zabbix: add agent active checks compression

[dormancygrace]

Package details

Maintainer: @danielfdickinson

Enable compression for classic Zabbix agent active-check traffic. The new EnableCompression agent configuration option defaults to 1 and can be set to 0 for servers or proxies older than 4.0.

The classic agent now passes the selected protocol flags through the redirect-aware exchange path. zabbix_sender remains uncompressed. The build also supplies zlib explicitly because upstream's configure script probes it only when server or proxy support is enabled.

Upgrade note

/etc/zabbix_agentd.conf is a preserved conffile. Existing installations do not receive the new commented example when upgrading, although compression now defaults to enabled to match agent2. Administrators using a server or proxy older than 4.0 must add EnableCompression=0 to their preserved config.

Run testing details

• OpenWrt build tree: 25.12.5, Linux 6.12.94
• OpenWrt target/subtarget: ramips/mt7620 (mipsel_24kc, GCC 16.2.0)
• Package source: exact Zabbix 7.0.30-r2 PR branch

Validation against the exact current source:

• verified the downloaded Zabbix 7.0.30 source against the package SHA-256;
• applied all package patches in order with --fuzz=0, then ran make package/zabbix/refresh; every patch, including 120-zabbix-agentd-compress-active-checks.patch, remained unchanged;
• built zabbix-agentd-7.0.30-r2.apk with agent compression enabled; the build used ZBX_AGENT_COMPRESSION and HAVE_ZLIB, the binary has NEEDED libz.so.1, and the APK depends on zlib;
• built agent-only with compression disabled; neither feature macro was present, the binary has no libz.so.1 dependency, and the APK does not depend on zlib;
• built the mixed zabbix-agentd + zabbix-sender selection with agent compression disabled; the build used HAVE_ZLIB without ZBX_AGENT_COMPRESSION, the agent binary has NEEDED libz.so.1, and the agent APK correctly retains its zlib dependency;
• on the preceding 7.0.28-r4 revision, ran the generated MIPS32 agent under qemu-mipsel: configuration validation accepts EnableCompression=0 and 1 and rejects 2;
• captured the cross-built agent's active-check heartbeat on a local listener: disabled mode used flags 0x01, a 109-byte original JSON payload and zero reserved length; enabled mode used flags 0x03, a 98-byte zlib payload and the correct 109-byte uncompressed length;
• decompressed content from enabled mode is equivalent to the disabled payload. The seven source-code hunks implementing compression are unchanged on 7.0.30.

Upstream

• Add compression support to agent active checks zabbix/zabbix#180
• https://support.zabbix.com/browse/ZBXNEXT-10703

The downstream patch header records both references.

Formalities

• I have reviewed CONTRIBUTING.md.
• The patch can be applied with git am.
• The patch was refreshed without offsets or fuzz.
• The change is submitted upstream.

[dormancygrace]

Upstream implementation submitted as zabbix/zabbix#180: zabbix/zabbix#180

[dormancygrace]

Official Zabbix feature request: ZBXNEXT-10703. The upstream implementation patch is attached there.

[danielfdickinson]

Nice! I'll take a closer look when I'm not fighting with instance problems at my cloud hoster. EDIT: Due to the hour, it now means once I'm back from work tomorrow.

[openwrt-ai]

Reviewed 1 new commit; no new issues found.

---

Generated by Claude Code

[danielfdickinson]

Looks like zabbix-extra-network postinst is broken. Not sure how I missed that.

Prior to this PR, that is.

[danielfdickinson]

Fixing the CI in #29999

[danielfdickinson]

I've decided to wait a couple of days to see if there are any comments upstream (and because I am busy). If not, I will run both the upstream PR and this PR through some automated testing, and run-test locally, for a second set of eyeballs on the PR.

It might need some minor rebasing, shortly, as I have noticed 7.0.28 is out, so I will be updating to pull the new version.

We should probably good until the end of the first week of August before the next version bump, after that.

[BKPepe]

Based on @danielfdickinson's comment, I am putting this on hold, well on blocked label! And btw: great decision!

[danielfdickinson]

I should be able to look at this this weekend.

[danielfdickinson]

Sorry, the weekend got away from me. I intend to look at it later this week.

[openwrt-ai]

Re-reviewed after the force-push (rebase onto zabbix 7.0.28 plus a regeneration of the 120- patch context). The content is otherwise unchanged from what was reviewed at 8e9b829.

The refresh itself looks clean — the new @@ -175,6 +175,17 @@ StartAgents=1 hunk sits on the post-010-zabbix_agentd-tweak-config-file-for-openwrt.patch tree (its context line # ServerActive=127.0.0.1 and the StartAgents=1 function context are both artifacts of that earlier patch), and the diffstat in the patch header still matches the body exactly.

Spot-checks that came back clean, for the record:

• zbx_tcp_send_ext(sock, data, strlen(data), 0, protocol, 0) is identical to the zbx_tcp_send(s, d) macro in include/zbxcomms.h apart from the flags argument, so the substitution is faithful.
• reserved = 0 is correct: zbx_tcp_send_ext() compresses internally and only skips it when reserved != 0 ("compress if not compressed yet"), so callers must not pre-compress.
• All in-tree callers of zbx_comms_exchange_with_redirect() are updated — the two in active_checks.c, send_heartbeat_msg(), and both sender variants. Nothing else in the tree calls it, so the signature change does not break the server/proxy variants.
• -DHAVE_ZLIB is genuinely required rather than belt-and-braces: src/libs/zbxcompress/compress.c carries a stubbed zbx_compress() in its #else branch that just fails, so without the define the compressed send would fail at runtime rather than at link time.
• The CONFIGURE_VARS approach works because configure.ac unconditionally folds $ZLIB_LIBS/$ZLIB_LDFLAGS into AGENT_LIBS/AGENT_LDFLAGS, even though the probe that populates them only runs for server/proxy — which matches your reported libz.so.1 result.
• PKG_RELEASE bump to 4 is right for adding a patch, and --with-zlib=$(STAGING_DIR)/usr is the correct base-directory form (the old value produced -I.../usr/include/include).

Nothing below blocks a merge: one patch-metadata item, one upgrade-path question, and two nits.

---

Generated by Claude Code

[openwrt-ai]

Reviewed 1 new commit; no new issues found.

The delta since 981b540 is confined to the three points raised last time, and each is addressed:

• Upstream-Status: Submitted [.../zabbix/zabbix/pull/180] plus a Link: to ZBXNEXT-10703 now sit in the 120- patch header, above the --- separator, so they survive git am and stay with the patch once merged.
• The CONFIGURE_VARS += continuation lines moved from tabs to two spaces, matching PKG_CONFIG_DEPENDS and the rest of the file. Harmless either way for make (it is a variable assignment, not a recipe), but consistent now.
• The commit message gained the conffile-preservation paragraph and the upstream references, and the PR body carries the 7.0.28-r4 retest results and the upgrade note.

No hunk headers or patch bodies changed, so the earlier verification of the zbx_tcp_send_ext() substitution, reserved = 0, the complete set of zbx_comms_exchange_with_redirect() call sites, -DHAVE_ZLIB, and the PKG_RELEASE bump still holds. The three FormalityCheck runs on a0ee1b0 are green.

I could not verify zabbix/zabbix#180 from this session (only openwrt/packages is reachable), so the upstream link is taken at face value.

---

Generated by Claude Code

[danielfdickinson]

See zabbix/zabbix#180 (comment). There are some small changes needed to the upstream version, but, as I mention in a follow-up, I think defaulting to compression does make sense rather than out of the box backwards configuration compatibility with servers/proxies three major versions ago (4.x series).

[dormancygrace]

The upstream PR has been updated with a ZBXNEXT-10703 changelog entry documenting the classic agent zlib build dependency. Compression remains enabled by default, following the upstream review follow-up; EnableCompression=0 preserves compatibility with pre-4.0 servers/proxies. No OpenWrt package code change is needed for these review points because this PR already supplies and verifies the agent-only zlib build flags.

[danielfdickinson]

@dormancygrace 7.0.29 has been released do I am updating the package, but once that is merged and you have rebased, I will make time to test this on my machine.

@BKPepe Upstream doesn't look like they necessarily comment on proposed updates until they actually merge them, and that can take some time, so I am disinclined to wait longer for comments upstream, as I have run the upstream PR through automated review and there wasn't much to change, and @dormancygrace has made the changes (and the changes don't affect this PR as they were more about upstream admin/metadata).

[danielfdickinson]

@dormancygrace Actually I do have a thought. For the OpenWrt package, could you add a default y ZABBIX_ENABLE_AGENT_COMPRESSION flag (or similar) and make the libz dependency and configure and compiler flags conditional on that flag?

[dormancygrace]

Implemented, thanks for the suggestion.

ZABBIX_ENABLE_AGENT_COMPRESSION is now a default-enabled build option. The zlib package dependency, HAVE_ZLIB, configure variables, and --with-zlib are conditional. Other Zabbix packages that need zlib still request it independently.

I cross-built both variants for mipsel_24kc:

• enabled: package depends on zlib, binary has NEEDED libz.so.1;
• disabled: package has no zlib dependency and the binary has no libz.so.1.

The no-zlib binary also passed -T under qemu-mipsel. With EnableCompression=1, its active-check heartbeat correctly used an uncompressed Zabbix frame (flags=0x01), so an existing runtime config remains safe. Patch refresh is clean.

Updated head: 872a08078.

[dormancygrace]

Fixed the Makefile assignment style reported by FormalityCheck and updated the branch to 4d256efe8. This is whitespace-only relative to the two validated build variants.

[openwrt-ai]

Reviewed the delta since a0ee1b0: the new ZABBIX_ENABLE_AGENT_COMPRESSION build option, the conditional zlib wiring in the Makefile, and the #ifdef HAVE_ZLIB guards added to the 120- patch. The patch hunks that were verified in the previous round are unchanged apart from those guards, so the earlier checks on zbx_tcp_send_ext(), reserved = 0, and the complete set of zbx_comms_exchange_with_redirect() call sites still hold.

Clean on re-check:

• +ZABBIX_ENABLE_AGENT_COMPRESSION:zlib matches the conditional-DEPENDS form already used in this Makefile (+ZABBIX_CURL:libcurl), and Config.in follows the file's existing tab indentation.
• The #else static int zbx_config_enable_compression; fallback plus the guard in active_checks_thread() is the right pair: the config parameter stays parseable on a no-zlib build and EnableCompression=1 becomes a no-op instead of a runtime send failure.
• PKG_RELEASE is still correct at 4 against master's 3 — one release bump covers the whole added patch, and PKG_VERSION is untouched.
• Three FormalityCheck runs on 4d256ef are green.

One item I'd resolve before merge — the agent's zlib dependency is now narrower than the condition under which the agent actually links libz, so a build that disables compression while also selecting zabbix-server/zabbix-proxy/zabbix-sender/zabbix-get can ship zabbix-agentd with an undeclared libz.so.1 dependency. Details inline on the Makefile. The rest is one stale patch diffstat, one upstream-divergence question, and two nits.

---

Generated by Claude Code

[danielfdickinson]

This PR is next on my list when I am back to OpenWrt - should be later today. BTW PKG_RELEASE here should probably be '2' not '1' as suggested - it will just complain about lack of PKG_RELEASE bump if you use '1'.

[dormancygrace]

Thanks — fixed. I rebased onto the 7.0.29 package update and set PKG_RELEASE:=2. Both the compression-enabled agent build and the mixed agentd + sender build with agent compression disabled pass on 7.0.29-r2. I also split the agent feature guard from HAVE_ZLIB, so another selected Zabbix component cannot accidentally enable agent compression. Updated head: 2b27c00.

[danielfdickinson]

@dormancygrace I've finally had a chance to do some testing here. It works well with and without SSL (as expected with your testing).

@BKPepe could you take a look and unblock / provide a Copilot second opinion?

[openwrt-ai]

Reviewed the delta since 4d256ef: the rebase onto 7.0.29, the widened zlib dependency on Package/zabbix-agentd/Default, the HAVE_ZLIB → ZBX_AGENT_COMPRESSION guard rename, and the patch-header note plus refreshed diffstat.

Clean on re-check:

• The new conditional-DEPENDS list mirrors ZABBIX_NEEDS_ZLIB symbol for symbol, which closes the previous round's finding. It also covers the cross-variant cases correctly: ZABBIX_NEEDS_ZLIB is a plain global, not per-BUILD_VARIANT, so the basic build links libz under exactly the same conditions as full — putting the list on the shared Package/zabbix-agentd/Default rather than on zabbix-agentd alone is the right call.
• The refreshed patch diffstat matches the body. Recounted all eight files: 40 insertions, 11 deletions, and each per-file line agrees (active_checks.c +10/-3, zabbix_agentd.c +8/-0).
• PKG_RELEASE:=2 on top of master's 7.0.29-r1 is right for adding a patch, and PKG_VERSION is untouched by this PR.
• The #else static int zbx_config_enable_compression; fallback still keeps EnableCompression parseable on a build with the option off, so an existing conffile carrying the setting does not become a startup error.
• The OpenWrt note: paragraph sits above the --- separator in the patch header, so it survives git am and travels with the patch.
• CI on 2b27c00: the three FormalityCheck runs are green; the architecture build matrix is still queued/in progress, nothing failed.

One item I'd resolve before merge — the guard rename dropped the only thing that selected Zabbix's real zbx_compress() in agent-only builds, which is the package's default configuration. Details inline on the Makefile, along with a question about whether the on-wire capture was re-run on this revision. Plus one nit.

---

Generated by Claude Code

[dormancygrace]

Thank you for testing both configurations on real hardware. That confirms the package-side compression path works with and without SSL in addition to the cross-build and protocol checks.

[openwrt-ai]

Reviewed the delta since 2b27c00: -DHAVE_ZLIB restored under ZABBIX_NEEDS_ZLIB, the reverted Package/zabbix-agentd/Default dependency list, and the reworded Config.in help. The 120- patch is byte-identical to the previously reviewed revision, so the earlier checks on zbx_tcp_send_ext(), reserved = 0, the complete set of zbx_comms_exchange_with_redirect() call sites, the diffstat and the patch header all still hold.

Clean on re-check:

• TARGET_CPPFLAGS += -DHAVE_ZLIB inside ifneq ($(ZABBIX_NEEDS_ZLIB),) is the right placement, and strictly better than what I suggested last round: CONFIG_ZABBIX_ENABLE_AGENT_COMPRESSION is itself a member of ZABBIX_NEEDS_ZLIB, so the default agent-only build gets the real zbx_compress() while ZBX_AGENT_COMPRESSION stays the independent agent switch. That closes the previous round's finding.
• The forced -DHAVE_ZLIB is benign where configure also defines it — both expand to 1, so the redefinition is identical and warning-free.
• The commit message matches the diff, including the new "Keep HAVE_ZLIB defined whenever any selected Zabbix component needs the real compression implementation" paragraph and the restored conffile-preservation caveat.
• PKG_RELEASE:=2 on master's 7.0.29-r1 is correct for adding a patch; PKG_VERSION untouched.
• CI on ec0fdc4: the three FormalityCheck runs are green, nothing failed.

One item I'd resolve before merge, and it is the same one as last round rather than a new one: reverting the widened zlib dependency puts the agent package's declared dependency back to being narrower than the condition under which the agent binary actually links libz. The justification given ("each of those packages already owns its zlib dependency") is about the sibling packages, not about zabbix-agentd itself, so I don't think it settles the case. Details and a concrete check that would confirm or kill it are inline on the Makefile. Plus one nit on a stranded comment.

---

Generated by Claude Code

[danielfdickinson]

@dormancygrace I've been making my share of annoying little mistakes on my own PRs. I've had to remember that when there is no urgency, so try to slow down and not worry if it takes an extra day or two. (Not sure how long I'll remember that lesson though; I tend to get impatient, especially since elsewhere it tends to be about getting things done yesterday).

So, just a friendly, don't worry, and a reminder (as much to me as you) to take it easy and remember that the only pressure is from oneself.

[openwrt-ai]

Reviewed the delta since ec0fdc4: the restored conditional zlib list on Package/zabbix-agentd/Default and the two reworded comment blocks in the Makefile. The 120- patch and Config.in are byte-identical to the previously reviewed revision, so the earlier checks on zbx_tcp_send_ext(), reserved = 0, the complete set of zbx_comms_exchange_with_redirect() call sites, the diffstat and the patch header all still hold.

Clean on re-check:

• The restored list mirrors ZABBIX_NEEDS_ZLIB symbol for symbol — ZABBIX_ENABLE_AGENT_COMPRESSION plus the five package symbols — so zabbix-agentd now declares zlib in exactly the configurations where the shared build passes ZLIB_LIBS/--with-zlib and the agent binary can acquire a libz.so.1 NEEDED entry. That closes the finding carried over from the last two rounds. Where the linker turns out not to need it the declaration is merely redundant, which is the harmless direction, and it restores parity with master's unconditional +zlib.
• Placing the list on /Default rather than on zabbix-agentd alone remains right: ZABBIX_NEEDS_ZLIB is a plain global, not per-BUILD_VARIANT, so zabbix-agentd-basic links libz under the same conditions as the full variant — including via zabbix-get/zabbix-sender, which are full but still flip the global.
• No other Zabbix package can pull zlib into the shared build: zabbix-extra-* and zabbix-frontend-server are all VARIANT:=no-configure, so the six symbols are the complete set.
• The comment split is now accurate — the ZBX_AGENT_COMPRESSION block describes only the feature switch, and the zlib-probe rationale sits directly above -DHAVE_ZLIB inside the ifneq ($(ZABBIX_NEEDS_ZLIB),) block.
• The commit message matches the diff, including the new "The programs share one configure and build … Mirror the shared-build conditions in the agent package dependency" paragraph, which documents exactly this change.
• PKG_RELEASE:=2 on master's 7.0.29-r1 is still correct for adding a patch; PKG_VERSION untouched.
• CI on b5f3fb8: the three FormalityCheck runs are green, nothing failed.

Nothing blocking from my side on this revision. One wording nit inline on Config.in, where the help text still reflects the intermediate revision that had the narrow dependency.

---

Generated by Claude Code

[openwrt-ai]

Reviewed 1 new commit; no new issues found.

The delta since b5f3fb8 is a single hunk: the ZABBIX_ENABLE_AGENT_COMPRESSION help text in Config.in, which now reads "the agent drops its zlib dependency, unless another selected Zabbix package makes the shared build link zlib anyway." That closes the last round's nit — the qualifier is now about zabbix-agentd's own dependency rather than about the sibling packages, which matches both the restored PACKAGE_*:zlib list on Package/zabbix-agentd/Default and the commit message's "When disabled for an agent-only build" scoping. Indentation follows the file's existing tabs.

Nothing else moved: the 120- patch, the Makefile and the commit message are byte-identical to the previously reviewed revision, so the earlier verification still holds — the zbx_tcp_send_ext() substitution, reserved = 0, the complete set of zbx_comms_exchange_with_redirect() call sites, the ZABBIX_NEEDS_ZLIB mirroring in both -DHAVE_ZLIB and the agent DEPENDS, the patch header diffstat, and PKG_RELEASE:=2 on master's 7.0.29-r1 with PKG_VERSION untouched.

CI on 13f9863: the three FormalityCheck runs are green, nothing failed.

Nothing blocking from my side on this revision.

---

Generated by Claude Code

[dormancygrace]

Rebased onto current master and Zabbix 7.0.30. The package release remains correctly incremented to 2, and the embedded source patch was refreshed for the 7.0.30 sample configuration so it now applies without fuzz or offsets.

Validation before the push:

• downloaded zabbix-7.0.30.tar.gz and verified it against the package SHA-256;
• dry-applied all eight patch hunks to the pristine 7.0.30 source with no fuzz or offsets;
• git diff --check passed for the OpenWrt Makefile and Kconfig changes.

New head: 310531c609.

[openwrt-ai]

Reviewed the delta since 13f9863: the rebase onto master and Zabbix 7.0.30, and the refreshed conf/zabbix_agentd.conf hunk in the 120- patch.

Clean on re-check:

• PKG_RELEASE:=2 on master's 7.0.30-r1 is correct for adding a patch; PKG_VERSION/PKG_HASH come from master's 070a299 and are untouched by this commit.
• The seven source hunks in the 120- patch (zbxcommshigh.h, commshigh.c, active_checks.c, active_checks.h, zabbix_agentd.c, both sender variants) are byte-identical to the previously reviewed revision, so the earlier checks on the zbx_tcp_send_ext() substitution, reserved = 0, and the complete set of zbx_comms_exchange_with_redirect() call sites still hold.
• The patch-header diffstat still matches the body — the conf hunk is unchanged in size (+11), so 40/11 is still right.
• The commit message matches its diff.
• CI on 310531c: nothing has failed; the checks are still pending.

Two things I'd resolve before merge, both introduced by this rebase rather than by the feature itself:

1. The refreshed conf hunk was generated against the pristine 7.0.30 tarball instead of the tree after 010-zabbix_agentd-tweak-config-file-for-openwrt.patch, so its context line and line numbers are wrong for the tree it lands on. It survives only on patch's default fuzz 2. Details and the reproduction inline on the patch.
2. admin/zabbix/Makefile and admin/zabbix/Config.in at this head are byte-identical to their state at ec0fdc4 apart from the version bump, so the work from b5f3fb8 and 13f9863 — the PACKAGE_*:zlib list on Package/zabbix-agentd/Default, the comment split, the Config.in help wording and the corresponding commit-message paragraph — is gone. That re-opens the dependency finding you closed in b5f3fb8. Details inline on the Makefile.

Plus one nit on the stale PR body.

---

Generated by Claude Code