Handmatige Zabbix-template stappen

Gebruik dit bestand alleen als je Zabbix-versie of importpolicy de YAML-export weigert.

Template

Ga naar Data collection -> Templates.
Maak template Template SSL Checker Relaxed.
Zet de groep op Templates/Custom.
Voeg macros toe:
- {$SSL_CONFIG} = /etc/zabbix/ssl_targets.json
- {$SSL_CHECK_TIMEOUT} = 10

Discovery rule

Maak een discovery rule:

Name: SSL target discovery
Type: External check
Key: ssl_discovery.py["--config","{$SSL_CONFIG}"]
Update interval: 1h

De discovery output bevat de LLD macros direct in het data object:

{#SSL_NAME}
{#SSL_HOST}
{#SSL_PORT}
{#SSL_OWNER}
{#SSL_PROFILE}

Master item prototype

Maak onder de discovery rule een item prototype:

Name: SSL raw check [{#SSL_NAME}]
Type: External check
Key: ssl_check.py["--config","{$SSL_CONFIG}","--host","{#SSL_HOST}","--port","{#SSL_PORT}"]
Type of information: Text
Update interval: 15m
History: 7d
Trends: 0

Dependent item prototypes

Maak dependent item prototypes met het master item hierboven als bron. Gebruik JSONPath preprocessing per veld, bijvoorbeeld:

ssl.reachable[{#SSL_HOST},{#SSL_PORT}] -> $.reachable -> JavaScript return value === true || value === "true" ? 1 : 0;
ssl.days_left[{#SSL_HOST},{#SSL_PORT}] -> $.days_left
ssl.valid_now[{#SSL_HOST},{#SSL_PORT}] -> $.valid_now -> boolean JavaScript
ssl.hostname_match[{#SSL_HOST},{#SSL_PORT}] -> $.hostname_match -> boolean JavaScript
ssl.chain_valid[{#SSL_HOST},{#SSL_PORT}] -> $.chain_valid -> boolean JavaScript
ssl.self_signed[{#SSL_HOST},{#SSL_PORT}] -> $.self_signed -> boolean JavaScript
ssl.not_yet_valid[{#SSL_HOST},{#SSL_PORT}] -> $.not_yet_valid -> boolean JavaScript
ssl.expired[{#SSL_HOST},{#SSL_PORT}] -> $.expired -> boolean JavaScript
ssl.issuer_org[{#SSL_HOST},{#SSL_PORT}] -> $.issuer_org
ssl.issuer_cn[{#SSL_HOST},{#SSL_PORT}] -> $.issuer_cn
ssl.subject_cn[{#SSL_HOST},{#SSL_PORT}] -> $.subject_cn
ssl.san_names[{#SSL_HOST},{#SSL_PORT}] -> $.san_names
ssl.fingerprint_sha256[{#SSL_HOST},{#SSL_PORT}] -> $.fingerprint_sha256
ssl.expected_issuer_match[{#SSL_HOST},{#SSL_PORT}] -> $.expected_issuer_match -> boolean JavaScript
ssl.tls_version_negotiated[{#SSL_HOST},{#SSL_PORT}] -> $.tls_version_negotiated
ssl.tls10_supported[{#SSL_HOST},{#SSL_PORT}] -> $.tls10_supported -> boolean JavaScript
ssl.tls11_supported[{#SSL_HOST},{#SSL_PORT}] -> $.tls11_supported -> boolean JavaScript
ssl.tls12_supported[{#SSL_HOST},{#SSL_PORT}] -> $.tls12_supported -> boolean JavaScript
ssl.tls13_supported[{#SSL_HOST},{#SSL_PORT}] -> $.tls13_supported -> boolean JavaScript
ssl.http_reachable[{#SSL_HOST},{#SSL_PORT}] -> $.http_reachable -> boolean JavaScript
ssl.http_status[{#SSL_HOST},{#SSL_PORT}] -> $.http_status
ssl.http_status_expected[{#SSL_HOST},{#SSL_PORT}] -> $.http_status_expected -> boolean JavaScript
ssl.http_response_time_ms[{#SSL_HOST},{#SSL_PORT}] -> $.http_response_time_ms
ssl.http_hsts[{#SSL_HOST},{#SSL_PORT}] -> $.http_hsts -> boolean JavaScript
ssl.http_security_headers_score[{#SSL_HOST},{#SSL_PORT}] -> $.http_security_headers_score
ssl.http_server_header[{#SSL_HOST},{#SSL_PORT}] -> $.http_server_header
ssl.error[{#SSL_HOST},{#SSL_PORT}] -> $.error

Triggers

Maak trigger prototypes op de dependent item prototypes:

SSL target unreachable: reachable = 0, Warning
SSL expires within 30 days: days_left < 30 and >= 14, Information
SSL expires within 14 days: days_left < 14 and >= 7, Warning
SSL expires within 7 days: days_left < 7 and >= 2, Average
SSL expires within 2 days: days_left < 2, High
SSL hostname mismatch: hostname_match = 0, High
SSL chain invalid: chain_valid = 0, Average
SSL is self-signed: self_signed = 1, Warning
SSL not yet valid: not_yet_valid = 1, High
TLS 1.0 supported: tls10_supported = 1, Warning
TLS 1.1 supported: tls11_supported = 1, Warning
HTTP status not expected: http_status_expected = 0, Warning
HSTS missing: http_hsts = 0, Information
HTTP security headers score low: score < 2, Information

Text-item change triggers voor issuer/fingerprint zijn bewust niet opgenomen, omdat importeerbaarheid per Zabbix 7.x minor release kan verschillen.

4.3 KiB Raw Blame History