[ZBXNEXT-2735] Liboping as an alternative to fping Created: 2015 Mar 06  Updated: 2015 Mar 09

Status: Open
Project: ZABBIX FEATURE REQUESTS
Component/s: Proxy (P), Server (S)
Affects Version/s: None
Fix Version/s: None

Type: Change Request Priority: Major
Reporter: Evgenii Terechkov Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: fping, icmpping, privilege
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate

 Description   

As a more scalable and robust alternative of (tricky) fping utility, consider support of Liboping or similar library. It will decrease resources usage by server and proxy and should avoid current problems with fping-s output parsing line-by-line.



 Comments   
Comment by Oleksii Zagorskyi [ 2015 Mar 07 ]

hmm, interesting of course.
What I found:

The liboping is existing long time already and seems is alive. It's good.

I tried an oping application - it demonstrates the library's abilities:
Next command just hangs after first echo reply (3 requests with 50 ms interval, no way to set timeout):

# oping -c3 -i50 zabbix.jp

I could not stop it by Ctrl+c - it doesn't react at all. Sent it to background by Ctrl+z and then killed with -9 level.
version is 1.7

Ok, this is just a demo application but we need the library.
Lib possibilities are here: http://noping.cc/manpages/ping_setopt.3.html
Looks like there is possible to set timeout but no way to set number of requests and interval between them.
So to support current zabbix icmpping* items - zabbix server will need to handle multiple requests and intervals in its own code.
Maybe it's not so bad as fping has its own strange things like mentioned in ZBX-5893 and I don't think they will be once resolved by fping's maintainer.

Also, the oping binary also has SUID flag enabled.
Maybe it's stupid, but question is - if use liboping with zabbix - would zabbix_server binary need to be run under root only to perform icmp check with allowed small values of interval etc ?
Probably not - but I'm not sure.

Comment by Evgenii Terechkov [ 2015 Mar 07 ]

I sure you are right about SUID bit on executables. Process needs to run under root user to create raw sockets and produce ICMP packets (on Linux kernel). It is apply to any such utility (ping,traceroute, mtr, fping, oping, ...). Usual way to handle such situation for long-running daemons is run under root, fork privileged process with just enough capabilities and drop superuser privileges in parent process (with further IPC with privileged helper). Obvious example for such method is openntpd daemon.

Comment by Oleksii Zagorskyi [ 2015 Mar 07 ]

Thanks!
Privileges separation (for agent) also was discussed in ZBXNEXT-195

Generated at Fri Jul 04 08:20:43 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.