0

I have setup Zabbix to autodiscover hosts by pinging all IP-address in my range. It then adds the discovered hosts to 'Discovered hosts'.

I have an action:

Conditions:

  • Discover rule
  • Discover status = discovered

Operations:

  • Add host
  • Add to host groups: Discovered hosts
  • Link to templates: Template TCP service discovery

The template runs a portscanning on the host to see which TCP ports are open.

This all works very well, but portscans every single host every 7 minutes (my guess is that it takes in total 7 minutes to ping all hosts in the network and do a port scan of all the hosts that are up). I would like it to only run once per day or so.

The discovery rule has 'Delay (in sec)' 200000. The 'Template TCP service discovery' has 'update interval' set to 86400.

How do I tell Zabbix to cool it? Don't run the discovery+portscan every 7 minutes.

Ole Tange
  • 2,946
  • 6
  • 32
  • 47
  • I have tried reproducing it with the latest pre-2.4.1, but it all works correctly: network discovery runs with the specified delay and the low-level discovery rule is checked with the specified interval. Could you please specify which Zabbix version you are using? Also, which of the above discoveries runs every 7 minutes: the network discovery or low-level discovery, or both? – asaveljevs Sep 30 '14 at 11:46
  • This is Zabbix 2.2.6. I can see the portscan runs on every host every 7 minutes (because it logs to syslog), but I do not know where to see if the network discovery runs every 7 minutes. – Ole Tange Sep 30 '14 at 12:58
  • For seeing how long a network discovery takes, in Zabbix 2.4.0 you could do "zabbix_server -R log_level_increase=discoverer" to get more information from the discoverer process (see a bit above https://www.zabbix.com/documentation/2.4/manual/introduction/whatsnew240#item_changesimprovements). – asaveljevs Oct 02 '14 at 08:11
  • Could you please describe a bit more how the port scan discovery is implemented, how long does it really take from the command line, and post a screenshot of the corresponding item or discovery rule configuration? The reason I ask is because the maximum timeout that can be set in server configuration file is 30 seconds, but your port scan supposedly takes 7 minutes, and these two do not go very well together. – asaveljevs Oct 02 '14 at 08:14
  • I edited the question to make it more clear that it is the full scanning of ALL hosts in the network that I believe in total takes 7 minutes. The portscan of a single hosts takes less than 30 seconds. – Ole Tange Oct 02 '14 at 11:19
  • Thank you. Still, screenshot of item configuration (on one of the hosts, not the template) would be nice. If it turns out to be an external check, we can proceed with debugging the server side. If it turns out to be an agent check, we can proceed with the agent. – asaveljevs Oct 03 '14 at 06:48
  • There is no Zabbix agent on the servers being scanned. I will find a screenshot. – Ole Tange Oct 03 '14 at 12:06

0 Answers0