Configuration¶

This section details the configuration and optimization of the OPC UA plugin.

Plugin Options¶

The following options are available for the OPC UA plugin.

System.Path¶

Plugins.OPCUA.System.Path — Path to the external plugin executable.
Mandatory: yes
Default value: /usr/sbin/zabbix-agent2-plugin/zabbix-agent2-plugin-opcua

Timeout¶

Plugins.OPCUA.Timeout — The maximum time in seconds to wait for an OPC UA server to respond to requests.
Mandatory: no
Limits: 1-30
Default value: Global timeout

Uri¶

Plugins.OPCUA.Default.Uri
Plugins.OPCUA.Sessions.<SessionName>.Uri
OPC UA endpoint URI to connect to. If specified in a session, it overrides the default value.
Mandatory: no
Range: Must match URI format; supported schema: opc.tcp.
Default value: opc.tcp://localhost:4840

User¶

Plugins.OPCUA.Default.User
Plugins.OPCUA.Sessions.<SessionName>.User
Username for authentication. Connects anonymously if omitted. If specified in a session, it overrides the default value.
Mandatory: no
Default value:

Password¶

Plugins.OPCUA.Default.Password
Plugins.OPCUA.Sessions.<SessionName>.Password
Password for authentication. If specified in a session, it overrides the default value.
Mandatory: no
Limits: up to 512 characters
Default value:

SecurityMode¶

Plugins.OPCUA.Default.SecurityMode
Plugins.OPCUA.Sessions.<SessionName>.SecurityMode
Message security mode. If specified in a session, it overrides the default value.
Mandatory: no
Accepted values: None, Sign, SignAndEncrypt
Default value: None

SecurityPolicy¶

Plugins.OPCUA.Default.SecurityPolicy
Plugins.OPCUA.Sessions.<SessionName>.SecurityPolicy
Security policy URI or short name. If specified in a session, it overrides the default value.
Mandatory: no
Accepted values: None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss, or a full security policy URI.
Default value: None

CertFile¶

Plugins.OPCUA.Default.CertFile
Plugins.OPCUA.Sessions.<SessionName>.CertFile
Full pathname of client X.509 certificate file (.crt or .pem). If specified in a session, it overrides the default value.
Mandatory: no
Default value:

KeyFile¶

Plugins.OPCUA.Default.KeyFile
Plugins.OPCUA.Sessions.<SessionName>.KeyFile
Full pathname of client private RSA key file (.key or .pem). If specified in a session, it overrides the default value.
Mandatory: no
Default value:

Named Sessions¶

Named sessions allow you to group connection credentials and security settings per server in opcua.conf and reference them in item keys instead of passing individual key parameters.

To define a named session, add the parameters to the plugin configuration file:

Plugins.OPCUA.Sessions.ScadaServer.Uri=opc.tcp://scada.corp.local:4840
Plugins.OPCUA.Sessions.ScadaServer.User=operator
Plugins.OPCUA.Sessions.ScadaServer.Password=TopSecret123
Plugins.OPCUA.Sessions.ScadaServer.SecurityMode=SignAndEncrypt
Plugins.OPCUA.Sessions.ScadaServer.SecurityPolicy=Basic256Sha256
Plugins.OPCUA.Sessions.ScadaServer.CertFile=/etc/zabbix/certs/opcua_client.crt
Plugins.OPCUA.Sessions.ScadaServer.KeyFile=/etc/zabbix/certs/opcua_client.key

Once defined, the session name can be used as the first parameter in item keys: opcua.ping[ScadaServer]

Named session parameters override Default parameters. If a parameter is not defined in a session, the corresponding Default parameter will be used.