Zabbix

Videos

Overview: Zabbix on Ubuntu 24.04 LTS on Azure: overview (watch on YouTube)

Launch and log in: Zabbix on Ubuntu 24.04 LTS on Azure: launch and log in (watch on YouTube)

Deep Dive: Zabbix on Ubuntu 24.04 LTS on Azure: deep dive (watch on YouTube)

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Size up for more monitored hosts, higher metric volumes or longer history retention.

For inbound NSG rules, allow 22/tcp from your management network and 80/tcp for the web frontend. To collect metrics from remote agents, also allow 10051/tcp (the Zabbix server trapper).

Zabbix serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for Zabbix by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:zabbix-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name zabbix \
  --image sac1647283583153:zabbix-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 for the web frontend:

az vm open-port --resource-group <your-rg> --name zabbix --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM, MariaDB, the Zabbix server and the Zabbix agent are all active. MariaDB listens only on 127.0.0.1:3306. nginx serves the web frontend on port 80, the agent listens on 10050, and the server trapper listens on 10051.

systemctl is-active nginx php8.3-fpm mariadb zabbix-server zabbix-agent2

ss -tlnp | grep -E ':80 |:3306 |:10050 |:10051 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own Zabbix administrator password on first boot. It writes the password, along with the login user and URL, to a root-only credentials file. Read it with sudo:

sudo cat /root/zabbix-credentials.txt

Sign in to the Zabbix web frontend as user Admin with the ZABBIX_ADMIN_PASSWORD from this file. With a Standard SKU public IP (the Azure default), the file's ZABBIX_URL can show the VM's private address (for example http://10.0.0.4/). From your browser, use the VM's public IP or DNS name, as in Step 5. On the box itself, you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the Zabbix web frontend

Browse to http://<vm-public-ip>/ and sign in with username Admin and the password from Step 4.

You land on the Global view dashboard. Because the appliance monitors itself out of the box, the dashboard already shows live data: the Zabbix server status and version, host and item counts, CPU utilization, host availability and problems by severity. The left menu gives you Monitoring, Services, Inventory, Reports, Data collection, Alerts, Users and Administration.

Step 6 - Explore the monitored hosts and live data

Open Monitoring, then Hosts, to see every monitored host. Out of the box, the Zabbix server host is present and reporting. This is the appliance monitoring itself.

Its agent interface at 127.0.0.1:10050 shows a green ZBX availability marker. From here you can jump straight to its Latest data, Problems, Graphs and Dashboards.

Step 7 - Add and configure hosts

Open Data collection, then Hosts, to manage what Zabbix monitors. Here you can add a new host, assign it templates, set its interfaces, and review its items, triggers, graphs and discovery rules. Zabbix ships hundreds of templates, for Linux, Windows, network devices, databases, cloud services and more. The bundled Zabbix server host is already linked to the Linux by Zabbix agent and Zabbix server health templates.

To add a remote host, install a Zabbix agent on the target machine and point it at this appliance's public IP on port 10051. Open 10051/tcp in the NSG, then create the host here and link the appropriate template.

Step 8 - The secured default account

A stock Zabbix install ships a well-known default super admin, Admin with the password zabbix, and an anonymous guest. The SecureAnyCloud image secures both before capture. The Admin password is rotated to a unique per-VM secret, and guest access is disabled.

Confirm that guest is disabled, then run the built-in round-trip check. It proves the per-VM administrator signs in through both the API and the web form, while the default Admin / zabbix login is rejected:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('guest disabled via group ',g.name,' (gui_access=',g.gui_access,', users_status=',g.users_status,')') FROM zabbix.usrgrp g JOIN zabbix.users_groups ug ON g.usrgrpid=ug.usrgrpid JOIN zabbix.users u ON ug.userid=u.userid WHERE u.username='guest' AND (g.gui_access=3 OR g.users_status=1) LIMIT 1"

sudo bash /usr/local/sbin/zabbix-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

Confirm the Zabbix version, the health endpoint, the dedicated data disk, and that the server is collecting live self-monitoring data. The MariaDB database lives on the data disk mounted at /var/lib/mysql, so all of your monitoring history is kept separate from the operating system disk and travels with the VM:

dpkg-query -W -f='Zabbix ${Version}\n' zabbix-server-mysql

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/mysql

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT((SELECT COUNT(*) FROM zabbix.history)+(SELECT COUNT(*) FROM zabbix.history_uint),' self monitoring values collected') AS collected"

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, front Zabbix with your own domain and a TLS certificate. You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain. Point it at the appliance on port 80.

Security notes

• Zabbix serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through the Zabbix frontend or over SSH.
• The default super admin is secured on every VM: the Admin password is unique per VM, and guest access is disabled. Keep /root/zabbix-credentials.txt protected, and change the password from within Zabbix under Users if you share access.
• The server trapper on port 10051 is reachable only if you open it in the NSG. Open it when you add remote monitored agents, and restrict it to the networks those agents live on.
• Restrict inbound 80/tcp in your NSG to the networks that need the web frontend.

Support

SecureAnyCloud maintains this image and provides 24/7 support. If you need help deploying or operating Zabbix on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Zabbix on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com