Zabbix: Open port 10050 on client necessary?

Question

Running Zabbix on AWS. The client's Security Group's port 10050 was closed and everything still seems to work. Can someone explain what it is used for?

Solution

Zabbix is probably configured to use passive checks (instead of active). More details below:

https://sites.google.com/site/wikirolanddelepper/systen-monitoring/difference-between-zabbix-agent-active-passive

Comments

[kev]

The wiki doesn't state which version of Zabbix it relates to. My zabbix_agentd.conf has no DisableActive flag. I am running zabbix_agentd (daemon) (Zabbix) 3.4.1. Is there any reason to chose passive over active anyway? Requires an additional open port. I think you've mixed up active and passive or are you talking about the client? The wiki page says: "active checks" = client pushes and "passive checks" = server polls. It's from the clients (agents) perspective. I find that confusing too. Should be the other way round.

[kev]

So, does that mean if the port 10050 is not open Zabbix falls back to active checks (= client pushing)?

[Richlv]

Active/passive description is correct. Passive agent is contacted by server, active agent connects to the server. In recent versions of Zabbix, the configuration parameter is called ServerActive, which both controls whether active checks should be enabled, and which server[s] to connect to. One reason for passive checks is that they support flexible intervals/scheduling, while active checks do not. If you re using active items only, agent will connect to the server on port 10051. There is no fallback, you explicitly configure this on the item level.

[Wojciech Olesiejuk]

Yes, the client automatically switches over to passive checks if active checks fail and ServerActive config param is enabled.