Web scenarios and HTTP agent for websites and APIs

You’ll create a small site and API on web01, then the checks in the frontend at https://zbx01.lab. web01 already runs Nginx from Lesson 7. The lab key lab-secret-123 is for this lab only. Add 192.168.56.81 web01.lab to /etc/hosts on zbx01 if Lesson 1 didn’t already.

1Give the web01 home page a known text

Run this on web01:

echo '<html><body><h1>SaatVedha Lab Shop</h1><a href="/login.html">Login</a></body></html>' | sudo tee /var/www/html/index.html >/dev/null
echo '<html><body><form><input name="user"><input name="pass" type="password"></form>Please sign in</body></html>' | sudo tee /var/www/html/login.html >/dev/null
curl -s http://192.168.56.81/ ; echo; curl -s -o /dev/null -w '%{http_code}\n' http://192.168.56.81/login.html

You should see:

<html><body><h1>SaatVedha Lab Shop</h1><a href="/login.html">Login</a></body></html>
200

Two pages, each with a phrase you can test for: “SaatVedha Lab Shop” and “Please sign in”. Real sites use a phrase that only appears when the page rendered properly, never something from the error template.

✅ Checkpoint: Both pages load from web01 and the login page returns 200.

2Create the web scenario

Open Data collection > Hosts, click Web in the web01 row and then Create web scenario. On the Scenario tab set Name Lab shop, Update interval 1m, Attempts 2, Agent “Zabbix”, and add the tag component = web. On the Steps tab add two steps:

Press Add. Attempts 2 means a step is retried once before it counts as failed, which hides a single dropped packet without hiding a real outage.

✅ Checkpoint: web01 has the web scenario Lab shop with two steps.

3Read the scenario results

Wait a minute, then open Monitoring > Hosts and click Web in the web01 row, and then the scenario name.

The six generated items are now in Latest data for web01 under the tag component = web. Two triggers turn them into problems:

{ITEM.LASTVALUE2} is the last value of the second item in the expression, the error message, so the problem title says why the scenario failed.

✅ Checkpoint: The web view shows both steps OK and the two triggers exist on web01.

4Add an HTTPS JSON health API on web01

Now a small API that needs a key. Create a self-signed certificate (like the one for zbx01 in Lesson 3), a JSON file, and an HTTPS server block.

Run this on web01:

sudo mkdir -p /etc/nginx/tls /var/www/api
sudo openssl req -x509 -newkey rsa:2048 -nodes -days 365 -subj "/CN=web01.lab" \
  -addext "subjectAltName=DNS:web01.lab,DNS:web01,IP:192.168.56.81" \
  -keyout /etc/nginx/tls/web01.key -out /etc/nginx/tls/web01.crt
echo '{"status":"ok","version":"2.4.1","orders_pending":12,"db":{"connected":true,"latency_ms":3.7}}' | sudo tee /var/www/api/health.json >/dev/null
sudo tee /etc/nginx/conf.d/api.conf >/dev/null <<'EOF'
server {
    listen 443 ssl;
    server_name web01.lab;
    ssl_certificate     /etc/nginx/tls/web01.crt;
    ssl_certificate_key /etc/nginx/tls/web01.key;
    location = /api/health {
        if ($http_x_api_key != "lab-secret-123") { return 401 '{"error":"unauthorized"}'; }
        default_type application/json;
        alias /var/www/api/health.json;
    }
}
EOF
sudo nginx -t && sudo systemctl reload nginx
sudo ufw allow from 192.168.56.80 to any port 443 proto tcp 2>/dev/null || true

Test it from zbx01, once with the key and once without:

Run this on zbx01:

curl -sk -H 'X-API-Key: lab-secret-123' https://web01.lab/api/health
curl -sk -o /dev/null -w '%{http_code}\n' https://web01.lab/api/health
curl -sS https://web01.lab/api/health

You should see:

{"status":"ok","version":"2.4.1","orders_pending":12,"db":{"connected":true,"latency_ms":3.7}}
401
curl: (60) SSL certificate problem: self-signed certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

All three are real outputs: the key works, no key gets 401, and without -k curl refuses the self-signed certificate. Keep that error in mind for the Break It section.

✅ Checkpoint: The API returns JSON with the key, 401 without it, and curl complains about the self-signed certificate without -k.

5Read the API with an HTTP agent item

On web01 open the Macros tab and add {$API.KEY} with type Secret text and value lab-secret-123. Then create an item:

Then add dependent items on it with JSONPath (as in Lesson 11): shop.api.orders_pending with $.orders_pending (Numeric unsigned), shop.api.db_latency with $.db.latency_ms (Numeric float, units ms), and shop.api.status with $.status (Character). A trigger last(/web01/shop.api.status)<>"ok" named “Shop API reports {ITEM.LASTVALUE}” completes it. Because this item type is polled by the server, the Test button’s Get value and test works here.

In the Test window the Value box fills with the JSON from the API, and because this item has no preprocessing steps, the Result is the same JSON.

✅ Checkpoint: Shop API: health JSON tests with a 200 reply, and orders_pending shows 12 in Latest data.

6Monitor certificate expiry with agent 2

Agent 2 on web01 can read the certificate locally. Test the key first:

Run this on web01:

sudo zabbix_agent2 -t 'web.certificate.get[web01.lab,443,127.0.0.1]'

You should see this (your serial, dates and fingerprints will differ):

web.certificate.get[web01.lab,443,127.0.0.1][s|{"x509":{"version":3,"serial_number":"05e83d5d324e1f62cb471f9338789a92a729469f","signature_algorithm":"SHA256-RSA","issuer":"CN=web01.lab","not_before":{"value":"Nov 08 06:27:21 2026 GMT","timestamp":1794119241},"not_after":{"value":"Nov 08 06:27:21 2027 GMT","timestamp":1825655241},"subject":"CN=web01.lab","public_key_algorithm":"RSA","alternative_names":["web01.lab","web01"]},"result":{"value":"valid-but-self-signed","message":"certificate verified successfully, but determined to be self signed"},"sha1_fingerprint":"d112f166af60865879f8496164f0cb73aa15c2e3","sha256_fingerprint":"b7313744093b157430d248e2d5230345f1b4cd0480d31c235149fa0c4164fb4c"}]

That’s real agent 2 output for a certificate made the same way (your serial, dates and fingerprints will differ). The third parameter is the address to connect to, and the first is the name to check the certificate against. Create an item Cert: web01.lab of type Zabbix agent (active), key web.certificate.get[web01.lab,443,127.0.0.1], Text, interval 1h, and a dependent item cert.not_after[web01.lab] with JSONPath $.x509.not_after.timestamp, units unixtime.

The expiry trigger, the same formula the official “Website certificate by Zabbix agent 2” template uses: (last(/web01/cert.not_after[web01.lab]) - now()) / 86400 < 30, name "Certificate for web01.lab expires in less than 30 days", severity Warning. For many sites at work, link that official template and list the sites in its macros instead of building items by hand.

✅ Checkpoint: Latest data shows "Cert: web01.lab" and cert.not_after shows a date about one year ahead.

7Watch a real outage

Stop Nginx on web01 for two minutes and watch both kinds of check fail:

Run this on web01:

sudo systemctl stop nginx; sleep 150; sudo systemctl start nginx

Monitoring > Problems shows two High problems for web01: Lab shop is failing on web01: Failed to connect to 192.168.56.81 port 80 after 0 ms: Couldn't connect to server and Nginx is down on web01.

The web scenario and the template trigger from Lesson 10 both fire, and both recover a minute or two after Nginx starts. The HTTP agent item goes Not supported with a similar "Couldn't connect" error and recovers by itself on its next successful check.

✅ Checkpoint: Problems showed the scenario failure with its reason, and everything recovered after Nginx started.