Zabbix agent config for PVE 8

[andersostling56]

It's maybe me, but I find the instructions for adding a PVE host/agent to Zabbix confusing. I dont get the relation between the local user accounts and API keys/tokens in Zabbix vs Proxmox, and how they are supposed to be setup. I may have tested all permutations I can think of but I still get an error in the Zabbix dashboard "(Proxmox: API service not available)" for the PVE host.

The macros are defined in Zabbix, but maybe with the wrong API key (zabbix or pve ...)

Anyone? Pretent that I am 8 yo .

 

[Dunuin]

You got a user on PVE. Then you can create a token associated with that user. Then you set the correct privileges in PVE for that token the zabbix template needs. Zabbix is then polling the data from PVE using PVEs API with that token from PVE. For testing purposes you could assign that token full admin privileges for "/" but later you really want the privileges as limited as possible for monitoring. See the templates repo: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/app/proxmox?at=release/6.4

Setup​

Create an API token for the monitoring user. Important note: for security reasons, it is recommended to create a separate user (Datacenter - Permissions).

For the created API token and user, provide the necessary access levels:

• Check: ["perm","/",["Sys.Audit"]]
• Check: ["perm","/nodes/{node}",["Sys.Audit"]]
• Check: ["perm","/vms/{vmid}",["VM.Audit"]]

Copy the resulting Token ID and Secret into host macros.

 

[andersostling56]

Ok, lets start from the beginning and see if I can follow you. I also found this page that was helpful but also a bit confusing

https://geekistheway.com/2022/12/31/monitoring-proxmox-ve-using-zabbix-agent/

This is what I have

• Zabbix 6.4 appliance installed on PVE
• Zabbix agent on PVE 8

On PVE/Datacenter:

• Users: Added a user called zabbix@pam (enabled, no expiration)
• API tokens: Added a new token called zabbix-api for user zabbix@pam (with priv separation enabled, no expiration)
• Token Id zabbix@pam!zabbix-token created with value 9a7fdd9e-23da-450e-a7f4-f28c30797573
• The permissions tab shows "/" as Path/Permisson. Nothing to add or change here? The guide I referred to says that I should create new permissions for the user, but there is no Add option...

On Zabbix web admin:

• The guide says "Go to the Configuration/Hosts ..." but there is no such option
• I used "Monitoring/Hosts" and Create host instead with "Proxmox VE by HTTP" used as template
• Admin/Macros: Added the PVE.TOKEN.ID and PVE.TOKEN.SECRET with the values above

So now when I go to Monitoring/Latest data, and select the PVE host I see this



So there is something going on that I cant figure out. The agent on PVE is configured as "passive" and restarted.

 

[Dunuin]

Token Id zabbix@pam!zabbix-token created with value 9a7fdd9e-23da-450e-a7f4-f28c30797573

Thats your secret you should not tell anyone as then everyone can login to your PVE node and manage your PVE (with proper privileges hopefully only beimg able to monitor stuff)!

The permissions tab shows "/" as Path/Permisson. Nothing to add or change here? The guide I referred to says that I should create new permissions for the user, but there is no Add option...

I would create a new "zabbix" role, set the correct permissions for that role according to the template documentation and then assign your zabbix token the "zabbix" role so it's using these permissions/privileges.

• The guide says "Go to the Configuration/Hosts ..." but there is no such option
• I used "Monitoring/Hosts" and Create host instead with "Proxmox VE by HTTP" used as template

There are two "Hosts" menus. The monitoring one where you can also see existing hosts and the configuration one where you will find a "Add new host" button at the upper right.
Look again, it should be there.

Admin/Macros: Added the PVE.TOKEN.ID and PVE.TOKEN.SECRET with the values above

I think there are other Macros too like for setting the IP of your PVE host.

 

[Gurumanger]

This whole thing is quite messed up - certainly the official "instructions" are. I have it running in an lxc on v8 and eventually after banging my head against the wall for hours:

On proxmox:

create a zabbix user
create a zabbix api token linked to the zabbix user (copy the secret)
create permission for the zabbix user at / level (admin for now)
create permmission for the zabbix@pam!zabbix token at / level (admin for now

On zabbix:

create host proxmox linked to the Proxmox HTTP template
create an interface with the proxmox IP address of type Zabbix agent - the port doesn't matter it seems - it gets the IP address from here but the port from the macro (8006) - that's obvious not.
in the macros tab on this screen, click to show host and inherited macros
change the token id to zabbix@pam!zabbix (assuming you used my naming convention)
change the secret to the one you copied above

That should set things off and in latest data for proxmox you should see stuff being collected. If will call out the vms and containers as tags.

But what I am not stuck on is getting any of the guests to appear as hosts themselves in zabbix. I had this problem with a bog standard ICMP ping discovery too until I realised that in zabbix, discovery is not enough - you have to go to Alerts > Actions > Discovery Actions and say "if you discover something, add it as a host". FFS - that's why I am discovering things!

I have managed to get my ICMP Ping hosts to start showing up gradually as it rediscovers things. But stuck on proxmox guests - there is a whole slew of enabled discovery rules attached to the host but god knows what they are doing or how you turn this into actions to add a host.

Any help in return gratefully appreciated!

I love how the Proxmox HTTP template uses the word "effortless"...

 

[Dunuin]

But what I am not stuck on is getting any of the guests to appear as hosts themselves in zabbix

Thats not how it works. If you want your guests as real zabbix hosts with all the additional data you have to install the zabbix agent within each guestOS.
The PVE Zabbix template will only discover guests and show them as a metric of your PVE host (and you are limited to the few metrics the PVE webUI is collecting likw CPU load, RAM and if the guest is running or not).

 

[jsterr]

InfluxDB + Grafana does have dashboards that include all data from vms/ct aswell

https://www.thomas-krenn.com/de/wik...iguration_eines_Metric-Servers_für_Proxmox_VE

 

[spergberger]

This whole thing is quite messed up - certainly the official "instructions" are. I have it running in an lxc on v8 and eventually after banging my head against the wall for hours:

On proxmox:

create a zabbix user
create a zabbix api token linked to the zabbix user (copy the secret)
create permission for the zabbix user at / level (admin for now)
create permmission for the zabbix@pam!zabbix token at / level (admin for now

On zabbix:

create host proxmox linked to the Proxmox HTTP template
create an interface with the proxmox IP address of type Zabbix agent - the port doesn't matter it seems - it gets the IP address from here but the port from the macro (8006) - that's obvious not.
in the macros tab on this screen, click to show host and inherited macros
change the token id to zabbix@pam!zabbix (assuming you used my naming convention)
change the secret to the one you copied above

That should set things off and in latest data for proxmox you should see stuff being collected. If will call out the vms and containers as tags.

But what I am not stuck on is getting any of the guests to appear as hosts themselves in zabbix. I had this problem with a bog standard ICMP ping discovery too until I realised that in zabbix, discovery is not enough - you have to go to Alerts > Actions > Discovery Actions and say "if you discover something, add it as a host". FFS - that's why I am discovering things!

I have managed to get my ICMP Ping hosts to start showing up gradually as it rediscovers things. But stuck on proxmox guests - there is a whole slew of enabled discovery rules attached to the host but god knows what they are doing or how you turn this into actions to add a host.

Any help in return gratefully appreciated!

I love how the Proxmox HTTP template uses the word "effortless"...

I see no way to set access levels on a token using the proxmox http interface.

 

[JTX2023]

I see no way to set access levels on a token using the proxmox http interface.

It took me a while to figure out how to set the permissions for a token or user. Once you have created a token or user click on “permissions” and on the upper left corner the add button will show up. If you click the add button you will be able to define the permissions for the token or user.

 

[chupakabra]

facing the same... even if i grand full access to user and @!apitoken
its just not working together with zabbix 7.0 & PVE 8.2.2?

 

[JTX2023]

No problems here for me once I got the permissions right. Running zabbix 7.0 and 6.8.8-1-pve / pve-manager 8.2.4. I followed this tutorial: https://geekistheway.com/2022/12/31/monitoring-proxmox-ve-using-zabbix-agent/

 

[chupakabra]

No problems here for me once I got the permissions right. Running zabbix 7.0 and 6.8.8-1-pve / pve-manager 8.2.4. I followed this tutorial: https://geekistheway.com/2022/12/31/monitoring-proxmox-ve-using-zabbix-agent/

Thanks for your answer, but as you can see many guys are getting the same even using your provided tutorial (comment section)
I was following this utube video: https://www.youtube.com/watch?v=qtw4PQR7kDA&t=40s

 

[JTX2023]

@chupakabra Did you try to access the API via Postman? If you have a valid API token you should be able to query different stuff (response code 200). This is how Postman looks for me:

 

[chupakabra]

@chupakabra Did you try to access the API via Postman? If you have a valid API token you should be able to query different stuff (response code 200). This is how Postman looks for me:

Proxmox community is superb! So fast responses! I hope this friday gonna be great for you!

To the point, im getting api call data, but i had to press disable ssl verification or it wouldnt work! I guess thats the key.
Is there any way how to disable ssl check in/for zabbix?





EDIT: IT'S ALIVE!

Somehow i got it through! Now zabbix is monitoring my PVE after I added 3.macro host_url (check picture)
I'm not sure if it's because of this change, but it's working for me!

 

[JTX2023]

glad to hear that!