Zabbix agent on VSX

[Vincent_Bacher]

Hello mates,

I am curious, if anybody here has ever installed Zabbix agent on VSX environment to run Checks / scripts on virtual Systems.

If yes, sharing experience or reports what is done would be appreciated. 

Thanks and best regards 

Vincent 

[PhoneBoy]

Have you seen this? https://community.checkpoint.com/t5/Automation-and-APIs/Pointix-a-tool-to-populate-checkpoint-device...
@John_Fleming have you tested this with VSX?

[John_Fleming]

Here is our Zabbix post.

Zabbix agent is a full blow agent meant to be installed on a linux/windows box. We didn't cover doing that on a checkpoint firewall directly or VSX for that matter.

That being said, I'm in that "don't tell me how I can/can't use my tool" camp. We have all kinds of write ups on how to put things on checkpoint in interesting ways.. like.. a Fortinet VM on QEMU inside a Palo VM inside QEMU inside a Checkpoint VM (PBJ blog post).. you know.. to protect those other vendors that have.. ehem.. colorful CVE reports.

The way we approached custom things in Zabbix was custom snmp scripts (for example installed on a MDS host). We made a few to do things like monitor diskspace per CMA  dir, log dir, logdata dir etc. 

Its pretty easy to script out. I could publish to our snmp scripts to github if you wanted to use that as a baseline. 

[Vincent_Bacher]

Would be interesting.
Background for thinking about zabbix is following:
There is for instance no way to query IA values on distributed pdp environments (pdp broker using publisher and subscriber). You only see connections on the cli using "pdp b s"
So how to monitor this automatically if not using an agent?

[John_Fleming]

Show the output. I don't have that handy.

[Vincent_Bacher]

From what? 

pdp broker status?

Mentioned in the getting started guide 

have already turned off my laptop 

[John_Fleming]

yeah, I mean isn't that what you want access to? The output of that command? 

I didn't poke around the mib file. Some of that might already be in there. If its not here is the quick and dirty.

I made a script to print MDS + CMA names. (MDSnames.sh)

#!/bin/bash
. /etc/profile
MDSname=$(hostname)
echo $HOSTNAME
for x in $($MDSVERUTIL ALLCMAs)
do
echo $x
done

edit /etc/snmp/userDefinedSettings.conf

add 

extend MDSnames /bin/bash /home/admin/MDSnames.sh

restart snmp

OID would be nsExtendedOutLine.\"MDSnames\"

\" are required if doin this via command line.

output will be like

NET-SNMP-EXTEND-MIB:nsExtendOutLine."MDSnames".1 = STRING: MDS_NAME_HERE

NET-SNMP-EXTEND-MIB:nsExtendOutLine."MDSnames".2 = STRING: FIRST_CMA_HERE

etc

good luck!

[Vincent_Bacher]

Hm. Interesting approach. Maybe i can realize that in pdp as well. Thanks a lot, will have a look at it.

[Vincent_Bacher]

Again thanks for that hint. I did some tests and compiled a short script to show state of cpd using cpwd_admin list and it works with and without vsx enabled 🙂