Using zone attribute in Services

Service Monitoring
,
1

The Service object supports an optional zone attribute, according documentation. If not specified, this attribute will default to the zone of the parent Host.

This led me to think that it was possible to run check a service from a different zone than its parent host. However, after a few hours of trial and error and Google deep-diving, I found a post on this forum stating that that it was not possible to use a different zone for an host and its services (cannot find said post anymore, sorry). This is when I decided to leave the matter here.

I’m thinking about looking at this issue again, and I would really appreciate some guidance. What I am trying to achieve is something like this:

object Host "some-host" {
    # ...
    vars.multipoint = true
    zone = "core"
}

template Service "icmp-multipoint" {
    check_command = "icmp"
    # ...
}

apply Service "icmp-remote01" {
    import "icmp-multipoint"
    zone = "remote01"
    assign where host.vars.multipoint
}

# ...

apply Service "icmp-remote99" {
    import "icmp-multipoint"
    zone = "remote99"
    assign where host.vars.multipoint
}

The idea is to perform multi-point Internet reachability monitoring, from various geographical locations and BGP ASes, in order to detect BGP brownouts (loss or degradation of connectivity on a subset of Internet/BGP destinations).

I saw posts suggesting to create multiple instances of the host, but it would create complexity and confusion for my users, and I’d like to keep that option as a very last resort.

I am also not sure of the purpose of the zone attribute under Service object, if setting a different zone is not supported - unless I missed something?

Can someone think of a “clean” way to achieve what I am trying to do?

Thanks in advance!

EDIT : Quick clarification; my distributed setup works just fine, as long as the host and its services are all in the same zone.

2

I think the problem for your setup is that this kind of checks need to stick to the zone layout, so checks can only be moved to a child zone with attribute zone.

So what should work is having your multi-homed host in the parent zone and also its service objects (objects should be easier to handle here than apply rules), but the service objects all get a different value for the attribute zone.

Not working would a setup like having the host in one child zone and trying to move services to another zone on the same level.

Also not working would be using the command endpoint in this case as it will only take commands from its parent zone.

I have not done this for a longer while, so please test it yourself and take my answer with a grain of salt as details could have changed, but I hope it still works in this way.

3

Hmm I see what you mean. I didn’t think of leveraging zone hierarchy. I will test it out and post back here, might be a few days though. Thanks!