[Monitoring] 07. Zabbix (CentOS Stream 8 기준) - 설치

Date: 2023.06.04 Updated: 2023.06.04

카테고리: MONITORING

07-1. 자빅스(Zabbix) 실행에 필요한 소프트웨어(Apache, PHP, MariaDB) 설치

■ Apache 설치

{
    dnf -y install httpd
    mv /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/welcome.conf.org
    sed -i 's/ServerAdmin root@localhost/ServerAdmin root@test.srv/gi' /etc/httpd/conf/httpd.conf
    sed -i 's/#ServerName www.example.com:80/ServerName www.test.srv:80/gi' /etc/httpd/conf/httpd.conf
    sed -i 's/Options Indexes FollowSymLinks/Options FollowSymLinks/gi' /etc/httpd/conf/httpd.conf
    sed -i '154s/AllowOverride None/AllowOverride All/gi' /etc/httpd/conf/httpd.conf
    sed -i 's/DirectoryIndex index.html/DirectoryIndex index.html index.php/gi' /etc/httpd/conf/httpd.conf
cat <<EOF >> /etc/httpd/conf/httpd.conf

ServerTokens Prod
EOF
    systemctl enable --now httpd
    firewall-cmd --add-service=http --permanent
    firewall-cmd --reload
}

■ PHP 설치

{
    dnf module reset php
    dnf module enable php:7.4
    dnf module -y install php:7.4/common
    php -v
    echo "<?php echo 'PHP 7.4 Test Page'.\"\n\"; ?>" > php_test.php
    php php_test.php
}

■ MariaDB 설치

{
    dnf module -y install mariadb:10.5
cat <<EOF > /etc/my.cnf.d/charset.cnf
[mysqld]
character-set-server = utf8mb4

[client]
default-character-set = utf8mb4
EOF
    systemctl enable --now mariadb
    firewall-cmd --add-service=mysql --permanent
    firewall-cmd --reload
    mysql_secure_installation
}

07-2. Zabbix 설치

Zabbix 설치 페이지

■ PHP 모듈을 설치하고 Zabbix 저장소를 추가

{
    dnf -y install php-mysqlnd php-gd php-xml php-bcmath php-ldap
    dnf -y install https://repo.zabbix.com/zabbix/6.0/rhel/8/x86_64/zabbix-release-6.0-1.el8.noarch.rpm
    dnf clean all
}

■ Zabbix 설치 - Zabbix 서버 자체를 모니터링하려면 agent도 설치해야함

dnf -y install zabbix-server-mysql zabbix-web-mysql zabbix-apache-conf zabbix-sql-scripts zabbix-selinux-policy zabbix-agent

■ Zabbix용 데이터베이스 생성

MariaDB [(none)]> create database zabbix character set utf8mb4 collate utf8mb4_bin;
Query OK, 1 row affected (0.00 sec)

# replace any password for DB [password]
MariaDB [(none)]> grant all privileges on zabbix.* to zabbix@'localhost' identified by 'password'; 
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> set global log_bin_trust_function_creators = 1;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges; 
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> exit 
Bye


# password of zabbix user on MariaDB you set above
zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz  | mysql -u zabbix -p zabbix
Enter password:   


MariaDB [(none)]> set global log_bin_trust_function_creators = 0;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> quit;
Bye

■ Zabbix 서버 구성

vi /etc/zabbix/zabbix_server.conf

# line 94 : add
DBHost=localhost

# line 130 : add Zabbix DB password
DBPassword=password

systemctl enable --now zabbix-server

■ SELinux가 활성화된 경우

{
    setsebool -P zabbix_can_network on
    setsebool -P httpd_can_connect_zabbix on
    setsebool -P domain_can_mmap_files on   
    setsebool -P daemons_enable_cluster_mode on
cat <<EOF > zabbix_server.te
module zabbix_server 1.0;

require {
        type initctl_t;
        type devlog_t;
        type proc_kcore_t;
        type zabbix_t;
        type zabbix_agent_t;
        type rpm_exec_t;
        type rpm_var_lib_t;
        class fifo_file getattr;
        class sock_file getattr;
        class file { execute execute_no_trans map open getattr };
        class capability dac_override;
}

#============= zabbix_t ==============
allow zabbix_t self:capability dac_override;

#============= zabbix_agent_t ==============
allow zabbix_agent_t devlog_t:sock_file getattr;
allow zabbix_agent_t initctl_t:fifo_file getattr;
allow zabbix_agent_t proc_kcore_t:file getattr;
allow zabbix_agent_t rpm_var_lib_t:file open;
allow zabbix_agent_t rpm_exec_t:file { execute execute_no_trans map };
EOF
    checkmodule -m -M -o zabbix_server.mod zabbix_server.te
    semodule_package --outfile zabbix_server.pp --module zabbix_server.mod
    semodule -i zabbix_server.pp
}

■ Firewalld이 활성화된 경우

{
    firewall-cmd --add-service={http,https}
    firewall-cmd --add-port={10051/tcp,10050/tcp}
    firewall-cmd --runtime-to-permanent
}

■ Zabbix Agent 구성

vi /etc/zabbix/zabbix_agentd.conf

# line 117 : specify Zabbix server
Server=127.0.0.1

# line 164 : specify Zabbix server
ServerActive=127.0.0.1

# line 175 : change to the own hostname
Hostname=dlp.test.srv


systemctl enable --now zabbix-agent

■ httpd 설정

vi /etc/httpd/conf.d/zabbix.conf

# line 12 : add access permittion for Zabbix Web frontend if you need
# by default, All are allowed
#Require all granted
Require ip 127.0.0.1 10.0.0.0/24

systemctl restart httpd php-fpm