Zabbix changed authentication method

Moohoo commented

2025-02-21 16:27:10 +00:00

What I'm trying to do and why

I use Borgmatic Docker to back up my MailCow using this tutorial: Borgmatic Backup. This works really well—thanks for that!

Now, I want to log the backup states in Zabbix (7.2). I modified my config file as described here.

I think I did everything correctly, but Zabbix doesn't receive any data. After some research, I found out that Zabbix changed something about the authentication methods in version 7.2.

My question: Is Borgmatic compatible with Zabbix 7.2?

Steps to reproduce

No response

Actual behavior

No response

Expected behavior

No response

Other notes / implementation ideas

No response

borgmatic version

No response

borgmatic installation method

Docker Container

Borg version

No response

Python version

No response

Database version (if applicable)

No response

Operating system and version

Debian 12

### What I'm trying to do and why I use Borgmatic Docker to back up my MailCow using this tutorial: [Borgmatic Backup]([url](https://docs.mailcow.email/third_party/borgmatic/third_party-borgmatic/)). This works really well—thanks for that! Now, I want to log the backup states in Zabbix (7.2). I modified my config file as described [here]([url](https://torsion.org/borgmatic/docs/how-to/monitor-your-backups/#zabbix-hook)). I think I did everything correctly, but Zabbix doesn't receive any data. After some research, I found out that Zabbix changed something about the authentication methods in version 7.2. My question: Is Borgmatic compatible with Zabbix 7.2? ### Steps to reproduce _No response_ ### Actual behavior _No response_ ### Expected behavior _No response_ ### Other notes / implementation ideas _No response_ ### borgmatic version _No response_ ### borgmatic installation method Docker Container ### Borg version _No response_ ### Python version _No response_ ### Database version (if applicable) _No response_ ### Operating system and version Debian 12

witten commented

2025-02-21 17:25:54 +00:00

Owner

The borgmatic Zabbix hook was initially implemented around the Zabbix 7.0 era—so prior to the 7.2 release. If 7.2 changed the API authentication method in a non-backwards-compatible way, then it's entirely possible that the hook won't work with it. Do you happen to have details on the authentication changes? I tried looking through some of the 7.2.x release notes but didn't find anything definitive.

Also, it may help to debug the problem to run borgmatic with --verbosity 2 and then paste the (redacted) logs here. Seeing your borgmatic Zabbix configuration would also help. Thanks!

The borgmatic Zabbix hook was initially implemented around the Zabbix 7.0 era—so prior to the 7.2 release. If 7.2 changed the API authentication method in a non-backwards-compatible way, then it's entirely possible that the hook won't work with it. Do you happen to have details on the authentication changes? I tried looking through some of the 7.2.x [release notes](https://www.zabbix.com/release_notes) but didn't find anything definitive. Also, it may help to debug the problem to run borgmatic with `--verbosity 2` and then paste the (redacted) logs here. Seeing your borgmatic Zabbix configuration would also help. Thanks!

Moohoo commented

2025-02-22 16:21:27 +00:00

Author

Since Zabbix 7.2, the "auth" parameter is no longer available. I have also read about some issues related to the Zabbix API and Grafana since version 7.2. I’m not sure to what extent the changes from Zabbix affect Borgmatic. Maybe I entered something incorrectly, but I don’t think so. My current configuration looks like this:

/opt/mailcow-dockerized/data/conf/borgmatic/etc/config.yaml
source_directories:
- /mnt/source/vmail
- /mnt/source/crypt
- /mnt/source/redis
- /mnt/source/rspamd
- /mnt/source/postfix
repositories:
- path: ssh://xxxxxx@xxxxx.xxxxxxx.xx:123/./mailcow
label: storagebox
exclude_patterns:
- '/mnt/source/postfix/public/'
- '/mnt/source/postfix/private/'
- '/mnt/source/rspamd/rspamd.sock'

keep_hourly: 24
keep_daily: 7
keep_weekly: 4
keep_monthly: 6

mariadb_databases:
- name: mailcow
username: mailcow
password: xxxxxxxxxxxxxx
options: "--default-character-set=utf8mb4 --skip-ssl"
list_options: "--skip-ssl"
restore_options: "--skip-ssl"

zabbix:
server: https://my.zabbix.server/api_jsonrpc.php

username: myzabbixuser
password: myzabbixpassword
api_key: myzabbixapikey

host: "my.hostto.monitor"
key: borg.backup.status
itemid: 49588

start:
    value: "STARTED"
finish:
    value: "OK"
fail:
    value: "ERROR"
states:

Authorization in Zabbix 7.0: Documentation
Authorization in Zabbix 7.2: Documentation
Problems in Grafana: Forum and Forum

Since Zabbix 7.2, the "auth" parameter is no longer available. I have also read about some issues related to the Zabbix API and Grafana since version 7.2. I’m not sure to what extent the changes from Zabbix affect Borgmatic. Maybe I entered something incorrectly, but I don’t think so. My current configuration looks like this: /opt/mailcow-dockerized/data/conf/borgmatic/etc/config.yaml source_directories: - /mnt/source/vmail - /mnt/source/crypt - /mnt/source/redis - /mnt/source/rspamd - /mnt/source/postfix repositories: - path: ssh://xxxxxx@xxxxx.xxxxxxx.xx:123/./mailcow label: storagebox exclude_patterns: - '/mnt/source/postfix/public/' - '/mnt/source/postfix/private/' - '/mnt/source/rspamd/rspamd.sock' keep_hourly: 24 keep_daily: 7 keep_weekly: 4 keep_monthly: 6 mariadb_databases: - name: mailcow username: mailcow password: xxxxxxxxxxxxxx options: "--default-character-set=utf8mb4 --skip-ssl" list_options: "--skip-ssl" restore_options: "--skip-ssl" zabbix: server: https://my.zabbix.server/api_jsonrpc.php username: myzabbixuser password: myzabbixpassword api_key: myzabbixapikey host: "my.hostto.monitor" key: borg.backup.status itemid: 49588 start: value: "STARTED" finish: value: "OK" fail: value: "ERROR" states: Authorization in Zabbix 7.0: [Documentation]([url](https://www.zabbix.com/documentation/7.0/en/manual/api#authorization-methods)) Authorization in Zabbix 7.2: [Documentation]([url](https://www.zabbix.com/documentation/current/en/manual/api#authorization-methods)) Problems in Grafana: [Forum]([url](https://github.com/grafana/grafana-zabbix/issues/1914#issuecomment-2532119209)) and [Forum]([url](https://github.com/grafana/grafana-zabbix/issues/1929))

Moohoo commented

2025-02-22 16:23:41 +00:00

Author

https://www.zabbix.com/documentation/current/en/manual/api#authorization-methods
https://www.zabbix.com/documentation/7.0/en/manual/api#authorization-methods
https://github.com/grafana/grafana-zabbix/issues/1914#issuecomment-2532119209
https://github.com/grafana/grafana-zabbix/issues/1929

https://www.zabbix.com/documentation/current/en/manual/api#authorization-methods https://www.zabbix.com/documentation/7.0/en/manual/api#authorization-methods https://github.com/grafana/grafana-zabbix/issues/1914#issuecomment-2532119209 https://github.com/grafana/grafana-zabbix/issues/1929

witten commented

2025-02-22 17:22:02 +00:00

Owner

Thanks for all the details! That really helps. I'll look into implementing Zabbix 7.2 support if nobody else does first. It's convenient that Zabbix 7.0 appears to also support the Authorization header as well, so the borgmatic Zabbix hook could likely just switch to using that for auth and thereby work with both 7.0 and 7.2.

Thanks for all the details! That really helps. I'll look into implementing Zabbix 7.2 support if nobody else does first. It's convenient that Zabbix 7.0 appears to also support the `Authorization` header as well, so the borgmatic Zabbix hook could likely just switch to using that for auth and thereby work with both 7.0 and 7.2.

witten referenced this issue from a commit

2025-02-22 17:27:05 +00:00

Document Zabbix server version compatibility (#1003).

Moohoo commented

2025-02-22 20:54:17 +00:00

Author

Thanks for your help. It seems I didn’t do anything wrong after all.:-)

👍 1

witten commented

2025-02-24 22:17:36 +00:00

Owner

Would you happen to have a Zabbix 7.2 instance I can use briefly for development/testing? I would use Zabbix Cloud, but they don't offer 7.2 yet. I don't need direct access to the web UI as long as I can get a temporary API token and host/key or item ID to write to.

It's okay if the answer is no; I just thought I'd ask since it'd make implementing this ticket a lot easier, given that I'm not a Zabbix user myself.

Would you happen to have a Zabbix 7.2 instance I can use briefly for development/testing? I would use Zabbix Cloud, but they don't offer 7.2 yet. I don't need direct access to the web UI as long as I can get a temporary API token and host/key or item ID to write to. It's okay if the answer is no; I just thought I'd ask since it'd make implementing this ticket a lot easier, given that I'm not a Zabbix user myself.

Moohoo commented

2025-02-25 11:16:08 +00:00

Author

So you only need access to the API via token? Is access to the "history-push" function of the API sufficient, or do you need any other functions?

witten commented

2025-02-25 17:48:40 +00:00

Owner

Yes, API access via token should be sufficient. (The code also supports username/password login, but I wasn't planning on using that for this ticket.) As for your second question, it looks like the only two API methods that borgmatic uses so far with Zabbix 7.0 are history.push and user.login. But having user.logout access may also be a good idea too.

I'm guessing that'll be sufficient for 7.2 as well. Thanks!

Yes, API access via token should be sufficient. (The code also supports `username`/`password` login, but I wasn't planning on using that for this ticket.) As for your second question, it looks like the only two API methods that borgmatic uses so far with Zabbix 7.0 are `history.push` and `user.login`. But having `user.logout` access may also be a good idea too. I'm guessing that'll be sufficient for 7.2 as well. Thanks!

Moohoo commented

2025-02-26 09:01:22 +00:00

Author

You have a new mail ;-)

witten commented

2025-02-26 17:54:28 +00:00

Owner

Thanks so much! I'm in, at least to the point of getting permissions errors, hopefully due to not using the correct Zabbix 7.2 authorization mechanism yet.

witten referenced this issue from a commit

2025-02-27 06:33:28 +00:00

In the Zabbix monitoring hook, support Zabbix 7.2's authentication changes (#1003).

witten commented

2025-02-27 06:35:18 +00:00

Owner

This is now implemented in main and will be part of the next release! Thanks again for bringing to this to my attention and for your help in supporting the development. And please feel free to delete the dev account at your leisure.

👍 1

witten closed this issue

2025-02-27 06:35:18 +00:00

Moohoo commented

2025-02-27 07:45:24 +00:00

Author

Thanks a lot, Dan! If you ever need someone with a Zabbix installation again, feel free to reach out.

👍 1

witten commented

2025-03-03 18:23:22 +00:00

Owner

Released in borgmatic 1.9.13!