5 What's new in Zabbix 6.4.0

New menu layout

The new version features an updated menu layout, which includes the following changes:

• Dashboards now are a top-level menu entry (previously Dashboard under the Monitoring menu)
• A new Alerts top-level menu has been added, which contains submenus related to alerting such as Actions, Media types and Scripts
  • Actions has a submenu with all types of actions (including Service actions, previously under Services)
• A new Users top-level menu has been added, which contains submenus related to user management such as User groups, User roles, Users, API tokens and Authentication
• A new Data collection menu replaces the previous Configuration menu and contains subsections that are related to configuring data collection (with actions moved to Alerts)
• The Audit section has been renamed to Audit log under Reports
• The Administration menu no longer contains submenus related to alerting and user management. Also:
  • Housekeeping, Macros and Audit log that previously were submenus of Administration -> General have been moved one level up and now are submenus of Administration

The new menu in full can be seen in frontend sections.

Note that access to the new menu depends on the user type and defined user role (see Permissions for more details).

Cause and symptom problems

The new version comes with an option to mark problems as cause or symptom problems.

For example, power outage may be the real reason why some host is unreachable or some service is down. In this case, the "host is unreachable" and "service is down" problems may be classified as symptom problems to "power outage" - the cause problem.

Symptom problems are grouped under the cause problem and marked accordingly, with an icon, smaller font and different background. The cause problem has a number showing how many symptoms are attributed to it.

By default all new problems are classified as cause problems. It is possible, in Monitoring -> Problems, to manually reclassify certain problems as symptom problems of the cause problem.

It is also possible to reclassify a symptom problem back to a cause problem.

See also: Cause and symptom problems.

Streaming to external systems

It is now possible to stream item values and events from Zabbix to external systems over HTTP (see protocol details). The tag filter can be used to stream subsets of item values or events.

The following steps are required to configure data streaming to an external system:

• Have a remote system set up for receiving data from Zabbix (see the documentation of a simple receiver;
• Set the required number of connector workers in Zabbix (see StartConnectors in zabbix_server.conf). Restart the Zabbix server.
• Configure a new connector in Zabbix (Administration -> General -> Connectors) with the receiver URL and other parameters.

When the connector has been saved, Zabbix will start sending data to the data receiver.

See also: Streaming to external systems

In this development, two new processes have been added to Zabbix server: connector manager and connector worker. A new Zabbix internal item zabbix[connector_queue] allows to monitor the count of values enqueued in the connector queue.

LDAP/SAML user provisioning

It is now possible to configure JIT (just-in-time) user provisioning for LDAP/SAML users. In this case, it is not required that a user already exists in Zabbix. The user account can be created when the user logs into Zabbix for the first time.

In addition to automatic user creation and updating the new functionality also allows to specify user group and user media matching between LDAP/SAML and Zabbix.

Provisioned users will be marked in the user list by a date entry in a new Provisioned column. Also, a Provision now option has been added to the user list to update users created from LDAP.

See also:

• LDAP authentication
• SAML authentication
• SAML setup with Okta
• Users

Optimized SNMP discovery and collection

A new snmp.walk(OID1,OID2,...) item has been added as SNMP agent item. For example,

snmp.walk[1.3.6.1.2.1.2.2.1.2,1.3.6.1.2.1.2.2.1.3]

will return a multi-line list of interface names and types.

The snmp.walk[] item returns the output of the snmpwalk utility with -Oe -Ot -On parameters. MIB names are supported as parameters; thus snmp.walk[1.3.6.1.2.1.2.2.1.2] and snmp.walk[ifDescr] will return the same output.

If several OIDs/MIBs are specified, i.e. snmp.walk[ifDescr,ifType,ifPhysAddress], then the output is a concatenated list.

This item uses GetBulk requests with SNMPv2 and v3 interfaces and GetNext for SNMPv1 interfaces; max repetitions for bulk requests are configured on the interface level.

Two new preprocessing steps have been added:

• SNMP walk value - extract and format SNMP walk value by the specified OID/MIB name;
• SNMP walk to JSON - convert SNMP walk values to JSON. This step may be used in low-level discovery of SNMP OIDs.

See also:

• SNMP agent checks
• Item preprocessing
• SNMP OID discovery

Thread-based preprocessing workers

The item value preprocessing has been rewritten to use thread-based preprocessing workers for enhanced parallelism and reduced overhead. This change adds a new required library for Zabbix server/proxy - libevent_pthreads.

See also: Preprocessing details

Context menu

Context menus for items, hosts, and events have become more functional.

New options

• Host context menu now offers options to navigate to the lists of host items, triggers, discovery rules, or web scenarios to quickly access configuration of the required entity.

• Item context menu now offers options to:

  • see all triggers based on an item and navigate to the configuration of any of them.
  • create a new trigger, a dependent item, or a discovery rule based on the item.
  • switch to the Latest data section filtered by the current host and item.

• Event context menu now offers options to:

  • acknowledge or update a problem.
  • see all items used by a problem trigger and navigate to the configuration of any of them.

Note that links to the configuration section are only visible to Admin and Super admin level users with sufficient permissions.

Custom links

Host context menu and event context menu can be customized further by adding custom links. In the Alerts → Scripts menu section, it is now possible to add a global script of the new type URL. If configured, such links will be visible in the context menu of matching hosts/problem events.

Configurable trigger URL label

When configuring a trigger, it is now possible to add a custom label to a trigger URL. If configured, the custom label will be displayed instead of the default label (Trigger URL) in the event context menu.

Additional item menu location

Item context menu is now also available in:

• Data collection → Hosts → Items
• Data collection → Hosts → Discovery rules → Item prototypes

Dashboard widgets

Secure password change

When changing your user password in User profile or User configuration (for users with the Super admin role), Zabbix now asks and verifies the current (old) password to allow changing it. On a successful password change, the user will be logged out of all active sessions. Note that the password can only be changed for users using Zabbix internal authentication.

CSRF tokens

For enhanced security against CSRF (Cross Site Request Forgery) attacks, Zabbix frontend now uses randomly generated CSRF tokens instead of static session-based tokens.

Dynamic background color for Item Value widget

The Item Value widget now allows to configure a dynamic background color based on the latest received value.

Renaming data sets in Graph widget

When configuring a Graph widget, it is now possible to rename data sets by customizing the Data set label. This makes it easier to identify data sets in widget configuration, as well as identify aggregated data sets in graph Legend.

Decimal places for item values in Top hosts widget

When configuring columns of data type "Item value" in the Top hosts widget, it is now possible to specify how many decimal places will be displayed with the value.

Dynamic item renamed to Enable host selection

The field that enables dynamic widgets has been renamed from Dynamic item to Enable host selection for more clarity.

Easier media type configuration

Automated processes for Gmail/Office365 media types

Gmail or Office365 users may now benefit from easier media type configuration. The new Email provider field in the mail media type configuration allows to select pre-configured options for Gmail and Office 365 (alongside the "Generic SMTP" option, which works as before).

When selecting the Gmail/Office365 related options, it is only required to supply the sender e-mail address/password to create a working media type.

As soon as the e-mail address/password is supplied, Zabbix will be able to automatically fill all required settings for Gmail/Office365 media types with the actual/recommended values, i.e. SMTP server, SMTP server port, SMTP helo, and Connection security. Because of this automation, these fields are not even shown, however, it is possible to see the SMTP server and e-mail details in the media type list (see the Details column).

Note also that:

• The password is not required for the relay options
• For Office365 relay, the domain name of the provided e-mail address will be used to dynamically fill the SMTP server (i.e. replace "example.com" in example-com.mail.protection.outlook.com with the real value)
• The SMTP helo value is the domain name extracted from the provided e-mail address

In other changes:

• The SMTP email field is now called simply Email
• The SMTP helo field is now optional (if empty, it will send the domain part of the sender email)
• New default media types have been added: Gmail, Gmail relay, Office365, Office365 relay
• In new installations, all media types are disabled by default
• In user media, where specific recipient addresses are specified, only enabled media types can be selected
• In user media, there is now a yellow icon and status column shown indicating if the media type has been disabled

See also:

• Email media type
• Media types
• User media
• User profile media

Notification macros in alert scripts

Alert script parameters now support user macros and all built-in macros that are supported in Zabbix notifications (including in trigger-based, autoregistration, discovery, internal, and service notifications) in addition to the {ALERT.*} macros supported previously.

Alert script testing form has been updated to allow specifying custom parameter values for the test procedure.

Interface not required for some checks

It is no longer required to define an interface when creating items of the following type:

• Simple check
• External check
• SSH agent
• Telnet agent

The interface field for these items is no longer mandatory. Also, it is now possible to select a "None" option in the interface field.

Instant refresh of active checks

Previously Zabbix agent (in active mode) received from Zabbix server or Zabbix proxy a full copy of the configuration once every two minutes (default). By introducing incremental configuration sync, full configuration is no longer sent when there are no changes to host or global regular expressions, thus default sync interval has been reduced to 5 seconds.

'RefreshActiveChecks' parameter supported in a Zabbix agent configuration file default value is changed to 5 seconds (previously 120).

JSON protocol for active agent checks has been updated to include config_revision and session ID. For more information, see Passive and active agent checks.

Value cache optimization

Previously, value cache was optimized for working with frequently changing data. Values for items that were updated less than daily were removed from value cache.

Now, value cache is optimized for a wider variety of monitoring patterns. Item values remain in value cache until the item is deleted or until the item value is outside the time or count range specified in the trigger/calculated item expression.

For more information, see Value cache.

Optimized proxy configuration update

In previous Zabbix versions, the server would send a full copy of the configuration to the proxy every time the configuration is synced.

Now it has been replaced with an incremental update of the proxy configuration. During a configuration sync only those entities are updated that have been changed; if there has been no change, nothing is sent. This approach allows to save resources and set a smaller interval (down to almost instant) for the proxy configuration update.

Proxy configuration changes are tracked using revision numbers. Only entities with revisions larger than the proxy configuration revision are included in configuration data sent to the proxy.

The entities for a configuration sync are as follows:

That means:

• If an item is changed on a host, all configuration of that host will be synced.
• If a regular expression is changed, all regular expressions will be synced.

An exception are the host macros which are sent also if anything on the host has been changed.

The -R config_cache_reload command on the proxy will also initiate an incremental update.

Note that a full configuration sync will take place on a proxy start/restart, HA failover, if the session token has changed, or if the configuration update failed on the proxy, for example, if the connection was broken while receiving configuration data.

Configuration parameters

The ProxyConfigFrequency is a new parameter for active proxies, which must be used instead of ConfigFrequency (now deprecated).

The default of ProxyConfigFrequency has been reduced from 3600 to 10 seconds, both on the server and the proxy, with the range remaining the same (1-604800). Also, the default value of CacheUpdateFrequency on the server has been lowered from 60 to 10 seconds.

Configuration parameters

The ProxyConfigFrequency parameter determines how often the proxy configuration is synced with the server (now 10 seconds by default).

Note that ProxyConfigFrequency is:

• the server parameter for passive proxies
• the proxy parameter for active proxies

On active proxies ProxyConfigFrequency is a new parameter and must be used instead of the now-deprecated ConfigFrequency.

Also, the default value of CacheUpdateFrequency on the server has been lowered from 60 to 10 seconds.

Higher limit for host metadata

The HostMetadataItem parameter in agent configuration, used in host autoregistration, now can return up to 65535 UTF-8 code points (instead of 255 in previous versions). A longer value will be truncated.

Note that on MySQL, the effective maximum length in characters will be less if the returned value contains multibyte characters. For example, a value containing 3-byte characters only will be limited to 21844 characters in total, while a value containing 4-byte characters only will be limited to 16383 symbols.

Also, the maximum length of the HostMetadata option in agent configuration has been increased to 2034 bytes.

Items

New items

A new system.sw.packages.get item has been added to Zabbix agent/agent 2 that returns information about installed packages in JSON format. In comparison to the existing system.sw.packages item, the new item returns more details.

See Zabbix agent items for more details.

Additional ssh.run options

The item ssh.run[] has been updated and now allows to pass additional SSH options as part of the item key. See SSH checks for details.

Templates

New templates are available:

• AWS RDS instance by HTTP
• AWS S3 bucket by HTTP
• Azure by HTTP
• OPNsense by SNMP

See setup instructions for HTTP templates.

Template versioning

To improve management and upgrade of templates, template versioning has been introduced.

In Data collection → Templates you can now see the template vendor and version, as well as filter templates by vendor and/or version.

For more information, see Upgrade notes for 6.4.0.

Updated templates

The templates Windows by Zabbix agent and Windows by Zabbix agent active have been updated and now include the system.sw.os item and a new trigger for monitoring system version changes.

Zabbix templates that discover filesystems now make use of the vfs.fs.get item instead of vfs.fs.discovery and:

• The update interval for the discovery has been reduced to one minute
• Item prototypes are now dependent on the vfs.fs.get master item
• A trigger to detect volumes that remounted in read-only mode has been added to UNIX templates
• Filters have been added to filter bind mounts on Linux and .dmg volumes on macOS in the respective templates

Performance

Zabbix server support for older proxies

In a server-proxy setup, the upgrade procedure has become more flexible. Now, Zabbix server officially supports data collection, execution of remote commands, and immediate item value checks by outdated proxies that are no older than Zabbix server previous LTS release version. Older proxies are not supported, and all communication with Zabbix server will fail with a warning. For more information, see Upgrade procedure.

Runtime commands for profiling

Runtime commands for profiling have been added to Zabbix server and Zabbix proxy.

• prof_enable - enable profiling
• prof_disable - disable profiling

Profiling can be enabled per server/proxy process. Enabled profiling provides details of all rwlocks/mutexes by function name.

See also:

• Zabbix server runtime commands
• Zabbix proxy runtime commands

Date removed from export

When exporting objects (hosts, templates, etc.), note that the element date is removed from the export format.

SQLite Database automatically dropped

Now, when Zabbix proxy, if it uses SQLite3, on startup detects that the existing database file version is older than required, it will delete the database file automatically and create a new one. Hence, Zabbix does not require administrators to delete the database file manually. Therefore, history data stored in the SQLite database file will be lost

Heartbeats are dropped from proxies

Now, heartbeat sender is removed from a proxy, and therefore, Zabbix proxy zabbix [process,heartbeat sender] item is not supported and is removed from templates. However, for older versions of proxies HeartbeatFrequency parameter is deprecated.

UI improvements

Ack link renamed to update

The link from the problem list to the problem update screen has been renamed from Ack (Acknowledge) to Update to correctly reflect multiple options that are available in the problem update screen in recent versions (not only acknowledgment).

Additonally, when a problem has been acknowledged it no longer displayed by the color of the link; it is now displayed by a green checkbox icon in the Actions column.

Filtering hosts by status in Data collection → Hosts

Hosts displayed in the Data collection → Hosts section can now be filtered by status (enabled/disabled).

New filtering options

New filtering options have been added to Reports → Action log section. In addition to filtering records by notification recipients, now you can also filter records by actions, media types, status, or by the message/remote command content. These filtering options can also be configured for the Action log widget.

Data export to CSV

It is now possible to export action log records to a CSV file. For more information, see Action log.

Security

Configuration import

The configuration import form for templates/hosts has a new row for All entities in the import rules section.

If you mark the checkbox in the All row, all importable entities become marked/unmarked.

To see the full list of entities in the import rules, it is now required to mark the Advanced options checkbox. In another change, the Delete missing option is now checked by default.

Frontend languages

Catalan language is now enabled in the frontend.

Frontend

Miscellaneous

• In the graph widget configuration, autocomplete functionality has been improved. The item pattern field suggestions now only display the items that belong to the hosts selected in the host pattern field. See also graph widgets for details.