Network Monitoring dengan Zabbix

# Tambah repository Zabbix
wget https://repo.zabbix.com/zabbix/7.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_7.0-1ubuntu22.04_all.deb
sudo dpkg -i zabbix-release_7.0-1ubuntu22.04_all.deb
sudo apt update

# Install Zabbix server, frontend, agent
sudo apt install -y zabbix-server-mysql zabbix-frontend-php \
  zabbix-nginx-conf zabbix-sql-scripts zabbix-agent

# Setup database MySQL
sudo mysql -u root -p
# Di MySQL shell:
# CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;
# CREATE USER 'zabbix'@'localhost' IDENTIFIED BY 'password123';
# GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix'@'localhost';
# SET GLOBAL log_bin_trust_function_creators = 1;
# FLUSH PRIVILEGES; EXIT;

# Import schema
sudo zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | \
  mysql -uzabbix -p zabbix

# Konfigurasi Zabbix server
sudo nano /etc/zabbix/zabbix_server.conf
# DBPassword=password123

# Start services
sudo systemctl restart zabbix-server zabbix-agent nginx php8.1-fpm
sudo systemctl enable zabbix-server zabbix-agent nginx php8.1-fpm

# Akses web: http://IP-SERVER/zabbix
# Default login: Admin / zabbix

# Via Zabbix API (alternatif web UI)
# POST ke http://zabbix-server/api_jsonrpc.php

# Contoh menambah host via API:
curl -s -X POST http://zabbix-server/api_jsonrpc.php \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "host.create",
    "params": {
      "host": "MikroTik-Router01",
      "groups": [{"groupid": "2"}],
      "interfaces": [{
        "type": 2,
        "main": 1,
        "useip": 1,
        "ip": "192.168.1.1",
        "dns": "",
        "port": 161,
        "details": {
          "version": 2,
          "community": "public"
        }
      }],
      "templates": [{"templateid": "10047"}]
    },
    "auth": "YOUR_AUTH_TOKEN",
    "id": 1
  }'

# 1. Buat template baru:
#    Configuration → Templates → Create Template
#    Name: Template MikroTik Custom
#    Groups: Templates/Network Devices

# 2. Tambah Items:
#    - CPU Load:   system.cpu.load[all,avg1]
#    - Memory:     vm.memory.size[available]
#    - Uptime:     system.uptime
#    - Interface:  ifInOctets[ether1] (SNMP OID)

# 3. Tambah Triggers:
#    - High CPU:   avg(/Template/cpu.load,5m)>5
#    - Low Memory: last(/Template/mem.available)<100M
#    - Interface:  change(/Template/ifInOctets[ether1])=0

# 4. Tambah Grafik:
#    - CPU Utilization (line graph)
#    - Interface Traffic (stacked graph)
#    - Memory Usage (pie chart)

# 5. Link template ke host:
#    Configuration → Hosts → Select Host → Templates → Link

# Trigger: CPU tinggi selama 5 menit
avg(/host/system.cpu.load,5m) > 5

# Trigger: Interface down
last(/host/ifOperStatus.1) <> 1

# Trigger: Packet loss > 5%
avg(/host/icmppingloss,10m) > 5

# Trigger: Latency > 100ms
avg(/host/icmppingsec,5m) > 0.1

# Trigger: Disk space < 10%
last(/host/vfs.fs.size[/,pfree]) < 10

# Trigger: Bandwidth > 80% utilization
last(/host/ifInOctets.1) > 80000000

# Trigger: BGP session down
last(/host/bgpPeerState.192.168.1.1) <> 6
# BGP state 6 = Established

# Konfigurasi Media Type (Email):
# Administration → Media Types → Email
# SMTP Server: smtp.gmail.com
# SMTP Port: 587
# SMTP Email: alert@yourdomain.com
# Security: STARTTLS
# Authentication: Username + Password

# Konfigurasi Media Type (Telegram):
# Administration → Media Types → Telegram Bot
# Token: dari @BotFather
# Parse mode: Markdown

# Buat Action:
# Configuration → Actions → Trigger Actions → Create
# Name: "Alert Network Down"
# Conditions: Trigger severity >= Warning
# Operations:
#   - Send message to "Admin" via Email
#   - Send message to "NOC Team" via Telegram
#   - Escalate after 15 minutes if not acknowledged

# Recovery Operations:
#   - Send recovery message to all

# Aktifkan SNMP
/snmp set enabled=yes

# Tambah community string (ganti "public" dengan string unik!)
/snmp community set [find name=public] \
  name=zabbix-monitor \
  addresses=192.168.1.100/32 \
  read-access=yes \
  write-access=no

# Atau buat community baru
/snmp community add \
  name=zabbix-monitor \
  addresses=192.168.1.100/32 \
  read-access=yes \
  write-access=no

# Cek SNMP status
/snmp print
/snmp community print

# Install proxy
sudo apt install -y zabbix-proxy-mysql zabbix-sql-scripts

# Konfigurasi proxy
sudo nano /etc/zabbix/zabbix_proxy.conf
# Server=zabbix-server-ip
# Hostname=proxy-site-a
# DBPassword=password123
# ProxyMode=0 (active) atau 1 (passive)

# Import schema
sudo zcat /usr/share/zabbix-sql-scripts/mysql/proxy.sql.gz | \
  mysql -uzabbix -p zabbix_proxy

# Start proxy
sudo systemctl restart zabbix-proxy
sudo systemctl enable zabbix-proxy

# Network Discovery:
# Configuration → Discovery → Create Discovery Rule
# Name: "Discover LAN Devices"
# IP Range: 192.168.1.1-254
# Check: 
#   - ICMP ping
#   - SNMPv2 community "zabbix-monitor" port 161
#   - Zabbix agent port 10050
# Update interval: 1h

# Auto-Registration (agent auto-register):
# Configuration → Actions → Autoregistration Actions
# Condition: Host metadata contains "mikrotik"
# Operations:
#   - Add host
#   - Add to host group "Network Devices"
#   - Link to template "Template MikroTik SNMP"

# LLD (Low-Level Discovery):
# Otomatis discover interface, filesystem, CPU, SNMP OID
# Template → Discovery Rules → Create
# Type: SNMP OID discovery
# Key: net.if.discovery
# SNMP OID: IF-MIB::ifDescr

# Login dan dapatkan auth token
curl -s -X POST http://zabbix-server/api_jsonrpc.php \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "user.login",
    "params": {
      "user": "Admin",
      "password": "zabbix"
    },
    "id": 1
  }'

# Response: {"jsonrpc":"2.0","result":"AUTH_TOKEN","id":1}