Hello Community,
anyone else has faced an issue after CU202 with Zabbix plugin 7.0.21-21 that the OpenVPN connection state or expired certificate notification is not coming anymore for the users?
Best regards
Hallo @filabrasileiro
Welcome to the IPFire community.
In CU202 openvpn was updated to the 2.7 branch and this change included a change in the format of the logging information provided by openvpn.
Looking at the ovpn.conf file from zabbix, that is extracting the info it wants from the openvpn status log and so will need modification to take account of the changed status logging format.
@robinr1 is the person who is looking after the zabbix details. By referring to him in this post he will be made aware of this issue.
Hello Community,
anyone else has faced an issue after CU202 with Zabbix plugin 7.0.21-21 that the OpenVPN connection state or expired certificate notification is not coming anymore for the users?
Best regards
Thx for the hint. @bonnietwin
From the zabbix_agentd log:
execl() failed for [sudo /usr/local/bin/openvpnctrl rw log 2>/dev/null | awk -F"," ‘function unixtime(t) { gsub(/[-:]/," “,t); return mktime(t) } BEGIN { ORS = “”; print “{” } /^Updated,.+/ { printf “\“timestamp\”:%s,\“clients\”:[”,unixtime($2) } /^.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,[0-9]+,[0-9]+,.+/ { if ($1 != “Common Name”) { printf “%s{\“common_name\”:\”%s\”,\“real_address\”:\“%s\”,\“bytes_in\”:\“%s\”,\“bytes_out\”:\“%s\”,\“connected_since\”:\“%s\”}“, separator, $1, $2, $3, $4, unixtime($5); separator = “,”; } } /^ROUTING TABLE/ { print “],\“routing_table\”:[”; separator = “” } /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+,.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,.+/ { if ($1 != “Virtual Address”) { printf “%s{\“common_name\”:\”%s\”,\“virtual_address\”:\“%s\”,\“real_address\”:\“%s\”,\“last_ref\”:\“%s\”}", separator, $2, $1, $3, unixtime($4); separator = “,” } } END { print “]}” }’]: [13] Permission denied
Hi @filabrasileiro
There indeed seems to be a problem with parsing the new OpenVPN stats format as @bonnietwin pointed out. To fix this there are changes required to both the Zabbix template and the Zabbix agentd config on the IPFire machine.
For the IPFire change, I have submitted a patch, probably to be released on next CU update, so for the current CU you will need to perform this manual change:
Replace line 6 of /var/ipfire/zabbix_agentd/userparameters/userparameter_ovpn.conf from:
UserParameter=ipfire.ovpn.statusreport.get,sudo /usr/local/bin/openvpnctrl rw log 2>/dev/null | awk -F"," 'function unixtime(t) { gsub(/[-:]/," ",t); return mktime(t) } BEGIN { ORS = ""; print "{" } /^Updated,.+/ { printf "\"timestamp\":%s,\"clients\":[",unixtime($2) } /^.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,[0-9]+,[0-9]+,.+/ { if ($1 != "Common Name") { printf "%s{\"common_name\":\"%s\",\"real_address\":\"%s\",\"bytes_in\":\"%s\",\"bytes_out\":\"%s\",\"connected_since\":\"%s\"}", separator, $1, $2, $3, $4, unixtime($5); separator = ","; } } /^ROUTING TABLE/ { print "],\"routing_table\":["; separator = "" } /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+,.+,[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,.+/ { if ($1 != "Virtual Address") { printf "%s{\"common_name\":\"%s\",\"virtual_address\":\"%s\",\"real_address\":\"%s\",\"last_ref\":\"%s\"}", separator, $2, $1, $3, unixtime($4); separator = "," } } END { print "]}" }'
to:
UserParameter=ipfire.ovpn.statusreport.get,sudo /usr/local/bin/openvpnctrl rw log 2>/dev/null | awk -F"," 'function unixtime(t) { gsub(/[-:]/," ",t); return mktime(t) } BEGIN { ORS = ""; print "{" } /^Updated,.+/ { printf "\"timestamp\":%s,\"clients\":[",unixtime($2) } /^.+,.+:[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,[0-9]+,[0-9]+,.+/ { if ($1 != "Common Name") { printf "%s{\"common_name\":\"%s\",\"real_address\":\"%s\",\"bytes_in\":\"%s\",\"bytes_out\":\"%s\",\"connected_since\":\"%s\"}", separator, $1, $2, $3, $4, unixtime($5); separator = ","; } } /^ROUTING TABLE/ { print "],\"routing_table\":["; separator = "" } /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+,.+,.+:[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+,.+/ { if ($1 != "Virtual Address") { printf "%s{\"common_name\":\"%s\",\"virtual_address\":\"%s\",\"real_address\":\"%s\",\"last_ref\":\"%s\"}", separator, $2, $1, $3, unixtime($4); separator = "," } } END { print "]}" }'
and then restart the zabbix_agentd:
/etc/init.d/zabbix_agentd restart
Next you will need to download the hotfix release v197.1 of the Zabbix template: Release v197.1 - for IPFire 2.29 CU 197+ · RobinR1/zbx-template-ipfire · GitHub and import it into your Zabbix server. When done, after a few minutes, your OpenVPN clients should start showing their connection state and details again in Zabbix.
However, the error from the zabbix_agentd log you posted indicates a permission problem that I don’t see here after an upgrade to CU202. Also OpenVPN client certificate details and alerts are still looking perfectly fine here.
The symptoms you describe, seem to indicate that there is something wrong with your sudo config on your IPFire machine, which I don’t see how this can be caused by the update alone.
Did you change `/etc/sudoers.d/zabbix_agentd` manually ?
Does that file exist in your installation? It should (only) contain:
# Include file for sudoers file
#
# This is needed for some IPFire specific userparameters to be able to execute commands that only run as root (using sudo)
#
# DO NOT CHANGE THIS FILE. This file is managed by IPFire, will be overwritten on next addon upgrade and is not
# included in the backup.
#
# To add more sudo rights to zabbix agent, you should modify the sudoers file zabbix_agentd_user
#
Defaults:zabbix !requiretty
zabbix ALL=(ALL) NOPASSWD: /opt/pakfire/pakfire status, /usr/sbin/fping, /usr/sbin/arping, /usr/local/bin/getipstat
zabbix ALL=(ALL) NOPASSWD: /usr/local/bin/openvpnctrl rw log, /usr/local/bin/wireguardctrl dump
zabbix ALL=(ALL) NOPASSWD: /var/ipfire/zabbix_agentd/scripts/ipfire_certificate_detail.sh
zabbix ALL=(ALL) NOPASSWD: /var/ipfire/zabbix_agentd/scripts/ipfire_services.pl
Does:
sudo -u zabbix sudo /usr/local/bin/openvpnctrl rw log
return Permission denied? or does it return OpenVPN stats ?
Hi @robinr1 ,
thx you so much for your effort. Now it’s working again. All OpenVPN values are shown in Zabbix.
Best regards