Zabbix: Installation and Configuration Setup

General Description

The make_zabbix.py utility is used to deploy infrastructure objects for the Zabbix module. It is included in the zabbix_ko_maker package and located in the bin directory.

Utility Purpose

• deployment of basic Search Anywhere Framework entities required for the module to function
• creation of index templates
• creation of index patterns
• inventory settings

---

Requirements

• Python 3.12 or higher
• utility dependencies are installed by the bin/install_dependencies.sh script, which creates .venv and installs the smpy and httpx libraries
• Access to the Search Anywhere Framework cluster with administrator privileges

---

Project Structure

./
├── bin/                   # Installation and deployment scripts
├── core/                  # Asset Service Model (hereafter ASM) layers
├── data/                  # Configuration files
│   ├── indexes/           # Index configurations
│   ├── index_templates/   # Index templates
│   ├── index-patterns/    # Index patterns
│   ├── ism_polices/       # ISM policies
│   ├── sm_*/              # Search Anywhere Framework entities
│   └── inv/               # Inventory settings
├── lookup_csv/            # List of rules for incident creation
├── templates/             # ASM metric templates
├── update_zabbix_rsm/     # Script for automatic ASM service updates
└── macroses.json          # Installation macros

---

Configuration File Formats

Important!

The settings in the indexes and ism_policies directories are for demonstration purposes. Before using them in a production environment, they must be adapted to meet data storage and rotation requirements.

Search Anywhere Framework Entities (sm_*)

{
  "_meta": { 
	  // metadata
  },
  // configuration
}

Index Templates (index_templates)

{
  "name": "zabbix_hosts_template",
  "index_template": {
    // template configuration
  }
}

ASM Layers (core/rsm/layers)

{
  "title": "Zabbix: metrics",
  "description": "layer description"
}

Index Patterns (index-patterns)

{
  "attributes": {
    "title": "zabbix_hosts-*"
  },
  "references": []
}

Inventory (inv)

• inv/inventories — asset configurations
• inv/relationSettings — relationships between assets

---

Installation Sequence

Step 1. SA Data Collector Integration

Before starting the installation, ensure Zabbix integration with SA Data Collector is completed. At this stage, all necessary pipelines should be configured, and the ZABBIX_API_TOKEN API token and logstash user password should be added to the keystore.

Step 2. Install Utility Dependencies

./bin/install_dependencies.sh

The script creates the .venv virtual environment and installs utility dependencies, including the smpy and httpx libraries.

Step 3. Run Configuration Installation

./bin/make_zabbix.py \
  --sm_host <SAF_HOST> \
  --sm_api_port <SAF_API_PORT> \
  --sm_cluster_port <OPENSEARCH_PORT> \
  --sm_user <SAF_USER> \
  --sm_password '<SAF_PASSWORD>'

Parameter	Required	Type	Default	Description
--sm_host	Yes	string	—	Search Anywhere Framework cluster host
--sm_api_port	No	int	5601	Frontend API port (saved objects, ASM, inventory)
--sm_cluster_port	No	int	9200	OpenSearch API port (index templates, sm_* objects)
--sm_user	Yes	string	—	Username
--sm_password	Yes	string	—	User password

Example:

./bin/make_zabbix.py --sm_host sm-host.my_company.ru --sm_api_port 5601 --sm_cluster_port 9200 --sm_user admin --sm_password securepassword

Attention!

--sm_api_port is used for the frontend API, saved objects, ASM, and inventory. --sm_cluster_port is used for the OpenSearch API (index templates and sm_* objects). If the frontend API and OpenSearch are published on different servers, you can explicitly set --sm_api_host and --sm_cluster_host.

Step 4. Start the Logstash Service

After successful configuration deployment, start the Logstash service:

sudo systemctl start logstash && sudo systemctl status logstash

or, if the service is already running:

sudo systemctl restart logstash && sudo systemctl status logstash

Step 5. Check the Result in the Interface

After startup, verify that the settings have been applied:

1. Indexes

   • In the Indexes: (Main menu - Settings - Index Management - Indices)

2. ISM Policies

   • In the Index policies: (Main menu - Settings - Index Management - Index policies)

3. Managed indices

   • In the Managed indices: (Main menu - Settings - Index Management - Managed indices)

4. Index Templates

   • In the Templates: (Main menu - Settings - Index Management - Templates)

5. Index patterns

   • In the Index patterns: (Main menu - Settings - Management - OPENSEARCH - Index patterns)

6. Lookups

   • In the Lookups: (Main menu - Lookup Manager - Lookups)

Step 6. Register the Module Incident Type

After importing the Zabbix content module, run the apply_incident_types.py script from the same zabbix_ko_maker utility. The script registers incident card fields (investigation playbook), idempotently creates the IT Incident incident type, and then assigns it to the module jobs.

./bin/apply_incident_types.py \
  --sm_host <SAF_HOST> \
  --sm_api_port <SAF_API_PORT> \
  --sm_user <SAF_USER> \
  --sm_password '<SAF_PASSWORD>'

After execution, verify that:

• the IT Incident incident type appears in Main Menu - Incident Manager - Incident Types
• the type is available in the Incident Type dropdown list in the job editor
• incident jobs of the Zabbix module received this type
• the incident card displays the playbook fields