[ZBX-25184] PGRES_FATAL_ERROR with fresh installation (NGINX + PostgreSQL + TimescaleDB + Zabbix 7.0.X) into Zabbix Server logs Created: 2024 Sep 05  Updated: 2026 Jun 08  Resolved: 2026 Jun 08

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Documentation (D), Server (S)
Affects Version/s: 7.0.2, 7.0.3
Fix Version/s: None

Type: Problem report Priority: Trivial
Reporter: Andrea Marconi Assignee: Tomass Janis Bross
Resolution: Cannot Reproduce Votes: 1
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

One test with 3 VMs:

  • Ubuntu 24.04 with Zabbix 7.0.2 (Backend) or Zabbix 7.0.2 (Backend) installed.
  • Ubuntu 24.04 with NGINX (Frontend) installed.
  • Ubuntu 24.04 with PostgreSQL 16.4 + TimescaleDB 2.15.2 installed

Another test with 3 containers:

  • zabbix/zabbix-server-pgsql:ubuntu-latest
  • zabbix/zabbix-web-nginx-pgsql:ubuntu-latest
  • timescale/timescaledb:latest-pg16

Attachments: JPEG File drop_chunks error.jpg     JPEG File zabbix-roles.jpg     HTML File zabbix-server-pgsql-public-schema.html     JPEG File zbx_ts_unix_now() error.jpg    
Issue Links:
Duplicate

 Description   

Good evening,

I am experiencing difficulties while setting up a new Zabbix infrastructure as outlined in the environment section. I have followed the documentation provided:

I applied the same procedure to two new Zabbix infrastructures (VMs or containers). For each test, I conducted two sub-tests:

  1. Using the public schema (default)
  2. Using the Zabbix schema (custom as per the documentation)

 

Steps to Reproduce:

  1. Created a usr_owner and the database with that owner as described in the documentation.
  2. Configured a secure schema (only for the sub-test with zabbix schema); Please note the typo with the double quotes around “zabbix”. The correct command should be: ALTER ROLE ALL IN DATABASE zabbix SET search_path = "zabbix"; instead of ALTER ROLE ALL IN DATABASE zabbix SET search_path = "zabbix";
  3. Set up the database using schema.sql, images.sql, and data.sql.
  4. Create a role and then a user with that role assigned for Zabbix Server communication with the database.
  5. Enable TimescaleDB using the command provided in the documentation:
    • One sub-test without the “WITH SCHEMA zabbix” substring when using the public schema.
    • The other sub-test including it since I used the "zabbix" schema.
  6. Use the script /usr/share/zabbix-sql-scripts/postgresql/timescaledb/schema.sql to create hypertables and compression.
  7. Start the Zabbix Server service (Backend).
  8. Check for errors in the logs in zabbix_server.log

Result: Please see the log file screenshot “zabbix-server-pgsql-public-schema.html”.

Expected: No errors in the logs.

 

Comments:

It appears that the function zbx_ts_unix_now cannot be executed by a user belonging to the zbx_srv role as documented. More importantly, there seems to be an issue preventing that user from having permissions on the Zabbix schema, even though they actually do have them.

Additionally, after reviewing the screenshot “zabbix-roles.jpg”, I suspect that the “zbx_srv” section might be incorrect. Without the CREATE permission on the schema (whether public or Zabbix), errors such as the following appear (please refer to the screenshot “zbx_ts_unix_now() error.jpg”):

  • PGRES_FATAL_ERROR: ERROR: permission denied for schema public (or zabbix)
  • [create or replace function zbx_ts_unix_now() returns integer language sql stable as select extract(epoch from now())::integer]
  • 826:20240905:130548.305 [Z3005] query failed: [0] PGRES_FATAL_ERROR: ERROR: function “zbx_ts_unix_now” does not exist

I am also encountering drop_chunks errors as shown in the “drop_chunks error.jpg” screenshot, along with messages like “must be owner of hypertable history”.

I am unsure how to resolve these issues, especially since this is a fresh and clean installation. Any assistance would be greatly appreciated

 

Thank you very much.

Best regards.

 Comments   
Comment by Andrea Marconi [ 2024 Sep 06 ]

Good Morning,

I would like to clarify that when I refer to point 7, “Start the Zabbix Server service (Backend),” I am indicating the use of the user created specifically for this purpose (point 4) in the Zabbix Server configuration file (e.g., the user “usr_srv” with the role “zbx_srv” as recommended in the documentation).

Additionally, at point 2, the fixed query is:

ALTER ROLE ALL IN DATABASE zabbix SET search_path = 'zabbix';

Thank you.

Comment by Tomass Janis Bross [ 2025 Jul 09 ]

Hello Andrea,
As I understand, up until point 6., where you execute the creation TSDB schema, you can start the Zabbix Server service, and it works as expected ?

I would also like for you to go into more details regarding these statements:

    One sub-test without the “WITH SCHEMA zabbix” substring when using the public schema.
    The other sub-test including it since I used the "zabbix" schema.

Please let us know precisely what commands you used.

Comment by Andrea Marconi [ 2025 Jul 14 ]

Hello Tomass,

It's been nearly a year since this issue occurred, so I don't recall all the details clearly—especially since I ended up reinstalling Zabbix from scratch without using database roles.

That said, I'm curious to know whether the documentation and the role-based setup have since been updated to avoid the previous permission issues (such as problems with dropping hypertables or ownership conflicts).

Regarding the statements you quoted: they refer to my attempts to perform the same procedure using both the zabbix schema and the public schema.

For reference, here are the commands I used at the time:

 

CREATE SCHEMA zabbix AUTHORIZATION own_zbx;
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE ALL ON DATABASE zabbix FROM PUBLIC;
ALTER ROLE ALL IN DATABASE zabbix SET search_path = 'zabbix';

CREATE ROLE zbx_srv;
GRANT CONNECT ON DATABASE zabbix TO zbx_srv;
GRANT USAGE ON SCHEMA zabbix TO zbx_srv;

ALTER DEFAULT PRIVILEGES FOR ROLE own_zbx IN SCHEMA zabbix GRANT DELETE, INSERT, SELECT, UPDATE ON TABLES TO zbx_srv;

ALTER DEFAULT PRIVILEGES FOR ROLE own_zbx IN SCHEMA zabbix GRANT SELECT, UPDATE, USAGE ON sequences TO zbx_srv;

CREATE USER usr_test WITH ENCRYPTED password '<password>';
GRANT zbx_srv TO usr_test;

Thank you for your support.
Best regards,

Comment by Andrea Marconi [ 2026 Jan 27 ]

Hello, any news about this problem? Thank you very much.

Comment by Tomass Janis Bross [ 2026 Jun 08 ]

Perhaps the older instructions were faulty, but I was able to basically just copy-paste from the following links:
https://www.zabbix.com/documentation/7.4/en/manual/best_practices/security/access_control/postgresql
https://www.zabbix.com/download?zabbix=7.4&os_distribution=ubuntu&os_version=26.04&components=server_frontend_agent&db=pgsql&ws=nginx

I was able to create both, the regular database schema and timescalbedb schema using the 'usr_owner' account.

Closing the issue because I could not reproduce the issue.

Generated at Sun Jun 14 05:06:09 EEST 2026 using Jira 10.3.18#10030018-sha1:5642e4ad348b6c2a83ebdba689d04763a2393cab.