[ZBX-24800] Remote command not executed on proxy but on server Created: 2024 Jul 06  Updated: 2025 Apr 16  Resolved: 2024 Aug 10

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Proxy (P), Server (S)
Affects Version/s: 7.0.0
Fix Version/s: 7.0.3rc1, 7.2.0alpha1

Type: Problem report Priority: Trivial
Reporter: Markku Leiniö Assignee: Vladislavs Sokurenko
Resolution: Fixed Votes: 13
Labels: None
Remaining Estimate: Not Specified
Time Spent: 8h
Original Estimate: Not Specified
Environment:

Zabbix server 7.0.0
Zabbix proxy 7.0.0
Zabbix agent 7.0.0 on Linux

Attachments: PNG File image-2024-07-11-03-16-44-382.png     PNG File image-2024-08-08-15-16-03-520.png     PNG File image-2024-08-08-15-19-33-714.png    
Issue Links:
Duplicate
is duplicated by ZBX-25007 Action operation scripts always trigg... Closed
is duplicated by ZBX-25136 Zabbix preprocessing JavaScript not b... Closed
is duplicated by ZBX-26304 script not executed on proxy but on ... Confirmed
Team: Team B
Sprint: S24-W32/33
Story Points: 0.25

 Description   

Idea of the steps: Have an agent monitored by a proxy, item and trigger, have a remote script run on the proxy on a trigger, observe where the script is run.

Steps to reproduce:

  1. Create a host "Zabbix70-agent" that is monitored by a proxy
  2. Create an item on the host: key "actiontest", type Zabbix trapper
  3. Create a trigger "Actiontest is 1" for the item: last(/Zabbix70-agent/actiontest) = 1
  4. In Alerts - Scripts, create script:
  • Name: Actiontest script
  • Scope: Action operation
  • Type: Script
  • Execute on: Zabbix proxy or server
  • Commands: (date; hostname) >> /tmp/hostname
  1. In Alerts - Actions - Trigger actions, create action:
  • Name: Actiontest
  • Conditions: Trigger equals Zabbix70-agent: Actiontest is 1
  • Operations: Add, select "Actiontest script", target list = Current host
  1. Enable remote commands on the Zabbix server and proxy configurations: EnableGlobalScripts=1 (server) and EnableRemoteCommands=1 (proxy)
  2. Use Zabbix sender on the agent host to send the value 1 for the key "actiontest" to the proxy
  3. See that the problem is generated in the Problems list
  4. Observe where the /tmp/hostname file is created.

Result:

On the Zabbix server there is now /tmp/hostname that has the problem date+time and the server hostname.

Expected:

Since the script was configured with "Execute on: Zabbix proxy or server" it is expected that the /tmp/hostname file was created (= script run) on the proxy because the host was monitored by proxy.

Documentation:

https://www.zabbix.com/documentation/7.0/en/manual/web_interface/frontend_sections/alerts/scripts says about the "Execute on" setting:

"Zabbix proxy or server - the script will be executed by Zabbix proxy or server - depending on whether the host is monitored by proxy or server."

Other comments:

If EnableGlobalScripts is disabled on the server, then the remote command execution fails: "Global script execution on Zabbix server is disabled by server configuration"

 Comments   
Comment by Dwight Coyle [ 2024 Jul 11 ]

I have also experienced this issue on Zabbix 7.0.0. I have a script that is configured to execute when a certain trigger fires on a host that is monitored by proxy.

Instead of the script executing on the appropriate proxy, it was executed on the server instead.

This line was found in the logs on the Zabbix server:

786:20240710:130317.763 Failed to execute command "snmpset -v3 -u ###### -l authPriv -A ################ -X ################ ######.###.### 1.3.6.1.4.1.9.6.1.104.1.1.2.1.0 i 1": sh: 1: snmpset: not found

The command failed because snmpset is not available on my Zabbix server, but it is available on the proxy. If I executed the script manually via the Zabbix UI, it runs correctly via the proxy (in this case, an SNMP command to reboot a Cisco WAP371).

This issue appears to be new to Zabbix 7.0.

Comment by Brahyan Rosano [ 2024 Jul 11 ]

I'm having this issue too extended to agents, all in version 7.0

if I set that script has to be executed on "zabbix agent" in a host monitored by a proxy, is the server that is looking for the agent to run the command (not the proxy), and failing since are on other networks

If I set that script to be executed on "zabbix proxy or server" option, is the server that run the command anyway

There is nothing related to command execution on zabbix agent or proxy logs, but zabbix server logs this

Execute on zabbix agent option: (server tries to connect to the agent for command execution instead of using the proxy)

   217:20240711:170949.774 query [txnlev:0] [select h.hostid,h.proxyid,h.host,s.type,s.scriptid,s.execute_on,s.port,s.authtype,s.username,s.password,s.publickey,s.privatekey,s.command,s.groupid,s.scope,s.timeout,s.name,h.tls_connect,h.ipmi_authtype,h.ipmi_privilege,h.ipmi_username,h.ipmi_password,h.tls_issuer,h.tls_subject,h.tls_psk_identity,h.tls_psk from opcommand o,opcommand_hst oh,hosts h,scripts s where o.operationid=oh.operationid and o.scriptid=s.scriptid and oh.hostid=h.hostid and o.operationid=69 and h.status=0 union all select 0,0,null,s.type,s.scriptid,s.execute_on,s.port,s.authtype,s.username,s.password,s.publickey,s.privatekey,s.command,s.groupid,s.scope,s.timeout,s.name,1,0,2,null,null,null,null,null,null from opcommand o,opcommand_hst oh,scripts s where o.operationid=oh.operationid and o.scriptid=s.scriptid and o.operationid=69 and oh.hostid is null]
   217:20240711:170949.775 In substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:170949.775 End substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:170949.775 In substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:170949.775 End substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:170949.775 In zbx_dc_get_nextid() table:'alerts' num:1
   217:20240711:170949.775 End of zbx_dc_get_nextid() table:'alerts' [508164:508164]
   217:20240711:170949.775 In zbx_script_prepare()
   217:20240711:170949.775 End of zbx_script_prepare():SUCCEED
   217:20240711:170949.775 In zbx_script_execute()
   217:20240711:170949.775 In passive_command_send_and_result_fetch()
   217:20240711:170949.775 In substitute_simple_macros_impl() data:'10050'
   217:20240711:170949.775 End substitute_simple_macros_impl() data:'10050'
   217:20240711:170949.775 In zbx_agent_get_value() host:'clt-zabbix-proxy' addr:'127.0.0.1' key:'system.run[echo OK
touch /tmp/zabbix-test-remote,nowait]' conn:'unencrypted'
   217:20240711:170949.775 In zbx_is_ip4() ip:'127.0.0.1'
   217:20240711:170949.775 End of zbx_is_ip4():SUCCEED
   217:20240711:170949.775 poll(POLLOUT) failed with revents 0x1c
   217:20240711:170949.775 End of zbx_agent_get_value():NETWORK_ERROR
   217:20240711:170949.775 End of passive_command_send_and_result_fetch():FAIL
   217:20240711:170949.775 End of zbx_script_execute():FAIL
   217:20240711:170949.775 In add_command_alert()
   217:20240711:170949.775 End of add_command_alert()

Execute on zabbix proxy or server option: (run on server, creates /tmp/zabbix-test-remote file on server instead of proxy)

   217:20240711:164149.565 In zbx_event_db_get_host()
   217:20240711:164149.565 query [txnlev:0] [select distinct h.hostid,h.proxyid,h.host,h.tls_connect,h.ipmi_authtype,h.ipmi_privilege,h.ipmi_username,h.ipmi_password,h.tls_issuer,h.tls_subject,h.tls_psk_identity,h.tls_psk from functions f,items i,hosts h where f.itemid=i.itemid and i.hostid=h.hostid and h.status=0 and f.triggerid=15722]
   217:20240711:164149.565 End of zbx_event_db_get_host():SUCCEED
   217:20240711:164149.565 In substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:164149.565 End substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:164149.565 In substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:164149.565 End substitute_simple_macros_impl() data:'echo OK
touch /tmp/zabbix-test-remote'
   217:20240711:164149.565 In zbx_dc_get_nextid() table:'alerts' num:1
   217:20240711:164149.565 End of zbx_dc_get_nextid() table:'alerts' [508130:508130]
   217:20240711:164149.565 In zbx_script_prepare()
   217:20240711:164149.565 End of zbx_script_prepare():SUCCEED
   217:20240711:164149.565 In zbx_script_execute()
   217:20240711:164149.565 In zbx_popen() command:'echo OK
touch /tmp/zabbix-test-remote'
   231:20240711:164149.565 zbx_setproctitle() title:'trapper #5 [processed data in 0.000678 sec, waiting for connection]'
   229:20240711:164149.565 zbx_setproctitle() title:'trapper #3 [processed data in 0.001066 sec, waiting for connection]'
   228:20240711:164149.565 zbx_setproctitle() title:'trapper #2 [processed data in 0.004311 sec, waiting for connection]'
   230:20240711:164149.565 zbx_setproctitle() title:'trapper #4 [processed data in 0.002374 sec, waiting for connection]'
   227:20240711:164149.566 In zbx_tls_accept()
   227:20240711:164149.566 zbx_psk_server_cb() requested PSK identity "PSK-clt"
   217:20240711:164149.566 End of zbx_popen():21
   301:20240711:164149.566 zbx_popen(): executing script
   227:20240711:164149.568 End of zbx_tls_accept():SUCCEED (established TLSv1.3 TLS_CHACHA20_POLY1305_SHA256)
   227:20240711:164149.568 zbx_setproctitle() title:'trapper #1 [processing data]'
   227:20240711:164149.568 In zbx_ipc_async_socket_recv() timeout:0
   227:20240711:164149.568 End of zbx_ipc_async_socket_recv():0
   233:20240711:164149.569 End of zbx_ipc_async_socket_recv():0
   200:20240711:164149.569 End of zbx_ipc_service_recv():2

 

Edit: Just adding that works fine to me with scope "manual host action", the issue above happen with scope "action operation"

 

Comment by Harrison Glotz [ 2024 Jul 16 ]

We're seeing the same issues as brah. Previously our proxy would handle the execution of remote commands for agents. It seems after upgrading to version 7.0.0 the main server has taken on this responsibility. Since we don't have the main server listed under the Server= option in the agent conf file, we're seeing failures.

 

 

Comment by Nate Curry [ 2024 Jul 18 ]

We are also seeing the same issues related to proxy with our hosts after we migrated to 7.0.  Remote commands are failing on hosts monitored by proxies.  Any hosts monitored by the server are able to run remote commands.  No logs in the proxy or agent hosts related to the remote commands are showing up, only on the server do we see the command being run.

Comment by Antonio Moletta [ 2024 Jul 24 ]

Save issue after the upgrade to version 7.

Comment by Piero Bendato [ 2024 Jul 25 ]

Same issue after upgrading to v7.0.1.

Comment by Fabian S. [ 2024 Aug 02 ]

Can confirm this problem still exists on v7.0.2

Comment by John Russell [ 2024 Aug 07 ]

I believe the priority on this is more than trivial.  One of our proxies sits in the DMZ monitoring various external system and services.  Trigger actions using remote commands(scripts) cannot execute.  The primary Zabbix server has no communication into the dmz other that the proxy.

I should add that in our case, the action is set to execute on the agent(monitored by proxy). the command is powershell -NoProfile -ExecutionPolicy bypass -command "get-service screen* | start-service"

If  a device is monitored by zabbix server, this works.  If monitored by proxy, it does not. No error is logged in front end.  Simply states "failed"

Comment by Piero Bendato [ 2024 Aug 07 ]

We have dozens of proxies in these situations. I fully agree that this is definitely not a "trivial" issue.

Comment by Brahyan Rosano [ 2024 Aug 08 ]

I agree it's not "Trivial - Cosmetic problem like misspelt words or misaligned text.", this is the only reason I didn't update yet

 

Is there a way to change severity o report to someone who can change it?

Comment by Antonio Moletta [ 2024 Aug 08 ]

Version 7 has just a few dashboard widgets more and nothing else.
I think it cannot be a reason for a major release update.

Another issue is the import process of official templates, that fails due to missed tags, so there a lot of other open bugs.

Comment by Markku Leiniö [ 2024 Aug 08 ]

Issue assignee hasn't had much public Jira activity lately, but maybe sasha can check if this has the attention it needs?

Comment by Alexander Vladishev [ 2024 Aug 08 ]

Thank you for your report! I was able to reproduce the described issue. We will fix it as soon as possible.

Comment by Vladislavs Sokurenko [ 2024 Aug 08 ]

Fixed in pull request feature/ZBX-24800-7.1

Comment by Markku Leiniö [ 2024 Aug 08 ]

Looks promising, thanks!

Comment by Vladislavs Sokurenko [ 2024 Aug 08 ]

Fixed in:

Comment by Markku Leiniö [ 2024 Aug 12 ]

Fix version = 7.0.3rc1 but not mentioned in the release notes: https://www.zabbix.com/rn/rn7.0.3rc1

Comment by Alexander Vladishev [ 2024 Aug 12 ]

Thank you for your comment. We indeed forgot to add the information to the ChangeLog. We will add it shortly.

Generated at Sat Apr 26 04:28:06 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.