Ceph by Zabbix Agent 2
Monitoring ceph by zabbix agent 2 connects your monitoring server to the storage manager API. You enable the storage REST module and link the agent with a read-only user key. Many teams set this up using shared admin keys to get data flowing fast. Broad roles give monitoring nodes the power to change pools or delete storage volumes. When an agent holds admin rights, a stolen key puts the whole cluster at risk. How ceph by zabbix agent 2 collects cluster metrics The agent uses a built-in Go pl
Open Policy Agent (OPA) + Privacy by Design: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
Monitoring ceph by zabbix agent 2 connects your monitoring server to the storage manager API. You enable the storage REST module and link the agent with a read-only user key. Many teams set this up using shared admin keys to get data flowing fast. Broad roles give monitoring nodes the power to change pools or delete storage volumes. When an agent holds admin rights, a stolen key puts the whole cluster at risk.
How ceph by zabbix agent 2 collects cluster metrics
The agent uses a built-in Go plugin to poll the storage manager module over HTTPS. You do not need external scripts or custom user parameters on the storage nodes. First, an operator enables the REST API module inside the active storage manager daemon. That module listens on a network port and answers requests for cluster health data. Next, you create a separate storage client user made just for metric collection. You grant this client read access on the monitor, manager, and placement group systems. The agent reads the user name, key, and manager URL from its local file. On a fixed schedule, the agent queries the API for pool usage and disk latency. It also checks placement group states, object counts, and overall cluster health scores. The agent sends these JSON metrics back to the central server for alert checks.
Why native storage roles leave an operational gap
Native storage roles help you limit what the monitoring agent can do on its own. A read-only key stops the metric plugin from writing data or dropping storage pools. Still, storage teams still need live access to fix alerts when the server pages them. When a disk fails or a placement group stalls, engineers log in to run checks. Native roles only check who logs in when the session starts on the cluster. They do not check each command an engineer runs during an active repair session. Operators often share one high-level admin key on the storage hosts for fast fixes. Once logged in, an engineer can run a bad command that wipes a pool. Static keys stored on monitoring hosts or laptops are also easy to copy and leak. Rotating those keys across dozens of storage nodes takes hours of manual work. Native permissions cannot mask sensitive values like emails or card numbers in command outputs. You need a better way to control live commands without sharing static keys.
Securing storage hosts during alert response
Good monitoring tells you when a storage node runs out of space or drops offline. Safe operations require tight controls over what happens after that alert wakes up your team. Separating read-only metric collection from human repair access is the first major step. You should keep the agent key locked down to read calls on the manager API. For human operators and automation scripts, you should remove static admin keys from host files. Teams work safer when every command goes through an approval and logging check in flight. Tying each storage command to a real person stops shared key abuse during outages. It also gives security teams a clear log of every action taken on the cluster.
Open Policy Agent (OPA) + Privacy by Design: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Does the agent need to run on every storage node?
No, the agent queries the central manager API over the network from one host. You can point it at the active manager address to pull cluster-wide data.
What permissions does the storage monitoring user need?
The client user only needs read rights on the monitor, manager, and OSD systems. Never give the monitoring user write or admin rights on your storage pools.
How do we handle SSL certificates for the manager API?
The manager API uses HTTPS by default and often starts with a self-signed certificate. You should install a valid CA certificate rather than turning off certificate checks.