[HTCondor-users] condor_q -global permissions for monitoring user (Zabbix)

[Simona Maria Stellacci <simona.stellacci@xxxxxxxxxx>]

Hello everyone,

I am trying to monitor running jobs on our HTCondor-CE cluster using 
Zabbix.
I created a bash script that uses `condor_q -global` to get the number 
of running jobs per user and per machine.

The problem is that when I run the script as the `zabbix` user, I get no 
output: jobs from other users are not visible, even though `zabbix` is 
included in ALLOW_READ:

ALLOW_READ = *.my.domain.it, zabbix@localhost, 
user_one@xxxxxxxxxxxxxxxxxxxxxx, zabbix, zabbix@xxxxxxxxxxxxxxxxxxxxxx, 
zabbix@xxxxxxxxxxxxxxxxxxxxxx

I would like to know:
1. What is the correct way to allow a monitoring user to use `condor_q 
-global` without granting full admin privileges?
2. Are there best practices for multiple schedds in a CE setup that 
allow gathering aggregated metrics without exposing usersâ jobs?

Thank you for any suggestions!

Best regards,
Simona Maria Stellacci