zabbix
zabbix_connection: httpapi
zabbix_httpapi_port: 443
zabbix_httpapi_use_ssl: true
zabbix_httpapi_validate_certs: false
zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu

60
roles/zabbix/zabbix_agent/tasks/hosts.yml Normal file
View file

@ -0,0 +1,60 @@
---
# Any host which includes zabbix_agent should register itself
# and place itself in one of the basic hostgroups
# - Minimal Hosts
# - Linux Hosts
# Also physical hardware should be added to the management-monitoring group
# = MGMT Hosts
- name: API Block
vars:
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"
tags:
- zabbix_hosts
block:
# Create the host in Zabbix, assign to default templates
- name: Create self in Zabbix
community.zabbix.zabbix_host:
host_name: "{{ inventory_hostname }}"
host_groups:
- Linux servers
link_templates: "{{ zabbix_base_templates }}"
status: enabled
state: present
force: false
tags:
- zabbix_templates
# Most applications can add their own templates, but
# the MGMT interfaces are part of the host properties
# so we create an item on the host directly as required
# There's quite a few items for this, so we'll keep it tidy in a separate file
- name: Configure MGMT interface
ansible.builtin.include_tasks: mgmt_interfaces.yml
when: bmc is defined
tags:
- zabbix_host_mgmt
# This applies any host-level overrides to macro (variable) values in Zabbix.
# It's applied through the base agent role, but will work for the macros in
# *any* template, since unused macros will be ignored anyway.
- name: Set Host-level macros
delegate_to: "{{ zabbix_server }}"
loop: "{{ lookup('dict', zabbix_macros, wantlist=True) }}"
community.zabbix.zabbix_hostmacro:
host_name: "{{ inventory_hostname }}"
macro_name: "{{ item.key }}"
macro_value: "{{ item.value }}"
state: "{{ 'absent' if item.value == 'absent' else 'present' }}"
tags:
- zabbix_macros
- zabbix_templates

23
roles/zabbix/zabbix_agent/tasks/macros.yml
View file

@ -1,23 +0,0 @@
---
# This applies any host-level overrides to macro (variable) values in Zabbix.
# It's applied through the base agent role, but will work for the macros in
# *any* template, since unused macros will be ignored anyway.
- name: Set Host-level macros
loop: "{{ lookup('dict', zabbix_macros, wantlist=True) }}"
vars:
ansible_zabbix_auth_key: "{{ (env == 'staging') | ternary(zabbix_stg_apikey, zabbix_apikey) }}"
ansible_network_os: community.zabbix.zabbix
ansible_connection: httpapi
ansible_httpapi_port: 443
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_host: "{{ (env == 'staging') | ternary(zabbix_stg_hostname, zabbix_hostname) }}"
ansible_zabbix_url_path: ""
community.zabbix.zabbix_hostmacro:
host_name: "{{ inventory_hostname }}"
macro_name: "{{ item.key }}"
macro_value: "{{ item.value }}"
state: "{{ 'absent' if item.value == 'absent' else 'present' }}"
tags:
- zabbix_macros

24
roles/zabbix/zabbix_agent/tasks/main.yml
View file

@ -1,6 +1,6 @@
---
- name: Importing specific distro variables
include_vars: "{{ item }}"
ansible.builtin.include_vars: "{{ item }}"
with_first_found:
- "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
- "{{ ansible_distribution }}.yml"
@ -9,7 +9,7 @@
- zabbix_agent
- name: Installing Zabbix packages
yum:
ansible.builtin.dnf:
name: "{{ zabbix_pkgs_list }}"
state: latest
register: pkg_install
@ -17,7 +17,7 @@
- zabbix_agent
- name: Installing selinux dependency packages
yum:
ansible.builtin.dnf:
name: "{{ pkgs_list }}"
state: installed
tags:
@ -35,13 +35,13 @@
- zabbix_agent
- name: Reload custom selinux files
ansible.builtin.shell: /usr/sbin/semodule -u "/etc/selinux/centos/centos-zabbix-agent.pp"
ansible.builtin.command: /usr/sbin/semodule -u "/etc/selinux/centos/centos-zabbix-agent.pp"
when: ansible_distribution == "Centos" and ansible_selinux.status == "enabled" and sepolicy.changed
tags:
- zabbix_agent
- name: Allowing zabbix to connect to network resources
seboolean:
ansible.posix.seboolean:
name: zabbix_can_network
persistent: yes
state: yes
@ -53,6 +53,9 @@
ansible.builtin.file:
path: "{{ zabbix_agentd_dir }}"
state: directory
mode: '0755'
owner: zabbix
group: zabbix
tags:
- zabbix_agent
@ -60,6 +63,9 @@
ansible.builtin.template:
src: zabbix_agentd.conf.j2
dest: "{{ zabbix_agentd }}"
mode: '0755'
owner: zabbix
group: zabbix
notify: Restart zabbix agent
tags:
- zabbix_agent
@ -72,7 +78,7 @@
group: zabbix
mode: "0600"
with_fileglob:
- "{{ private }}/files/zabbix/fedora{{env_suffix}}.psk"
- "{{ private }}/files/zabbix/fedora{{ env_suffix }}.psk"
tags:
- zabbix_agent
@ -121,7 +127,7 @@
- name: Configure Zabbix tools
ansible.builtin.include_tasks: tools.yml
- name: Configure Zabbix macros / variables
ansible.builtin.include_tasks: macros.yml
- name: Configure Zabbix hosts
ansible.builtin.include_tasks: hosts.yml
tags:
- zabbix_macros
- zabbix_hosts

119
roles/zabbix/zabbix_agent/tasks/mgmt_interfaces.yml Normal file
View file

@ -0,0 +1,119 @@
---
- name: API Block
vars:
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"
tags:
- zabbix_host_mgmt
block:
- name: Create MGMT ping check
community.zabbix.zabbix_item:
name: "MGMT by ICMP Ping"
host_name: "{{ inventory_hostname }}"
params:
type: simple_check
key: "icmpping[{{ bmc['ip_address'] }}]"
value_type: numeric_unsigned
interval: "1m"
tags:
- tag: mgmt
value: ping
state: "{{ 'present' if (bmc['ping']) else 'absent' }}"
tags:
- zabbix_hostitems
- name: Create MGMT ping trigger
community.zabbix.zabbix_trigger:
name: "MGMT: Chassis unreachable by ICMP ping"
host_name: "{{ inventory_hostname }}"
params:
severity: high
expression: "max(/{{ inventory_hostname }}/icmpping[{{ bmc['ip_address'] }}],5m)=0"
recovery_mode: recovery_expression
recovery_expression: "last(/{{ inventory_hostname }}/icmpping[{{ bmc['ip_address'] }}])=1"
comments: "MGMT has been unreachable via ICMP ping for 5 minutes"
manual_close: true
enabled: true
tags:
- tag: mgmt
value: ping
state: "{{ 'present' if (bmc['ping']) else 'absent' }}"
tags:
- zabbix_hostitems
- name: Create MGMT HTTP check
community.zabbix.zabbix_item:
name: "MGMT by HTTP"
host_name: "{{ inventory_hostname }}"
params:
type: simple_check
key: "net.tcp.service[http, {{ bmc['ip_address'] }}, 80]"
value_type: numeric_unsigned
interval: "1m"
tags:
- tag: mgmt
value: http
state: "{{ 'present' if (bmc['http']) else 'absent' }}"
tags:
- zabbix_hostitems
- name: Create MGMT HTTP trigger
community.zabbix.zabbix_trigger:
name: "MGMT: Chassis unreachable by HTTP"
host_name: "{{ inventory_hostname }}"
params:
severity: high
expression: "max(/{{ inventory_hostname }}/net.tcp.service[http, {{ bmc['ip_address'] }}, 80],5m)=0"
recovery_mode: recovery_expression
recovery_expression: "last(/{{ inventory_hostname }}/net.tcp.service[http, {{ bmc['ip_address'] }}, 80])=1"
comments: "MGMT has been unreachable via HTTP for 5 minutes"
manual_close: true
enabled: true
tags:
- tag: mgmt
value: ping
state: "{{ 'present' if (bmc['http']) else 'absent' }}"
tags:
- zabbix_hostitems
- name: Create MGMT HTTPS check
community.zabbix.zabbix_item:
name: "MGMT by HTTPS"
host_name: "{{ inventory_hostname }}"
params:
type: simple_check
key: "net.tcp.service[https, {{ bmc['ip_address'] }}, 443]"
value_type: numeric_unsigned
interval: "1m"
tags:
- tag: mgmt
value: https
state: "{{ 'present' if (bmc['https']) else 'absent' }}"
tags:
- zabbix_hostitems
- name: Create MGMT HTTPS trigger
community.zabbix.zabbix_trigger:
name: "MGMT: Chassis unreachable by HTTPS"
host_name: "{{ inventory_hostname }}"
params:
severity: high
expression: "max(/{{ inventory_hostname }}/net.tcp.service[https, {{ bmc['ip_address'] }}, 443],5m)=0"
recovery_mode: recovery_expression
recovery_expression: "last(/{{ inventory_hostname }}/net.tcp.service[https, {{ bmc['ip_address'] }}, 443])=1"
comments: "MGMT has been unreachable via HTTPS for 5 minutes"
manual_close: true
enabled: true
tags:
- tag: mgmt
value: ping
state: "{{ 'present' if (bmc['https']) else 'absent' }}"
tags:
- zabbix_hostitems

2
roles/zabbix/zabbix_agent/tasks/tools.yml
View file

@ -12,7 +12,7 @@
- zabbix-check-ro.sh
- name: Ensuring we have some cron jobs for zabbix-sender wrapper scripts
cron:
ansible.builtin.cron:
name: "Zabbix sender wrapper script {{ item }}"
minute: "*/30"
job: "/usr/lib/zabbix/{{ item }}"

14
roles/zabbix/zabbix_server/defaults/main.yml
View file

@ -22,3 +22,17 @@ zabbix_server_pkgs:
- python3-psycopg2
- nmap
- php-openssl
# Zabbix API params - these are used in API-call blocks, eg configure_api.yml
# We define them here with zabbix names, so we can easily override them when testing the role
zabbix_server: "{{ (env == 'staging') | ternary(zabbix_stg_hostname, zabbix_hostname) }}"
zabbix_auth_key: "{{ (env == 'staging') | ternary(zabbix_stg_apikey, zabbix_apikey) }}" # ansible-private repo
zabbix_network_os: community.zabbix.zabbix
zabbix_connection: httpapi
zabbix_httpapi_port: 443
zabbix_httpapi_use_ssl: true
zabbix_httpapi_validate_certs: false
zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu
# Target Matrix server for the notifications
zabbix_matrix_server: https://fedora.ems.host

2208
roles/zabbix/zabbix_server/files/templates/linux-by-zabbix-agent-active.yml Normal file
View file

File diff suppressed because it is too large Load diff

1711
roles/zabbix/zabbix_server/files/templates/linux_autoregister.yaml
View file

File diff suppressed because it is too large Load diff

354
roles/zabbix/zabbix_server/files/templates/linux_hosts.yaml
View file

@ -1,354 +0,0 @@
zabbix_export:
version: '7.0'
template_groups:
- uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec
name: Fedora
templates:
- uuid: 28d6d64b3a5041b7a5d2d166b26f25a8
template: 'Linux Hosts'
name: 'Linux Hosts'
description: 'Builds upon "Linux Autoregistration" to enable the remaining triggers / prototypes for non-Koji hosts'
templates:
- name: 'Linux Autoregistration'
groups:
- name: Fedora
discovery_rules:
- uuid: 34e769e2da244b338e7d3b1126e6bcc1
name: 'Block devices discovery'
type: ZABBIX_ACTIVE
key: vfs.dev.discovery
delay: 1h
filter:
evaltype: AND
conditions:
- macro: '{#DEVNAME}'
value: '{$VFS.DEV.DEVNAME.MATCHES}'
formulaid: A
- macro: '{#DEVNAME}'
value: '{$VFS.DEV.DEVNAME.NOT_MATCHES}'
operator: NOT_MATCHES_REGEX
formulaid: B
- macro: '{#DEVTYPE}'
value: disk
formulaid: C
lifetime: 30d
enabled_lifetime_type: DISABLE_NEVER
item_prototypes:
- uuid: 9a0448cf8a184d52a7872df410f25d6c
name: '{#DEVNAME}: Disk average queue size (avgqu-sz)'
type: DEPENDENT
key: 'vfs.dev.queue_size[{#DEVNAME}]'
delay: '0'
history: 7d
value_type: FLOAT
description: 'The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.'
preprocessing:
- type: JSONPATH
parameters:
- '$[10]'
- type: CHANGE_PER_SECOND
parameters:
- ''
- type: MULTIPLIER
parameters:
- '0.001'
master_item:
key: 'vfs.file.contents[/sys/block/{#DEVNAME}/stat]'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: 1b3559f0d90948f0a72c2fdfdc80930c
name: '{#DEVNAME}: Disk read request avg waiting time (r_await)'
type: CALCULATED
key: 'vfs.dev.read.await[{#DEVNAME}]'
history: 7d
value_type: FLOAT
units: '!ms'
params: '(last(//vfs.dev.read.time.rate[{#DEVNAME}])/(last(//vfs.dev.read.rate[{#DEVNAME}])+(last(//vfs.dev.read.rate[{#DEVNAME}])=0)))*1000*(last(//vfs.dev.read.rate[{#DEVNAME}]) > 0)'
description: 'This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: 3bb5f84b2e954c28843fa1fb3898c035
name: '{#DEVNAME}: Disk read rate'
type: DEPENDENT
key: 'vfs.dev.read.rate[{#DEVNAME}]'
delay: '0'
history: 7d
value_type: FLOAT
units: '!r/s'
description: 'r/s (read operations per second) - the number (after merges) of read requests completed per second for the device.'
preprocessing:
- type: JSONPATH
parameters:
- '$[0]'
- type: CHANGE_PER_SECOND
parameters:
- ''
master_item:
key: 'vfs.file.contents[/sys/block/{#DEVNAME}/stat]'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: df02934521b54864b2538b764c5d549c
name: '{#DEVNAME}: Disk read time (rate)'
type: DEPENDENT
key: 'vfs.dev.read.time.rate[{#DEVNAME}]'
delay: '0'
history: 7d
value_type: FLOAT
description: 'The rate of total read time counter; used in `r_await` calculation.'
preprocessing:
- type: JSONPATH
parameters:
- '$[3]'
- type: CHANGE_PER_SECOND
parameters:
- ''
- type: MULTIPLIER
parameters:
- '0.001'
master_item:
key: 'vfs.file.contents[/sys/block/{#DEVNAME}/stat]'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: 72546bd5eefb4ac7a0b2992a25e5f0c6
name: '{#DEVNAME}: Disk utilization'
type: DEPENDENT
key: 'vfs.dev.util[{#DEVNAME}]'
delay: '0'
history: 7d
value_type: FLOAT
units: '%'
description: 'This item is the percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests.'
preprocessing:
- type: JSONPATH
parameters:
- '$[9]'
- type: CHANGE_PER_SECOND
parameters:
- ''
- type: MULTIPLIER
parameters:
- '0.1'
master_item:
key: 'vfs.file.contents[/sys/block/{#DEVNAME}/stat]'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: 8422c37735774134996be62580e7bf10
name: '{#DEVNAME}: Disk write request avg waiting time (w_await)'
type: CALCULATED
key: 'vfs.dev.write.await[{#DEVNAME}]'
history: 7d
value_type: FLOAT
units: '!ms'
params: '(last(//vfs.dev.write.time.rate[{#DEVNAME}])/(last(//vfs.dev.write.rate[{#DEVNAME}])+(last(//vfs.dev.write.rate[{#DEVNAME}])=0)))*1000*(last(//vfs.dev.write.rate[{#DEVNAME}]) > 0)'
description: 'This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: 4ba78909402d4bb8ab32f12c679ea3dc
name: '{#DEVNAME}: Disk write rate'
type: DEPENDENT
key: 'vfs.dev.write.rate[{#DEVNAME}]'
delay: '0'
history: 7d
value_type: FLOAT
units: '!w/s'
description: 'w/s (write operations per second) - the number (after merges) of write requests completed per second for the device.'
preprocessing:
- type: JSONPATH
parameters:
- '$[4]'
- type: CHANGE_PER_SECOND
parameters:
- ''
master_item:
key: 'vfs.file.contents[/sys/block/{#DEVNAME}/stat]'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: 7717dd9841004fa08b35b0e9f42bffae
name: '{#DEVNAME}: Disk write time (rate)'
type: DEPENDENT
key: 'vfs.dev.write.time.rate[{#DEVNAME}]'
delay: '0'
history: 7d
value_type: FLOAT
description: 'The rate of total write time counter; used in `w_await` calculation.'
preprocessing:
- type: JSONPATH
parameters:
- '$[7]'
- type: CHANGE_PER_SECOND
parameters:
- ''
- type: MULTIPLIER
parameters:
- '0.001'
master_item:
key: 'vfs.file.contents[/sys/block/{#DEVNAME}/stat]'
tags:
- tag: component
value: storage
- tag: disk
value: '{#DEVNAME}'
- uuid: 39877664726f4886aa88f3d1592bbcb2
name: '{#DEVNAME}: Get stats'
type: ZABBIX_ACTIVE
key: 'vfs.file.contents[/sys/block/{#DEVNAME}/stat]'
history: '0'
value_type: TEXT
trends: '0'
description: 'The contents of get `/sys/block/{#DEVNAME}/stat` to get the disk statistics.'
preprocessing:
- type: JAVASCRIPT
parameters:
- 'return JSON.stringify(value.trim().split(/ +/));'
tags:
- tag: component
value: raw
trigger_prototypes:
- uuid: e7d0c8f816de481b8790709b24c44c81
expression: 'min(/Linux Hosts/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux Hosts/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}'
name: '{#DEVNAME}: Disk read/write request responses are too high'
event_name: '{#DEVNAME}: Disk read/write request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} ms for 15m or write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} ms for 15m)'
priority: WARNING
description: 'This trigger might indicate the disk {#DEVNAME} saturation.'
manual_close: 'YES'
tags:
- tag: scope
value: performance
graph_prototypes:
- uuid: feca6a365b8d49d2a66ff4bfac089fc9
name: '{#DEVNAME}: Disk average waiting time'
graph_items:
- color: 199C0D
item:
host: 'Linux Hosts'
key: 'vfs.dev.read.await[{#DEVNAME}]'
- sortorder: '1'
drawtype: GRADIENT_LINE
color: F63100
item:
host: 'Linux Hosts'
key: 'vfs.dev.write.await[{#DEVNAME}]'
- uuid: b136583f822a4d48a52a17f4bb0d07d8
name: '{#DEVNAME}: Disk read/write rates'
graph_items:
- color: 199C0D
item:
host: 'Linux Hosts'
key: 'vfs.dev.read.rate[{#DEVNAME}]'
- sortorder: '1'
drawtype: GRADIENT_LINE
color: F63100
item:
host: 'Linux Hosts'
key: 'vfs.dev.write.rate[{#DEVNAME}]'
- uuid: 8863772fb82b49a891ea50cbec5cdd06
name: '{#DEVNAME}: Disk utilization and queue'
graph_items:
- color: 199C0D
yaxisside: RIGHT
item:
host: 'Linux Hosts'
key: 'vfs.dev.queue_size[{#DEVNAME}]'
- sortorder: '1'
drawtype: GRADIENT_LINE
color: F63100
item:
host: 'Linux Hosts'
key: 'vfs.dev.util[{#DEVNAME}]'
preprocessing:
- type: DISCARD_UNCHANGED_HEARTBEAT
parameters:
- 1h
triggers:
- uuid: cd709f79294341b4ad24213adc2cbfd5
expression: 'min(/Linux Hosts/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
name: 'Linux: High CPU utilization'
event_name: 'Linux: High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)'
opdata: 'Current utilization: {ITEM.LASTVALUE1}'
priority: WARNING
description: 'The CPU utilization is too high. The system might be slow to respond.'
dependencies:
- name: 'Linux: Load average is too high'
expression: |
min(/Linux Hosts/system.cpu.load[all,avg1],5m)/last(/Linux Hosts/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN}
and last(/Linux Hosts/system.cpu.load[all,avg5])>0
and last(/Linux Hosts/system.cpu.load[all,avg15])>0
tags:
- tag: scope
value: performance
- uuid: d3e1eaa726cc4ab8b2dcadae64a0fd55
expression: 'min(/Linux Hosts/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX}'
name: 'Linux: High memory utilization'
event_name: 'Linux: High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)'
priority: AVERAGE
description: 'The system is running out of free memory.'
dependencies:
- name: 'Linux: Lack of available memory'
expression: 'max(/Linux Hosts/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux Hosts/vm.memory.size[total])>0'
tags:
- tag: scope
value: capacity
- tag: scope
value: performance
- uuid: 61ce552ec3774a01b89de3edce1d00ae
expression: 'max(/Linux Hosts/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux Hosts/system.swap.size[,total])>0'
name: 'Linux: High swap space usage'
event_name: 'Linux: High swap space usage (less than {$SWAP.PFREE.MIN.WARN}% free)'
opdata: 'Free: {ITEM.LASTVALUE1}, total: {ITEM.LASTVALUE2}'
priority: WARNING
description: 'If there is no swap configured, this trigger is ignored.'
dependencies:
- name: 'Linux: High memory utilization'
expression: 'min(/Linux Hosts/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX}'
- name: 'Linux: Lack of available memory'
expression: 'max(/Linux Hosts/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux Hosts/vm.memory.size[total])>0'
tags:
- tag: scope
value: capacity
- uuid: 6e638060373b44398dd22b01564bc326
expression: 'max(/Linux Hosts/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux Hosts/vm.memory.size[total])>0'
name: 'Linux: Lack of available memory'
event_name: 'Linux: Lack of available memory (<{$MEMORY.AVAILABLE.MIN} of {ITEM.VALUE2})'
opdata: 'Available: {ITEM.LASTVALUE1}, total: {ITEM.LASTVALUE2}'
priority: AVERAGE
tags:
- tag: scope
value: capacity
- tag: scope
value: performance
- uuid: cebd3b42cd2042b8a76eac570ce70b4c
expression: |
min(/Linux Hosts/system.cpu.load[all,avg1],5m)/last(/Linux Hosts/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN}
and last(/Linux Hosts/system.cpu.load[all,avg5])>0
and last(/Linux Hosts/system.cpu.load[all,avg15])>0
name: 'Linux: Load average is too high'
event_name: 'Linux: Load average is too high (per CPU load over {$LOAD_AVG_PER_CPU.MAX.WARN} for 5m)'
opdata: 'Load averages(1m 5m 15m): ({ITEM.LASTVALUE1} {ITEM.LASTVALUE3} {ITEM.LASTVALUE4}), # of CPUs: {ITEM.LASTVALUE2}'
priority: AVERAGE
description: 'The load average per CPU is too high. The system may be slow to respond.'
tags:
- tag: scope
value: capacity
- tag: scope
value: performance

177
roles/zabbix/zabbix_server/files/templates/zabbix-agent-active.yml Normal file
View file

@ -0,0 +1,177 @@
zabbix_export:
version: '7.0'
template_groups:
- uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec
name: Fedora
templates:
- uuid: 650bec3f2f364a478b82317396949459
template: 'Zabbix agent active'
name: 'Zabbix agent active'
description: |
Use this template instead of 'Zabbix agent' for agents running in active mode only.
Generated by official Zabbix template tool "Templator"
vendor:
name: Zabbix
version: 7.0-0
groups:
- name: Fedora
items:
- uuid: ca27c17d8ca34643a7db8b99d2cc3025
name: 'Host name of Zabbix agent running'
type: ZABBIX_ACTIVE
key: agent.hostname
delay: 1h
value_type: CHAR
trends: '0'
preprocessing:
- type: DISCARD_UNCHANGED_HEARTBEAT
parameters:
- 1d
tags:
- tag: component
value: system
- uuid: 0f86ec6cde2249f7946c678f9fd2665a
name: 'Zabbix agent ping'
type: ZABBIX_ACTIVE
key: agent.ping
description: 'The agent always returns "1" for this item. May be used in combination with `nodata()` for the availability check.'
valuemap:
name: 'Zabbix agent ping status'
tags:
- tag: component
value: system
triggers:
- uuid: 6bbb74c522d44baea8c6ceb666423da2
expression: 'nodata(/Zabbix agent active/agent.ping,{$AGENT.NODATA_TIMEOUT})=1'
name: 'Zabbix agent is not available'
event_name: 'Zabbix agent is not available (or nodata for {$AGENT.NODATA_TIMEOUT})'
priority: AVERAGE
description: 'For active agents, `nodata()` with `agent.ping` is used with `{$AGENT.NODATA_TIMEOUT}` as a time threshold.'
manual_close: 'YES'
tags:
- tag: scope
value: availability
- uuid: 41fb0f76fa1d464f8ab67f744fc29e8b
name: 'Version of Zabbix agent running'
type: ZABBIX_ACTIVE
key: agent.version
delay: 1h
value_type: CHAR
trends: '0'
preprocessing:
- type: DISCARD_UNCHANGED_HEARTBEAT
parameters:
- 1d
tags:
- tag: component
value: application
- uuid: 0fd83c56dce244738607cd6585a6acb3
name: 'Active agent availability'
type: INTERNAL
key: 'zabbix[host,active_agent,available]'
description: |
Availability of active checks on the host. The value of this item corresponds to availability icons in the host list.
Possible values:
0 - unknown
1 - available
2 - not available
valuemap:
name: zabbix.host.active_agent.available
tags:
- tag: component
value: health
- tag: component
value: network
triggers:
- uuid: e91c556b0ff64292b9b9b5709a5d74b3
expression: 'min(/Zabbix agent active/zabbix[host,active_agent,available],{$AGENT.TIMEOUT})=2'
name: 'Active checks are not available'
opdata: 'Current state: {ITEM.LASTVALUE1}'
priority: HIGH
description: 'Active checks are considered unavailable. Agent has not sent a heartbeat for a prolonged time.'
tags:
- tag: scope
value: availability
tags:
- tag: class
value: software
- tag: target
value: zabbix-agent
macros:
- macro: '{$AGENT.NODATA_TIMEOUT}'
value: 30m
description: 'No data timeout for active agents. Consider to keep it relatively high.'
- macro: '{$AGENT.TIMEOUT}'
value: 5m
description: 'Timeout after which agent is considered unavailable.'
dashboards:
- uuid: 27dea14380314e67906525ad3d2a995a
name: 'Zabbix agent active: Overview'
pages:
- name: Main
widgets:
- type: item
name: 'Agent availability'
width: '18'
height: '3'
fields:
- type: ITEM
name: itemid.0
value:
host: 'Zabbix agent active'
key: agent.ping
- type: INTEGER
name: show.0
value: '4'
- type: INTEGER
name: show.1
value: '2'
- type: item
name: Version
x: '18'
width: '18'
height: '3'
fields:
- type: ITEM
name: itemid.0
value:
host: 'Zabbix agent active'
key: agent.version
- type: INTEGER
name: show.0
value: '4'
- type: INTEGER
name: show.1
value: '2'
- type: graph
x: '36'
width: '36'
height: '5'
fields:
- type: ITEM
name: itemid.0
value:
host: 'Zabbix agent active'
key: agent.ping
- type: STRING
name: reference
value: AAAAA
- type: INTEGER
name: source_type
value: '1'
valuemaps:
- uuid: 9f93aabb08794395b1c62cf784fc58c3
name: zabbix.host.active_agent.available
mappings:
- value: '0'
newvalue: unknown
- value: '1'
newvalue: available
- value: '2'
newvalue: 'not available'
- uuid: 9bf3eef7e8d8402ca6f826b377ea2db6
name: 'Zabbix agent ping status'
mappings:
- value: '1'
newvalue: Up

3882
roles/zabbix/zabbix_server/files/templates/zabbix-server-health-by-zabbix-agent-active.yml Normal file
View file

File diff suppressed because it is too large Load diff

35
roles/zabbix/zabbix_server/tasks/configure_api.yml
View file

@ -5,30 +5,23 @@
# Use a block so we can specify the connection vars once
- name: API Block
vars:
ansible_zabbix_auth_key: "{{ (env == 'staging') | ternary(zabbix_stg_apikey, zabbix_apikey) }}"
ansible_network_os: community.zabbix.zabbix
ansible_connection: httpapi
ansible_httpapi_port: 443
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_host: "{{ (env == 'staging') | ternary(zabbix_stg_hostname, zabbix_hostname) }}"
ansible_zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"
tags:
- zabbix_configuration
block:
# Templates seem to always report a change :/
- name: Import Base Auto-registration template
- name: Import all template files
community.zabbix.zabbix_template:
template_yaml: "{{ lookup('ansible.builtin.file', 'templates/linux_autoregister.yaml') }}"
state: present
tags:
- zabbix_templates
# Templates seem to always report a change :/
- name: Import dependant Linux Host template
community.zabbix.zabbix_template:
template_yaml: "{{ lookup('ansible.builtin.file', 'templates/linux_hosts.yaml') }}"
template_yaml: "{{ lookup('ansible.builtin.file', item) }}"
state: present
loop: "{{ query('ansible.builtin.fileglob', 'templates/*.yml') }}"
tags:
- zabbix_templates
@ -77,7 +70,7 @@
idp_entityid: "https://id{{ env_suffix }}.fedoraproject.org/saml2/metadata"
sso_url: "https://id{{ env_suffix }}.fedoraproject.org/saml2/SSO/Redirect"
username_attribute: preferred_username
sp_entityid: "https://{{ (env == 'staging') | ternary(zabbix_stg_hostname, zabbix_hostname) }}"
sp_entityid: "https://{{ zabbix_server }}"
nameid_format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
group_name: groups
provision_groups:
@ -139,7 +132,7 @@
- name: event_severity
value: "{EVENT.NSEVERITY}"
- name: event_url
value: "https://{{ (env == 'staging') | ternary(zabbix_stg_hostname, zabbix_hostname) }}/tr_events.php?triggerid={TRIGGER.ID}&eventid={EVENT.ID}"
value: "https://{{ zabbix_server }}/tr_events.php?triggerid={TRIGGER.ID}&eventid={EVENT.ID}"
- name: http_proxy
value: ""
- name: matrix_room
@ -147,7 +140,7 @@
- name: matrix_token
value: "{{ (env == 'staging') | ternary(zabbix_stg_matrix_token, zabbix_matrix_token) }}"
- name: matrix_url
value: "https://fedora.ems.host"
value: "{{ zabbix_matrix_server }}"
message_templates:
- subject: "{EVENT.NAME} ({EVENT.ID})"
body: "Severity: {EVENT.SEVERITY} started at {EVENT.DATE} {EVENT.TIME} on {HOST.NAME}"

22
roles/zabbix/zabbix_server/tasks/create_keytab.yml
View file

@ -1,22 +0,0 @@
---
- name: Create the zabbix keytab path
ansible.builtin.file:
path: "/etc/openshift_apps/zabbix/"
state: directory
owner: root
group: root
mode: "0750"
tags:
- create-keytab
- name: Acquire a keytab
include_role:
name: keytab/service
vars:
kt_location:
"/etc/openshift_apps/zabbix/zabbix_server.kt"
service: "zabbix"
host: "{{ (env == 'staging')|ternary(zabbix_stg_hostname, zabbix_hostname) }}"
tags:
- create-keytab

10
roles/zabbix/zabbix_templates/defaults/main.yml
View file

@ -1 +1,11 @@
---
# Zabbix API params - these are used in API-call blocks, eg configure_api.yml
# We define them here with zabbix names, so we can easily override them when testing the role
zabbix_server: "{{ (env == 'staging') | ternary(zabbix_stg_hostname, zabbix_hostname) }}"
zabbix_auth_key: "{{ (env == 'staging') | ternary(zabbix_stg_apikey, zabbix_apikey) }}"
zabbix_network_os: community.zabbix.zabbix
zabbix_connection: httpapi
zabbix_httpapi_port: 443
zabbix_httpapi_use_ssl: true
zabbix_httpapi_validate_certs: false
zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu

16
roles/zabbix/zabbix_templates/tasks/add_hosts_to_hostgroups.yml
View file

@ -11,11 +11,11 @@
- zabbix_add_hosts_to_hostgroups
- zabbix_templates
vars:
ansible_zabbix_auth_key: "{{ (env == 'staging')|ternary(zabbix_stg_apikey, zabbix_apikey) }}"
ansible_network_os: community.zabbix.zabbix
ansible_connection: httpapi
ansible_httpapi_port: 443
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_host: "{{ (env == 'staging')|ternary(zabbix_stg_hostname, zabbix_hostname) }}"
ansible_zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"

16
roles/zabbix/zabbix_templates/tasks/add_templates_to_hosts.yml
View file

@ -10,11 +10,11 @@
- zabbix_add_templates_to_hosts
- zabbix_templates
vars:
ansible_zabbix_auth_key: "{{ (env == 'staging')|ternary(zabbix_stg_apikey, zabbix_apikey) }}"
ansible_network_os: community.zabbix.zabbix
ansible_connection: httpapi
ansible_httpapi_port: 443
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_host: "{{ (env == 'staging')|ternary(zabbix_stg_hostname, zabbix_hostname) }}"
ansible_zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"

16
roles/zabbix/zabbix_templates/tasks/hostgroups.yml
View file

@ -9,11 +9,11 @@
- zabbix_add_hostgroups
- zabbix_templates
vars:
ansible_zabbix_auth_key: "{{ (env == 'staging')|ternary(zabbix_stg_apikey, zabbix_apikey) }}"
ansible_network_os: community.zabbix.zabbix
ansible_connection: httpapi
ansible_httpapi_port: 443
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_host: "{{ (env == 'staging')|ternary(zabbix_stg_hostname, zabbix_hostname) }}"
ansible_zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"

16
roles/zabbix/zabbix_templates/tasks/templates.yml
View file

@ -28,11 +28,11 @@
- zabbix_add_templates
- zabbix_templates
vars:
ansible_zabbix_auth_key: "{{ (env == 'staging')|ternary(zabbix_stg_apikey, zabbix_apikey) }}"
ansible_network_os: community.zabbix.zabbix
ansible_connection: httpapi
ansible_httpapi_port: 443
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_host: "{{ (env == 'staging')|ternary(zabbix_stg_hostname, zabbix_hostname) }}"
ansible_zabbix_url_path: "" # If Zabbix WebUI runs on non-default (zabbix) path ,e.g. http://<FQDN>/zabbixeu
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"