Understanding Zabbix Active and Passive Monitoring Modes

Zabbix provides two primary monitoring approaches: passive mode, where the server initiates connections to agents, and active mode, where agents pull configuration and send data to the server.

Passive mode: By default, Zabbix operates in passive mode. The server retrieves the host name from the agent's configuration (Hostname) and, based on the monitoring items stored in its database, opens a random port to connect to the agent's port 10050. The agent then returns the requested data, which the server writes to the database. Example command to verify the listening port:

netstat -nltp|grep 10050

Output:

tcp 0 0 0.0.0.0:10050 0.0.0.0:* LISTEN 995/zabbix_agentd

tcp6 0 0 :::10050 :::* LISTEN 995/zabbix_agentd

Because each agent must maintain a connection, passive mode can impose significant load on the server when many agents are present, making it unsuitable for large environments.

Active mode: In contrast, active mode has the agent initiate a connection to the server's port 10051. The agent must specify the server address in its configuration (Server=). After connecting, the agent retrieves its monitoring items and intervals from the server, collects the data, and pushes it back. Some items may still require passive checks.

Typical agent configuration for active mode includes:

Server=192.168.23.1

ServerActive=192.168.23.1

Hostname=192.168.23.1

Enabling active checks (if the parameter is omitted, active checks are disabled) and optionally specifying a proxy address if one is used.

Overall, choosing between passive and active modes depends on the scale of the deployment and performance requirements.