From: Daniel F. Dickinson Date: Thu, 16 Jul 2026 23:47:53 +0000 (-0400) Subject: zabbix: tweak patch agent and server patch configs X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=589cf9a73cdcbc3a0d23e096061f54624abb0cbd;p=openwrt-packages.git zabbix: tweak patch agent and server patch configs Tweak the agentd and server patch configurations and bring agentd and server confgurations to parity. Signed-off-by: Daniel F. Dickinson --- diff --git a/admin/zabbix/patches/010-change-agentd-config.patch b/admin/zabbix/patches/010-change-agentd-config.patch deleted file mode 100644 index b94fbe693..000000000 --- a/admin/zabbix/patches/010-change-agentd-config.patch +++ /dev/null @@ -1,93 +0,0 @@ -From da7f1292838f087e2179705f2778f78ddd85cba8 Mon Sep 17 00:00:00 2001 -From: "Daniel F. Dickinson" -Date: Wed, 17 Dec 2025 18:28:37 -0500 -Subject: [PATCH] zabbix_agentd: Tweak config file for OpenWrt - -Note: original patch had no header, header added 2025-12-16, while -bumping package version. Modified 2025-12-25. Modified 2026-01-21. - -1. Use syslog not a file for logging -2. Place PidFile under /var/run/zabbix -3. Only start passive agent by default -4. Do not do active checks by default -5. Use the system hostname as hostname (except on zabbix server) -6. Include configurations under /etc/zabbix_agentd.conf.d/ -7. Drop privileges to the zabbix-agent user (instead of zabbix) - -Signed-off-by: Daniel F. Dickinson ---- - conf/zabbix_agentd.conf | 19 +++++++------------ - 1 file changed, 7 insertions(+), 12 deletions(-) - ---- a/conf/zabbix_agentd.conf -+++ b/conf/zabbix_agentd.conf -@@ -3,12 +3,11 @@ - - ############ GENERAL PARAMETERS ################# - --### Option: PidFile --# Name of PID file. --# --# Mandatory: no --# Default: --# PidFile=/tmp/zabbix_agentd.pid -+# Zabbix always creates a PidFile. Make sure it is where we want it. -+PidFile=/var/run/zabbix-agent/zabbix_agentd.pid -+ -+# use syslog -+LogType=system - - ### Option: LogType - # Specifies where log messages are written to: -@@ -27,8 +26,6 @@ - # Default: - # LogFile= - --LogFile=/tmp/zabbix_agentd.log -- - ### Option: LogFileSize - # Maximum size of log file in MB. - # 0 - disable automatic log rotation. -@@ -136,6 +133,7 @@ Server=127.0.0.1 - # Range: 0-100 - # Default: - # StartAgents=10 -+StartAgents=1 - - ##### Active checks related - -@@ -166,8 +164,6 @@ Server=127.0.0.1 - # Default: - # ServerActive= - --ServerActive=127.0.0.1 -- - ### Option: Hostname - # List of comma delimited unique, case sensitive hostnames. - # Required for active checks and must match hostnames as configured on the server. -@@ -177,8 +173,6 @@ ServerActive=127.0.0.1 - # Default: - # Hostname= - --Hostname=Zabbix server -- - ### Option: HostnameItem - # Item used for generating Hostname if it is undefined. Ignored if Hostname is defined. - # Does not support UserParameters or aliases. -@@ -317,7 +311,7 @@ Hostname=Zabbix server - # - # Mandatory: no - # Default: --# User=zabbix -+User=zabbix-agent - - ####### USER-DEFINED MONITORED PARAMETERS ####### - -@@ -547,5 +541,6 @@ Hostname=Zabbix server - # Include= - - # Include=/usr/local/etc/zabbix_agentd.userparams.conf --# Include=/usr/local/etc/zabbix_agentd.conf.d/ - # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf -+Include=/usr/share/zabbix_agentd.openwrt-params.d/ -+Include=/etc/zabbix_agentd.conf.d/ diff --git a/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch new file mode 100644 index 000000000..ab7b43e50 --- /dev/null +++ b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch @@ -0,0 +1,98 @@ +From 502248599bfc0b36daf0f8dd83bee5bc6e1b24e4 Mon Sep 17 00:00:00 2001 +From: "Daniel F. Dickinson" +Date: Wed, 17 Dec 2025 18:28:37 -0500 +Subject: zabbix_agentd: tweak config file for OpenWrt + +Note: original patch had no header, header added 2025-12-16, while +bumping package version. Modified 2025-12-25. Modified 2026-01-21. +Tweaked further 2026-07-16. + +1. Use syslog not a file for logging. +2. Place PidFile under /var/run/zabbix-agent. +3. Only start 1 passive agent by default. +4. Do not do active checks by default. +5. Use the system hostname as hostname. +6. If started as root, drop privileges to the zabbix-agent user, not + a shared (with server and proxy) zabbix user or root, per upstream + recommendation: + https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation +7. Include configuration files under /etc/zabbix_agentd.conf.d/. +8. Require configurations under /etc/zabbix_agentd.conf.d/ end in .conf. + (other files are ignored for configuration purposes). + +Signed-off-by: Daniel F. Dickinson +--- + conf/zabbix_agentd.conf | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/conf/zabbix_agentd.conf ++++ b/conf/zabbix_agentd.conf +@@ -10,6 +10,9 @@ + # Default: + # PidFile=/tmp/zabbix_agentd.pid + ++# Zabbix always creates a PidFile. Make sure it is where we want it. ++PidFile=/var/run/zabbix-agent/zabbix_agentd.pid ++ + ### Option: LogType + # Specifies where log messages are written to: + # system - syslog +@@ -20,6 +23,9 @@ + # Default: + # LogType=file + ++# Use syslog ++LogType=system ++ + ### Option: LogFile + # Log file name for LogType 'file' parameter. + # +@@ -27,7 +33,7 @@ + # Default: + # LogFile= + +-LogFile=/tmp/zabbix_agentd.log ++# LogFile=/tmp/zabbix_agentd.log + + ### Option: LogFileSize + # Maximum size of log file in MB. +@@ -136,6 +142,7 @@ Server=127.0.0.1 + # Range: 0-100 + # Default: + # StartAgents=10 ++StartAgents=1 + + ##### Active checks related + +@@ -166,7 +173,7 @@ Server=127.0.0.1 + # Default: + # ServerActive= + +-ServerActive=127.0.0.1 ++# ServerActive=127.0.0.1 + + ### Option: Hostname + # List of comma delimited unique, case sensitive hostnames. +@@ -177,7 +184,7 @@ ServerActive=127.0.0.1 + # Default: + # Hostname= + +-Hostname=Zabbix server ++# Hostname=Zabbix server + + ### Option: HostnameItem + # Item used for generating Hostname if it is undefined. Ignored if Hostname is defined. +@@ -318,6 +325,7 @@ Hostname=Zabbix server + # Mandatory: no + # Default: + # User=zabbix ++User=zabbix-agent + + ####### USER-DEFINED MONITORED PARAMETERS ####### + +@@ -549,3 +557,5 @@ Hostname=Zabbix server + # Include=/usr/local/etc/zabbix_agentd.userparams.conf + # Include=/usr/local/etc/zabbix_agentd.conf.d/ + # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf ++Include=/usr/share/zabbix_agentd.openwrt-params.d/ ++Include=/etc/zabbix_agentd.conf.d/*.conf diff --git a/admin/zabbix/patches/020-change-server-config.patch b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch similarity index 59% rename from admin/zabbix/patches/020-change-server-config.patch rename to admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch index d9251d5c0..04f8b5684 100644 --- a/admin/zabbix/patches/020-change-server-config.patch +++ b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch @@ -1,21 +1,28 @@ -From ca45744e63b957d83cdbc2a28588077cbf8b5639 Mon Sep 17 00:00:00 2001 +From 6655a1f2e5bff8d0082f41cf2711339f0d75d788 Mon Sep 17 00:00:00 2001 From: "Daniel F. Dickinson" Date: Wed, 17 Dec 2025 06:39:16 -0500 -Subject: [PATCH] Make zabbix_server config suitable for OpenWrt +Subject: zabbix_server: tweak config file for OpenWrt -1. Log to (default ephemeral) syslog, not a file (and don't rotate) +Created 2025-12-17. Updated 2026-07-16. + +1. Log to syslog, not a file. 2. Update PidFile path so correct permissions can be set for access by - Zabbix server running without privileges + Zabbix server running without privileges. 3. If started as root, drop privileges to zabbix-server user (instead of - zabbix) -4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin) -5. Configure fping as the ipv6 fping as well -6. For privacy, disable the public API call to check Zabbix version + zabbix user shared with agent and proxy, or root) per upstream + recommendation: + https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation. +4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin). +5. Configure fping as the ipv6 fping as well. +6. For privacy, disable the public API call to check Zabbix version. +7. Include configurations under /etc/zabbix_server.conf.d/. +8. Require configurations under /etc/zabbix_server.conf.d/ end in .conf + (other files are ignored for configuration purposes). Signed-off-by: Daniel F. Dickinson --- - conf/zabbix_server.conf | 15 +++++++++++---- - 1 file changed, 11 insertions(+), 4 deletions(-) + conf/zabbix_server.conf | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) --- a/conf/zabbix_server.conf +++ b/conf/zabbix_server.conf @@ -36,15 +43,7 @@ Signed-off-by: Daniel F. Dickinson ### Option: LogFileSize # Maximum size of log file in MB. -@@ -45,6 +46,7 @@ LogFile=/tmp/zabbix_server.log - # Range: 0-1024 - # Default: - # LogFileSize=1 -+LogFileSize=0 - - ### Option: DebugLevel - # Specifies debug level: -@@ -67,6 +69,10 @@ LogFile=/tmp/zabbix_server.log +@@ -67,6 +68,10 @@ LogFile=/tmp/zabbix_server.log # Default: # PidFile=/tmp/zabbix_server.pid @@ -55,11 +54,10 @@ Signed-off-by: Daniel F. Dickinson ### Option: SocketDir # IPC socket directory. # Directory to store IPC sockets used by internal Zabbix services. -@@ -610,7 +616,7 @@ Timeout=4 - # +@@ -611,6 +616,7 @@ Timeout=4 # Mandatory: no # Default: --# FpingLocation=/usr/sbin/fping + # FpingLocation=/usr/sbin/fping +FpingLocation=/usr/bin/fping ### Option: Fping6Location @@ -72,16 +70,15 @@ Signed-off-by: Daniel F. Dickinson ### Option: SSHKeyLocation # Location of public and private keys for SSH checks and actions. -@@ -698,7 +705,7 @@ LogSlowQueries=3000 - # +@@ -699,6 +706,7 @@ LogSlowQueries=3000 # Mandatory: no # Default: --# User=zabbix + # User=zabbix +User=zabbix-server ### Option: SSLCertLocation # Location of SSL client certificates. -@@ -1050,7 +1057,7 @@ EnableGlobalScripts=0 +@@ -1050,7 +1058,7 @@ EnableGlobalScripts=0 # # Mandatory: no # Default: @@ -90,3 +87,8 @@ Signed-off-by: Daniel F. Dickinson ### Option: SMSDevices # List of comma delimited modem files allowed to use Zabbix server +@@ -1125,3 +1133,4 @@ EnableGlobalScripts=0 + # Include=/usr/local/etc/zabbix_server.general.conf + # Include=/usr/local/etc/zabbix_server.conf.d/ + # Include=/usr/local/etc/zabbix_server.conf.d/*.conf ++Include=/etc/zabbix_server.conf.d/*.conf