Problems as notifications — through your own Firebase

ZbxView has no cloud in the middle. Your organisation creates its own Firebase project, a small relay runs on the Zabbix server, and notifications go straight from your Zabbix to your phones. Android, app 0.50 and newer.

• Your data stays with you
  A notification carries only the problem name, host, severity and event id. The app fetches the details from your Zabbix itself. The relay runs on your server and listens on localhost only.
• One setting, every phone
  The admin enters the Firebase project in the ZbxView connect module — the QR code hands it to every phone and push turns on right after the scan. Or distribute it via MDM (push_* keys).
• Android only for now
  On iOS Firebase delivers through APNs and needs the app developer’s key, which cannot be shared. One device uses one Firebase project.

What you are building

The “relay” is a small program that you install on the Zabbix server. Firebase only accepts messages signed with a private key, and a Zabbix webhook cannot sign them. So Zabbix hands each alert to the relay, and the relay signs it and passes it to Firebase. It is not something you find or click in Firebase.

Part 1Before you start

• An Android phone with ZbxView 0.50 or newer. Your own Firebase project cannot deliver to iPhones, because that needs the app developer’s Apple key.
• SSH with sudo on the machine that runs the Zabbix server. This is not necessarily the machine that runs the web frontend.
• A Zabbix account with the Super admin role.
• Python 3.9 or newer on the server. Check with python3 --version.
• Outgoing HTTPS from the server to fcm.googleapis.com and oauth2.googleapis.com at all times, and to pypi.org and github.com during installation.

Part 2 · In your browserCreate the Firebase project

You need two files from Firebase. Keep them apart, because they do different jobs:

2.1 Create the project

Open console.firebase.google.com, click Create project and give it any name. Google Analytics is not needed. The free Spark plan is enough.

2.2 Add the Android app and download google-services.json

1. On the project overview page, click the Android icon (or Add app).
2. In Android package name, enter exactly app.zbxview. Firebase does not check who owns the package, so this is fine.
3. Click Register app.
4. Click Download google-services.json.
5. Skip the remaining wizard steps. They are for developers, and you do not need to add anything to any code.

2.3 Generate the private key

1. Click the gear icon, then Project settings, then the Service accounts tab.
2. Click Generate new private key and confirm with Generate key.
3. Rename the downloaded file to service-account.json. Firebase gives it a long name such as myproject-firebase-adminsdk-abc12-1234567890.json, and the relay will not find it under that name.

2.4 Check that Cloud Messaging is enabled

In Project settings, open the Cloud Messaging tab. Firebase Cloud Messaging API (V1) should show Enabled. On a new project it normally does. If it does not, use the ⋮ menu next to it to enable it.

Part 3 · On the Zabbix server, over SSHInstall the relay

Run the blocks below one at a time, in order. Use the Copy button and paste them into your SSH session instead of retyping them.

3.1 Debian and Ubuntu only: install the Python venv package

Skip this on RHEL, Rocky, Alma and Oracle Linux.

sudo apt install -y python3-venv

3.2 Download the relay

sudo mkdir -p /opt/zbxview-push-relay
cd /opt/zbxview-push-relay
for f in push_relay.py config.ini.example zbxview-push-relay.service; do
  sudo curl -fsSLO https://radekpavlik.github.io/zbxview/tools/push-relay/$f
done
ls

You should see:

config.ini.example  push_relay.py  zbxview-push-relay.service

3.3 Put the private key on the server

Run this on your own computer, in the folder with the file, replacing the user and server name. On Windows, WinSCP works too.

scp service-account.json youruser@your-zabbix-server:~/

Then, back on the Zabbix server:

sudo mv ~/service-account.json /opt/zbxview-push-relay/

3.4 Create the configuration and a shared secret

The shared secret is a password between Zabbix and the relay. This block generates one and writes it to the configuration. Copy the secret it prints, because you need it in step 4.2.

cd /opt/zbxview-push-relay
SECRET=$(openssl rand -hex 24)
sudo cp config.ini.example config.ini
sudo sed -i "s/FILL_ME_LONG_RANDOM/$SECRET/" config.ini
echo "Your shared secret: $SECRET"

3.5 Install the Firebase library and start the service

The installation takes a minute or two. A pip warning about upgrading is harmless.

cd /opt/zbxview-push-relay
sudo python3 -m venv venv
sudo venv/bin/pip install firebase-admin
sudo chown -R zabbix:zabbix .
sudo chmod 600 config.ini service-account.json
sudo cp zbxview-push-relay.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now zbxview-push-relay

3.6 Check that the relay works

sleep 5
cd /opt/zbxview-push-relay
systemctl is-active zbxview-push-relay
SECRET=$(sudo awk -F' *= *' '/^shared_secret/{print $2}' config.ini)
curl -s -X POST -H "X-Auth: $SECRET" -d '{}' http://127.0.0.1:8090/send; echo

You should see exactly this:

active
{"ok": false, "error": "missing token"}

That “error” means success. The relay is running, it accepted your secret, and it is only complaining that this test named no phone. If you see anything else, go to troubleshooting.

3.7 RHEL, Rocky, Alma, Oracle Linux: allow Zabbix to reach the relay

Run getenforce. If it prints Enforcing, SELinux has to allow Zabbix to connect to the relay port:

sudo setsebool -P zabbix_can_network on

Part 3 · If Zabbix runs in DockerInstall the relay as a container

Use these steps instead of 3.1 to 3.7. The relay runs as a separate Compose project next to Zabbix. Your Zabbix compose file stays as it is, no port opens on the host, and only containers on the Zabbix network can reach the relay.

D.1 Find the Zabbix server container and its network

sudo docker ps --format '{{.Names}}  {{.Image}}' | grep zabbix-server
sudo docker inspect -f '{{range $n, $c := .NetworkSettings.Networks}}{{println $n}}{{end}}' zabbix-server

The first command prints the container’s name. Use that name instead of zabbix-server in the second command and in step D.6.

You should see the network’s name, for example:

zabbix_default

If several networks are listed, use the one with backend in its name. If you see only host or bridge, see the Docker rows in troubleshooting.

D.2 Download the relay

sudo mkdir -p /opt/zbxview-push-relay
cd /opt/zbxview-push-relay
for f in push_relay.py config.ini.example Dockerfile docker-compose.yml; do
  sudo curl -fsSLO https://radekpavlik.github.io/zbxview/tools/push-relay/$f
done
ls

You should see:

Dockerfile  config.ini.example  docker-compose.yml  push_relay.py

D.3 Put the private key on the server

Copy service-account.json to /opt/zbxview-push-relay/ the same way as in step 3.3.

D.4 Create the configuration and a shared secret

Replace zabbix_default with your network from step D.1. This block generates the shared secret and writes the configuration. Copy the secret it prints, because you need it in step 4.2. The relay runs as user 10001, so both files must belong to that user.

cd /opt/zbxview-push-relay
SECRET=$(openssl rand -hex 24)
sudo cp config.ini.example config.ini
sudo sed -i -e "s/FILL_ME_LONG_RANDOM/$SECRET/" -e "s/^listen = .*/listen = 0.0.0.0/" config.ini
echo "ZABBIX_NETWORK=zabbix_default" | sudo tee .env
sudo chown 10001:10001 config.ini service-account.json
sudo chmod 600 config.ini service-account.json
echo "Your shared secret: $SECRET"

D.5 Build and start the container

The build takes a minute or two. The container starts again by itself after a reboot.

cd /opt/zbxview-push-relay
sudo docker compose up -d --build

D.6 Check that Zabbix reaches the relay

Use your container name from step D.1. The test runs inside the Zabbix server container, so it also proves that the network is right.

sleep 5
cd /opt/zbxview-push-relay
SECRET=$(sudo awk -F' *= *' '/^shared_secret/{print $2}' config.ini)
sudo docker exec zabbix-server wget -O- --header "X-Auth: $SECRET" --post-data '{}' http://zbxview-push-relay:8090/send

The last line should be exactly this:

wget: server returned error: HTTP/1.0 400 Bad Request

That “error” means success. The relay is running, it accepted your secret, and it is only complaining that this test named no phone. 401 means the secret does not match, and bad address means the two containers do not share a network. If the container has no wget, skip this check, because step 4.3 tests the same path.

Now continue with Part 4. In step 4.2, set RelayURL to http://zbxview-push-relay:8090/send.

Part 4 · In the Zabbix web interfaceConnect Zabbix to the relay

4.1 Import the media type

1. Download media_type_zbxview_push.yaml to your computer.
2. In Zabbix, open Alerts → Media types and click Import.
3. Choose the file and click Import.

The file is for Zabbix 7.0 and newer. On 6.4, create a webhook media type named exactly ZbxView Push by hand, using this script and the parameters listed at its top.

4.2 Enter the shared secret

1. Click ZbxView Push in the list.
2. Replace the value of the Auth parameter with the secret from step 3.4 / D.4. You can show it again with sudo grep shared_secret /opt/zbxview-push-relay/config.ini.
3. Leave RelayURL as http://127.0.0.1:8090/send. If Zabbix runs in Docker, set it to http://zbxview-push-relay:8090/send.
4. Click Update.

4.3 Test Zabbix → relay

In the media types list, click Test in the ZbxView Push row, leave the values as they are and click Test. This test sends to a phone that does not exist, so it is expected to fail. The message tells you how far it got:

4.4 Create the action

The action decides which problems are sent, and to whom.

1. Open Alerts → Actions → Trigger actions and click Create action.
2. Name it, for example ZbxView push. Add conditions if you want to limit it, for example Trigger severity is greater than or equals High.
3. On the Operations tab, under Operations, click Add. Choose your technicians in Send to user groups or Send to users, set Send to media type to ZbxView Push and click Add.
4. Under Recovery operations, click Add, choose Notify all involved and click Add. Technicians then also get a “Resolved” notification.
5. Click Add to save the action.

You do not enter any phone numbers or addresses. The app registers each phone with Zabbix by itself in Part 6, and Zabbix only sends a user problems on hosts that user has permission to see.

Part 5 · Server and Zabbix web interfaceAdd the project to the QR code

This part is required. The phone has to learn which Firebase project to use, and the QR code from the free ZbxView connect module tells it. Until then, the app shows no Push notifications option at all. (With an MDM you can send the same values as push_* keys instead.)

5.1 Install the ZbxView connect module

Skip this if you already have version 1.6 or newer. On the machine that runs the Zabbix web frontend:

cd /usr/share/zabbix/modules
sudo git clone https://github.com/RadekPavlik/Zabbix-UI-Modules-ZbxView-connect.git

If that folder does not exist, use /usr/share/zabbix/ui/modules. Then, in Zabbix, open Administration → General → Modules, click Scan directory and enable ZbxView connect.

Web frontend in Docker: the modules folder is inside the container, so the module has to come from the host. First check whether the frontend already mounts that folder, using your web container’s name:

sudo docker inspect -f '{{range .Mounts}}{{println .Source .Destination}}{{end}}' zabbix-web | grep modules

If a line ends with exactly /usr/share/zabbix/modules, as in the official Zabbix compose files, run the git clone command in the host folder shown at the start of that line. Otherwise, clone the module to the host:

sudo git clone https://github.com/RadekPavlik/Zabbix-UI-Modules-ZbxView-connect.git /opt/Zabbix-UI-Modules-ZbxView-connect

Add this line under volumes: of the web service in your Zabbix compose file, then run sudo docker compose up -d in that file’s folder. The web frontend restarts, which takes a few seconds.

- /opt/Zabbix-UI-Modules-ZbxView-connect:/usr/share/zabbix/modules/Zabbix-UI-Modules-ZbxView-connect:ro,z

Then scan the directory and enable the module in Zabbix, as described above.

5.2 Load the project

1. Open Administration → Mobile configuration.
2. On the Push notifications (Firebase) card, click Load google-services.json and pick the file from step 2.2. The four values fill in.
3. Click Save.

Part 6 · Every technician, on their phoneScan the QR code and test

6.1 Pair the phone

1. In Zabbix, in your own account, open User settings → Mobile connect. A QR code appears.
2. In the app, choose Add server → Scan QR code. If the server is already in the app, scan the code anyway.
3. When Android asks about notifications, tap Allow.
4. If the app tells you to restart it, close it fully and open it again.

Push turns on by itself after the scan. To confirm, check that Settings → Push notifications is on in the app.

6.2 Confirm Zabbix registered the phone

In Zabbix, open Users → Users, choose your user and open the Media tab. There should be a ZbxView Push row with a long token. Each phone has its own row.

6.3 Send a real test

Raise a test problem on a host you can see that matches the action, for example by stopping the agent on a lab host or lowering a trigger threshold for a moment. A notification should arrive, and tapping it opens the problem.

That completes the setup. Your other technicians only need 6.1, as long as the action in step 4.4 includes them.

Part 7If something does not work

Two places tell you nearly everything. On the server, this shows the relay’s log:

sudo journalctl -u zbxview-push-relay -n 30 --no-pager

If the relay runs in Docker, use this instead:

sudo docker logs --tail 30 zbxview-push-relay

In Zabbix, Reports → Action log shows whether an alert was sent and the error if it failed. Python FutureWarning and DeprecationWarning lines in the relay log are harmless.

During installation

On the phone

Nothing arrives after a test problem

Still stuck? Use the contact form and include the output of step 3.6 / D.6, the relay log and the error from the Action log. Do not send service-account.json, config.ini or the shared secret.

Relay files on GitHub

← back to the main page