Service Monitoring using Zabbix

1. Update the Zabbix Agent Configuration

Adding User Parameters

Edit the Zabbix agent configuration file (usually located at /etc/zabbix/zabbix_agentd.conf). Add the following UserParameter entries to define custom checks for systemd services:

UserParameter=systemd.unit.is-active[*],systemctl is-active --quiet '$1' && echo 1 || echo 0
UserParameter=systemd.unit.is-failed[*],systemctl is-failed --quiet '$1' && echo 1 || echo 0
UserParameter=systemd.unit.is-enabled[*],systemctl is-enabled --quiet '$1' && echo 1 || echo 0

• systemd.unit.is-active: Checks if the service is currently active and running.

• systemd.unit.is-failed: Checks if the service has entered a failed state.

• systemd.unit.is-enabled: Checks if the service is enabled to start at boot.

Restart the Zabbix Agent

Restart the Zabbix agent service to apply changes:

sudo systemctl restart zabbix-agent

---

2. Create Items in Zabbix

Log in to Zabbix Frontend

Access the Zabbix web interface with an account that has the necessary permissions.

Add Items

1. Navigate to Configuration > Hosts.

2. Select the target host.

3. Click Items and then Create Item.

Create the following items for monitoring a specific service (e.g., sshd):

• Service Active Status

  • Name: SSHD Service Active Status

  • Key: systemd.unit.is-active[sshd]

  • Type: Zabbix Agent

  • Type of Information: Numeric (unsigned)

  • Update Interval: 60s

• Service Failed Status

  • Name: SSHD Service Failed Status

  • Key: systemd.unit.is-failed[sshd]

  • Type: Zabbix Agent

  • Type of Information: Numeric (unsigned)

  • Update Interval: 60s

• Service Enabled Status

  • Name: SSHD Service Enabled Status

  • Key: systemd.unit.is-enabled[sshd]

  • Type: Zabbix Agent

  • Type of Information: Numeric (unsigned)

  • Update Interval: 60s

---

3. Configure Triggers

Add triggers to generate alerts based on the service status.

1. Navigate to Configuration > Hosts.

2. Select the target host.

3. Click Triggers and then Create Trigger.

Example Triggers

• Service is Not Active

  • Name: SSHD Service is Not Active

  • Expression: {<host>:systemd.unit.is-active[sshd].last()}=0

  • Severity: High

• Service is in Failed State

  • Name: SSHD Service is in Failed State

  • Expression: {<host>:systemd.unit.is-failed[sshd].last()}=1

  • Severity: Disaster

• Service is Disabled

  • Name: SSHD Service is Disabled

  • Expression: {<host>:systemd.unit.is-enabled[sshd].last()}=0

  • Severity: Warning

---

4. Testing

1. Restart the sshd service to verify active status:

   sudo systemctl restart sshd

2. Stop the sshd service to trigger an alert:

   sudo systemctl stop sshd

3. Re-enable the sshd service to test the enabled status:

   sudo systemctl enable sshd

Monitor the Zabbix frontend for corresponding changes in item values and trigger alerts.

---