Note TLS auth for proxies won't work right in HA: https://support.zabbix.com/browse/ZBXNEXT-8490

I apologize for promoting it like this. With my other tickets I promise I wait patiently like I should.

Available in versions:

• pre-7.0.0rc1 (master) d486608e8e3

Dear ZabbixDevTeam,
Thanks for this great feature!
After play with it, I have noticed an attention point which maybe you already know.

If a Proxy Group will go offline, how we can received a notification?

Do you have some plan to create a dedicated template for monitoring the status and performance of a Proxy Group?

Thanks so much

Hi,

Thank you for the feedback!

You can use the "zabbix[proxy group, <name>, state]" item to get current state of the proxy group.

0 - unknown; 1 - offline; 2 - recovering; 3 - online; 4 - degrading.

Currently, we are working on such a template. It will be available in the nearest minor release.

Perfect! Thanks so much

Updated documentation:

• What's new
• Proxy load balancing and high availability
• Server processes ('proxy group manager' added)
• Proxy groups (new menu item)
• Internal items (four new "zabbix[proxy group*]" items added)
• User macros supported by location ('Proxy groups' added, 'Proxies' updated)
• Proxies ('State' column added, 'Host count' and 'Hosts' columns merged)
• Adding proxies
• Host configuration (updated 'Monitored by' option, added 'Proxy' field)
• Network discovery rule (updated 'Discovery by' option)
• Item testing (updated 'Test with' option)
• Permissions ('Proxy groups' added)
   

Hello, 

great news !

what does it change for the network flows ?

does the proxies talk to each other, or they only talk to zabbix server

I believe that's not the case. I think the proxy will start reporting its status by writing to a new table in the database, similar to how the server's HA works, but I haven't verified this yet to be sure.

I've been running some tests with this new feature, and I have a question. Does this feature require something like HAProxy in my environment? My concern is that if I point the "Address for active agents" to a proxy, and that proxy goes offline, then the data might be lost.

Documentation is still somewhat incomplete, but based on using the latest Wireshark 4.3.0rc0 build with Zabbix traffic, the server sends those addresses to all the proxies in the group. That way the proxies can return a (yet undocumented) redirect response to the active agents (7.0+?) to guide them to another proxy, for better load distribution.

That IP address is thus not a virtual address, that is the IP address of the proxy, to be used by the active agents. Otherwise Zabbix server does not "know" the IP address of the active proxy.

For the documentation under section https://www.zabbix.com/documentation/7.0/en/manual/distributed_monitoring/proxies/ha we could add/edit to include these bits:

How it works:

• Active agent can have a single proxy for ServerActive field. When agent service starts, the agent will receive a full list of all IP addresses of all Zabbix proxies, load and keep into memory.
• Proxy manager always knows which other proxies are healthy or unhealthy.

Possible problems:

• Misconfiguration in Zabbix agent configuration file for the "Server" field. All proxies must be listed, it's mandatory for this field. Use subnet type of syntax.
• Regarding Zabbix agent active checks, on an agent startup, if first proxy "alpha" responds and gives proxy "beta" in answer, and the proxy "beta" is not reachable because of firewall problem, the communication will stop in a state of waiting for "beta" to respond. The root cause of this is that proxy "alpha" knew that proxy "beta" was healthy for sure. It's a big priority to allow agents to reach all proxies at a firewall level. This is not a problem if the first proxy fails. Then, it will try different addresses configured in the "ServerActive" field.
• Zabbix agent active checks, misconfiguration. Instead of semicolon syntax, a comma has been used
• Misconfiguration at the group level. 10 proxies belong to 1 group and "Minimum number of proxies=10". One proxy dies, and the whole proxy group goes offline, data collection stops. It is better to have a minimum of 6 proxies. This will support 4 unhealthy proxies.
• The HA setup has been very stable for multiple months in a row. Host rebalancing never happens; it is not needed. The agent does not validate the "backup channel" for other proxies. In a failover scenario, it might not work because a firewall was modified half a year ago.
• While using the "Database monitoring" item, the DB object/server must have extended permissions.

Active agent can have a single proxy for ServerActive field. When agent service starts, the agent will receive a full list of all IP addresses of all Zabbix proxies, load and keep into memory.

Note that in this case starting/rebooting agent while that particular proxy is offline causes agent to lose monitoring.