> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/security-operations/zabbix-nms/service-monitoring-using-zabbix.md).

# Service Monitoring using Zabbix

1\. Update the Zabbix Agent Configuration

**Adding User Parameters**

Edit the Zabbix agent configuration file (usually located at `/etc/zabbix/zabbix_agentd.conf`). Add the following `UserParameter` entries to define custom checks for systemd services:

```bash
UserParameter=systemd.unit.is-active[*],systemctl is-active --quiet '$1' && echo 1 || echo 0
UserParameter=systemd.unit.is-failed[*],systemctl is-failed --quiet '$1' && echo 1 || echo 0
UserParameter=systemd.unit.is-enabled[*],systemctl is-enabled --quiet '$1' && echo 1 || echo 0
```

* **systemd.unit.is-active**: Checks if the service is currently active and running.
* **systemd.unit.is-failed**: Checks if the service has entered a failed state.
* **systemd.unit.is-enabled**: Checks if the service is enabled to start at boot.

**Restart the Zabbix Agent**

Restart the Zabbix agent service to apply changes:

```bash
sudo systemctl restart zabbix-agent
```

***

#### 2. Create Items in Zabbix

**Log in to Zabbix Frontend**

Access the Zabbix web interface with an account that has the necessary permissions.

**Add Items**

1. Navigate to **Configuration > Hosts**.
2. Select the target host.
3. Click **Items** and then **Create Item**.

Create the following items for monitoring a specific service (e.g., `sshd`):

* **Service Active Status**
  * Name: `SSHD Service Active Status`
  * Key: `systemd.unit.is-active[sshd]`
  * Type: Zabbix Agent
  * Type of Information: Numeric (unsigned)
  * Update Interval: 60s
* **Service Failed Status**
  * Name: `SSHD Service Failed Status`
  * Key: `systemd.unit.is-failed[sshd]`
  * Type: Zabbix Agent
  * Type of Information: Numeric (unsigned)
  * Update Interval: 60s
* **Service Enabled Status**
  * Name: `SSHD Service Enabled Status`
  * Key: `systemd.unit.is-enabled[sshd]`
  * Type: Zabbix Agent
  * Type of Information: Numeric (unsigned)
  * Update Interval: 60s

***

#### 3. Configure Triggers

Add triggers to generate alerts based on the service status.

1. Navigate to **Configuration > Hosts**.
2. Select the target host.
3. Click **Triggers** and then **Create Trigger**.

**Example Triggers**

* **Service is Not Active**
  * Name: `SSHD Service is Not Active`
  * Expression: `{<host>:systemd.unit.is-active[sshd].last()}=0`
  * Severity: High
* **Service is in Failed State**
  * Name: `SSHD Service is in Failed State`
  * Expression: `{<host>:systemd.unit.is-failed[sshd].last()}=1`
  * Severity: Disaster
* **Service is Disabled**
  * Name: `SSHD Service is Disabled`
  * Expression: `{<host>:systemd.unit.is-enabled[sshd].last()}=0`
  * Severity: Warning

***

#### 4. Testing

1. Restart the `sshd` service to verify active status:

   ```bash
   sudo systemctl restart sshd
   ```
2. Stop the `sshd` service to trigger an alert:

   ```bash
   sudo systemctl stop sshd
   ```
3. Re-enable the `sshd` service to test the enabled status:

   ```bash
   sudo systemctl enable sshd
   ```

Monitor the Zabbix frontend for corresponding changes in item values and trigger alerts.

***