【Rocky Linux 9】16.Zabbix設定

## Zabbix設定
サーバー監視ツールとして「Zabbix」を利用する。
Zabbixにてサーバーのシステム、Apache、MariaDBを監視する

### Zabbix Repository設定
https://www.zabbix.com/jp/download
上記にて、Zabbixのバージョン、OS、OSバージョン等を選び、適切なRepositoryをインストールする
以下の内容にて選択した際のインストール状況を記す
| 選択肢                  | 選択内容                |
|:-----------------------|:------------------------|
| Zabbixバージョン        | 6.2                     |
| OSディストリビューション | Rocky Linux             |
| OSバージョン            | 9                       |
| Zabbix Component       | Server, Frontend, Agent |
| データベース            | MySQL                   |
| Web Server             | Apache                  |

```shell-session
rpm -Uvh https://repo.zabbix.com/zabbix/6.2/rhel/9/x86_64/zabbix-release-6.2-3.el9.noarch.rpm
dnf clean all
```

### ZabbixServerインストール
```shell-session
dnf install zabbix-server-mysql zabbix-sql-scripts
```

### ZabbixAgent2インストール
```shell-session
dnf install zabbix-agent2
```

### ZabbixWebFrontendインストール
```shell-session
dnf install zabbix-web-mysql zabbix-apache-conf zabbix-web-japanese
```

### ZabbixServer用MariaDBデータベース作成
| 設定名         | 設定内容     |
|:--------------|:------------|
| データベース名 | zabbix      |
| ユーザー名     | zabbix_user |
| パスワード     | zabbix_pass |
```shell-session:mysql -u root -p
root@localhost> create database zabbix character set utf8mb4 collate utf8mb4_bin;
root@localhost> grant all privileges on zabbix.* to 'zabbix_user'@localhost identified by 'zabbix_pass';
root@localhost> flush privileges;
root@localhost> exit;
```

### ZabbixServer設定
```diff_shell:/etc/zabbix/zabbix_server.conf
- # DBHost=localhost
+ DBHost=localhost

- DBUser=zabbix
+ DBUser=zabbix_user

- # DBPassword=
+ DBPassword=zabbix_pass

- # DBSocket=
+ DBSocket=/var/lib/mysql/mysql.sock

- # DBPort=
+ DBPort=3306
```

### ZabbixServer用MariaDBスキーマ設定
```shell-session
zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -u zabbix_user -pzabbix_pass zabbix
```

### ZabbixServer起動・自動化
```shell-session
systemctl enable --now zabbix-server
```

### ZabbixAgent2起動・自動化
特に設定は必要無いが、ZabbixAgent2用のMariaDBユーザーを作成する
| 設定名         | 設定内容          |
|:--------------|:------------------|
| ユーザー名     | zabbix_agent_user |
| パスワード     | zabbix_agent_pass |
```shell-session
systemctl enable --now zabbix-agent2
```
```shell-session:mysql -u root -p
root@localhost> grant usage,replication client,process, show databases,show view on *.* to 'zabbix_agent_user'@localhost identified by 'zabbix_agent_pass';
root@localhost> flush privileges;
root@localhost> exit;
```

### Apache設定
Zabbixは「http://zabbix.example.com/」というサブドメイン運用とする
さらに「zabbix.example.com」ドメインに関してもLet's EncryptにてSSLを取得し、SSLにて運用する
```shell-session
mv /etc/httpd/conf.d/zabbix.conf /etc/httpd/conf.d/zabbix.conf.org
```
```shell-session:/etc/httpd/conf.d/virtualhost.zabbix.example.com.conf
<VirtualHost *:80>
    ServerName      zabbix.example.com
    DocumentRoot    /usr/share/zabbix
    ErrorLog        logs/zabbix.example.com/error_log
    CustomLog       logs/zabbix.example.com/access_log combined env=!no_log
</VirtualHost>

<Directory "/usr/share/zabbix">
    Options FollowSymLinks
    AllowOverride None
    Require all granted

    <IfModule dir_module>
        DirectoryIndex index.php
    </IfModule>

    <FilesMatch \.(php|phar)$>
        SetHandler "proxy:unix:/run/php-fpm/zabbix.sock|fcgi://localhost"
    </FilesMatch>
</Directory>

<Directory "/usr/share/zabbix/conf">
    Require all denied
</Directory>

<Directory "/usr/share/zabbix/app">
    Require all denied
</Directory>

<Directory "/usr/share/zabbix/include">
    Require all denied
</Directory>

<Directory "/usr/share/zabbix/local">
    Require all denied
</Directory>

<Directory "/usr/share/zabbix/vendor">
    Require all denied
</Directory>
```
```diff_shell:/etc/httpd/conf.modules.d/00-base.conf
# Required for Zabbix
- #LoadModule authz_host_module modules/mod_authz_host.so
- #LoadModule env_module modules/mod_env.so
- #LoadModule status_module modules/mod_status.so
+ LoadModule authz_host_module modules/mod_authz_host.so
+ LoadModule env_module modules/mod_env.so
+ LoadModule status_module modules/mod_status.so
```

### Apache再起動
```shell-session
mkdir /var/log/httpd/zabbix.example.com
systemctl restart httpd
```

### SSL取得（Let's Encrypt）
```shell-session
certbot certonly --webroot -w /usr/share/zabbix -m server@example.com -d zabbix.example.com -n --agree-tos
```

### Apache設定
```diff_shell:/etc/httpd/conf.d/virtualhost.zabbix.example.com.conf
<VirtualHost *:80>
    ServerName      zabbix.example.com
    DocumentRoot    /usr/share/zabbix
    ErrorLog        logs/zabbix.example.com/error_log
    CustomLog       logs/zabbix.example.com/access_log combined env=!no_log
</VirtualHost>

+ <VirtualHost *:443>
+     ServerName      zabbix.example.com
+     DocumentRoot    /usr/share/zabbix
+     ErrorLog        logs/zabbix.example.com/ssl_error_log
+     CustomLog       logs/zabbix.example.com/ssl_access_log combined env=!nolog
+     Protocols       h2 http/1.1

+     # Brotli settings
+     SetOutputFilter BROTLI_COMPRESS
+     SetEnvIfNoCase  Requst_URI \.(bmp|gif|htc|ico|jpe?g|mpe?g|png|swf|woff|ttf)$ no-brotli
+     BrotliCompressionQuality 5
+     BrotliCompressionWindow 18
+     BrotliFilterNote Input instream
+     BrotliFilterNote Output outstream
+     BrotliFilterNote Ratio ratio
+     LogFormat '"%r" %{outstream}n/%{instream}n (%{ratio}n%%)' brotli
+     CustomLog "logs/zabbix.example.com/brotli_log" brotli

+     SSLEngine       on
+     SSLCertificateFile      /etc/letsencrypt/live/zabbix.example.com/cert.pem
+     SSLCertificateKeyFile   /etc/letsencrypt/live/zabbix.example.com/privkey.pem
+     SSLCertificateChainFile /etc/letsencrypt/live/zabbix.example.com/chain.pem
+     Header always set Strict-Transport-Security "max-age=31536000"
+ </VirtualHost>
```

### Apache監視用設定
```shell-session:/etc/httpd/conf.d/virtualhost.localhost.conf
<VirtualHost *:80>
    ServerName      localhost
    DocumentRoot    /var/www/html
    ErrorLog        logs/error_log
    CustomLog       logs/access_log combined env=!nolog

    <Location "/server-status">
        SetHandler  server-status
        Require all denied
        Require local
    </Location>
</VirtualHost>
```

### PHP-FPM監視用設定
```diff_shell:/etc/php-fpm.d/www.conf
- ;pm.status_path = /status
+ pm.status_path = /php-fpm_status

- ;ping.path = /ping
+ ping.path = /php-fpm_ping
```
```diff_shell:/etc/httpd/conf.d/virtualhost.localhost.conf
    <Location "/server-status">
        SetHandler  server-status
        Require all denied
        Require local
    </Location>
+     <Location ~ /(php-fpm_status|php-fpm_ping)$>
+         SetEnv downgrade-1.0
+         SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost"
+         Require all denied
+         Require local
+     </Location>
```

### Apache・PHP-FPM再起動
```shell-session
systemctl restart php-fpm
systemctl restart httpd
```