From fdf4d32a5dbc1f47b8d2e4c6043079589dc5e20e Mon Sep 17 00:00:00 2001 From: Patrik Uytterhoeven Date: Mon, 19 Feb 2024 15:45:45 +0100 Subject: [PATCH] pdf generated --- site/search/search_index.json | 2 +- site/sitemap.xml | 60 +++++++++++++++++----------------- site/sitemap.xml.gz | Bin 527 -> 527 bytes zabbix-7-book.pdf | Bin 2483186 -> 2623081 bytes 4 files changed, 31 insertions(+), 31 deletions(-) diff --git a/site/search/search_index.json b/site/search/search_index.json index 99c28b16..ee4fdbf3 100644 --- a/site/search/search_index.json +++ b/site/search/search_index.json @@ -1 +1 @@ -{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"What is this book about ?","text":"

Hi, welcome and thank you for your interest in my Zabbix book. I wrote the Zabbix cookbook and co wrote with Richards Zabbix 4 Network Monitoring a few years ago for PackPub.

The cookbook the first of it's kind probably outdated and will be replaced by the Zabbix 7 IT Infrastructure Monitoring Cookbook, written by Brian and Nathan, 2 people I like a lot to work with and can higly recommend. There are many more books available from Packt about Zabbix a complete overview can be found here Zabbix books at pack. Or if you like to find some non English books Amazon has some books form Packt and other Publishers in Chinese, Spanish and maybe some other languages as well. Other books

As Zabbix is an opensource product and making money out of the books was never my intention, it got me thinking how to do things different. How to make a new book without using a publisher like I had done before. After a while, I came up with the idea to make a book that would be free and that would be updated when new versions came out. Since I am a huge fan of documentation in markdown or asciidoc I came up with the idea to share the book in git and use markdown. The only problem left was how to make those markdown files readable in an easy way like a book ? After some searching trying to look for a good solution I found MkDocs. MkDocs is a Python-Markdown library that can convert everything to HTML and can be templated. So the problem was solved and a new book was born.

"},{"location":"#who-am-i","title":"Who am I ?","text":"

My name is Patrik Uytterhoeven and I work for a Belgium company named Open-Future. I started at this company at Januari 2013 and that's when my journey started with Zabbix as well. They gave me the opportunity to build my experience and to get certified as Zabbix trainer. Since this year I am officially 10y Zabbix trainer. If you would like to follow one of my trainings feel free to register for a training at our website www.open-future.be. Why would you follow a training if you can read this book for free are you now thinking? Because trainings just like the book explain you all the details on how to set up and do things but also give you valueable tips and feedback that you never get from a book. Books just can't cover everything.

"},{"location":"#what-os-do-i-need","title":"What OS do I need ?","text":"

Since I work mostly with RHEL based systems and since I am convinced that RHEL is the better choice in Production environments I have chosen to focus on using one of the forks that is available for free. Zabbix is supported on Ubuntu, Debian, Suse, Raspberry .... and it can be compiled on any OS that is Unix based so it's almost impossible to cover them all. However the book is Opensource and in GIT so feel free to contribute the code for your favorite flavour :). I will use Rocky Linux 9 in this book, but it should work for most of the other installations as well.

"},{"location":"#what-version-of-zabbix-is-used-in-this-book","title":"What version of Zabbix is used in this book ?","text":"

Since we are almost at the release of Zabbix 7, I will focus on version 7 since it will be the new LTS. It should also apply to most other versions but of course there will be minor changes. In the future, if there is enough support from the community to update this book together, it would be great if we could build a book for every LTS version available.

"},{"location":"#how-to-use-this-book","title":"How to use this book ?","text":"

The book will try to cover all the topics, feel free to let me know if something is missing or feel free to make a pull request. There is no need to start from page 1 and read the book till the end. Some people will be looking for basic knowledge others might want to skip to the fun part, so I want the book to be useful for everyone. Therefor I will try to explain as best as possible in every topic the exact steps needed to reproduce.

There will be moments in the book where you need to type some code, I will show the commands you need to type in a box just like here.

# some command \n

Notes to some useful documentation will be added at the bottom of the page.

Here is a simple footnote1. With some additional text after it.

In case there is some important information to share I will add notes in the documentation like can be seen here :

Note

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Info

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Tip

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Question

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Warning

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Bug

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Example

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

  1. My reference.\u00a0\u21a9

"},{"location":"actions/zabbix-eventactions/","title":"Event based Actions","text":""},{"location":"api/zabbix-api/","title":"Zabbix API","text":""},{"location":"automation/automating-configuration/","title":"Automating configuration","text":""},{"location":"configuration/Dashboard/","title":"Zabbix Interface","text":"

This chapter is going to cover the basics we need to know when it comes to the Zabbix userinterface and the thing we need to know before we can start to fully dive into our monitoring tool. We will see how the userinteface works how to add a host, groups users, items ... so that we have a good understanding of the basics. This is something that is sometimes missed and can lead to frustrations not knowing why things don't work like we had expected them to work. So even if you are an advanced user it may be usefull to have a look into this chapter.

"},{"location":"configuration/Dashboard/#overview-of-the-interface","title":"Overview of the interface","text":"

With Zabbix 7 the user interface after logging in is a bit changed. Our menu on the left side of the screen has has a small overhaul. Let's dive into it. When we login into our Zabbix setup the first time with our Admin user we see a page like this where we have our main window in green our main menu marked in red and our links marked in yellow.

The main menu can be hidden by collapsing it completely or to reduce it to a set of small icons.

When we click on the button with the 2 arrows to the left:

You will see that the menu collapses to a set of small icons. Pressing \">>\" will bring the main menu back to it's original state. Pressing the box with the arrow sticking out next to the \"<<\" button will hide the main menu completely.

To get the main menu back it's not too difficult we just look for the button on the left with three horizontal lines and click it. This will bring the menu back and clicking on the box with the arrow agian will bring the main menu back.

Yet another way to make the screen bigger that is quit useful for monitors in NOK teams for example is the kiosk mode button. This one is however located on the left side of your screen and looks like 4 arrows pointing to every corner of the screen. Pressing this button will remove all the menus and leave only main window to focus on.

When wanting to leave the kios mode the button will be changed to 2 arrows poiting to the inside of the screen. Pressing this button will revert us back to the original state.

Tip

We can also enter and exit kiosk mode by making use of parameters in our Zabbix url: /zabbix.php?action=dashboard.view&kiosk=1 - activate kiosk mode or /zabbix.php?action=dashboard.view&kiosk=0 - activate normal mode

Note

There are many other page parameters we can use. A full list can be found here

Zabbix also has a global search menu that we can use to find hosts, host groups and templates.

If we look in the search box for server you will see that we get an overview of all templates, host groups and hosts with the name server in it.

"},{"location":"configuration/Dashboard/#main-menu","title":"Main menu","text":"

Our main menu on the left consists of a few sections, 9 to be exact:

Menu Name Details Dashboards Contains an overview of all the dashboards we have access to. Monitoring Shows us the hosts, problems, latest data, maps, ... Services An overview of all the Services and SLA settings. Inventory An overview of our collected inventory data. Reports Shows us the system information, scheduled reports, audit logs, action logs, etc . Data collection Contains all things related to collecting data like hosts, templates, maintenance, discovery, ... Alert The configuration of our media types, scripts and actions Users User configuration like user roles, user groups, authentication, API tokes, ... Administration The administration part containing all global settings, housekeeper, proxies, queue, ..."},{"location":"configuration/Dashboard/#links-menu","title":"Links menu","text":"

Our last part the links part contain a set of useful links that we can use:

Menu name Details Support This brings us to the technical support page that you can buy from Zabbix. Remember that your local partner is also able to sell these contracts and can help you in your own language. Your local distributors Integrations The official zabbix integeration page Help The link to the documentation of your Zabbix version User settings The user profile settings. Sign out Log out of the current session.

There are still a few buttons that we need to cover on the right side of our screen

The edit button allows us to change our dashboard. This is something we will cover later. On the far left side there is a \"?\" this will bring you to the Zabbix documentation page that explains everything about the dashboard. The button on the right side with the 3 horizontal lines is the one to share, rename, delete, ... our dashboards.

"},{"location":"configuration/Dashboard/#system-information","title":"System Information","text":"

There is also a box on the dashboard called System Information. This widget will show you the current System status of your Zabbix setup. Let's go over the different lines of information as they are important to understand.

Parameter Value Details Zabbix server is running This gives us the status of our zabbix server if it is running yes or no and if it is running on our localhost or another IP and on what port the zabbix server is listening. If no trapper is listening the rest of the information can not be displayed IP and port of the Zabbix server Zabbix server version This shows us the version of the Zabbix server so the version you see at the bottom of your screen is the one from the Zabbix frontend and can be different but should be in the same major version. Version Number Zabbix frontend version This is the version of the frontend and should match with what you see at the bottom of your screen. Version Number Number of hosts (enabled/disabled) The total number of hosts configured on our system How many of those are enabled and disabled Number of templates The number of templates installed on our Zabbix server. Number of items (enabled/disabled/not supported) This line shows us the number of items we have configured in total in this case 99 90 are enabled and 0 are disabled but 9 of them are unsupported. This last number is important as those are items not working. We will look into this later why it happens and how to fix it. For now remember that a high number of unsupported items is not a good idea. Number of triggers (Enabled/disabled[problem/ok]) The number of triggers configured Number of enabled and disabled triggers. Just as with items we also see if there are triggers that are in a problem state or ok state. A trigger in a problem state is a non working trigger something we need to monitor and fix. We will cover this also later. Number of users (online) Here we see the number of users that are configured on our system The nunber of users currently online. Required server performance, nvps The number of new values per second that Zabbix will process per second. This is just an estimated number as some values we get are unknown so the real value is probably higher. So we can have some indication about how many IOPS we need and how busy our database is. A better indication is probably the internal item zabbix[wcache,values,all] High availability cluser It will show us if we are running on a Zabbix HA cluster or not Failover delay once HA is activated Tip

System information may display some additonal warnings like when your database doesnt have the correct character set or collation UTF-8. Also when the database you used is lower or higher then the recommended version or when there are misconfigurations on housekeeper or TimescaleDB. Another warning you can see is about database history tables that aren't upgraded or primary keys that have not been set. This is possible if you are coming from an older version before Zabbix 6 and never did the upgrade.

"},{"location":"configuration/Dashboard/#the-main-menu-explained","title":"The main menu explained","text":"

It's important to know that we have so far seen our dashboard with the Admin user and that this user is a Zabbix Super Admin user. This means that the user has no restrictions. Zabbix works with 3 different levels of users we have the regular users, Zabbix Admin and Zabbix Super Admin users. Let's have a look

Info

More information can be found in the online Zabbix documentation here

"},{"location":"configuration/zabbix-agent/","title":"Zabbix Agent","text":""},{"location":"configuration/zabbix-agent/#zabbix-agent-linux","title":"Zabbix agent Linux","text":""},{"location":"configuration/zabbix-agent/#zabbix-agent-windows","title":"Zabbix agent windows","text":""},{"location":"configuration/zabbix-dataflow/","title":"Data Flow","text":""},{"location":"configuration/zabbix-dataflow/#data-collection","title":"Data Collection","text":""},{"location":"configuration/zabbix-dataflow/#simple-checks","title":"Simple Checks","text":""},{"location":"configuration/zabbix-hostgroups/","title":"Host groups","text":""},{"location":"configuration/zabbix-hosts/","title":"Zabbix hosts","text":"

To understand how Zabbix works it's important to know that Host in Zabbix are a reference to anything we would like to monitor it can be a physical host, a virtual machine, an application a device or even just a dummy host used to calculate data from existing other hosts into something new.

Its probably one of the first tasks that we will do as an Admin when we first login to Zabbix because we need a host if we would like to monitor some metrics. It's however important to know that hosts cannot be created without them being in a hostgroup.

With this said let's create our first host.

Let's go to the menu on our Left and select Data Collection -> Hosts. We see that there is already a hosts configured and that the availability icon is \"RED\" don't worry about it this is normal we have no Zabbix agent installed or configured.

To Add a new host to our system we press `Create host this button can be found in the upper right corner of our screen.

We now get a modal form where we need to fill in some information about our host. The fields marked with a red asterisk \"*\" are the fields that are mandatory.

ParameterDescription Host nameHere we need to enter the Host name of our machine we like to add. The name can contain alphanumerics, spaces, dots, dashes and underscores. HOWEVER you are not allowed to use leading and trailing spaces. The Host name in the frontend is what we need later for the configuration of our Zabbix agent so make sure you remember it. Visible nameThe host name as we have seen is neede to configure our Zabbix agent. So in case you like to give it a unique name that is random generated etc you can add a visible name here. This name will then be used in the frontend instead of what we call the technical name host name. This name has support for UTF-8 so special characters are supported.This name will be used in all the places like maps, latest data, inventory , ... TemplatesTemplates are like blueprints that we can use on our hosts to add items, triggers , .... We explain more about it in the topic Zabbix templates. You can start typing the name of the template and Zabbix will start to show a list with matches or you can press the ```Select``` box and choose one from the list. Host groupsEvery host needs to be in atleast 1 ```host group```. This is because permssions are set on host groups. You can type the name of the host group and a list of matching groups will start to appear. Another way is to select a host group from an existing list by pressing the Selectbutton. Or you can create a new group by just typing the name and pressing on the box that shows the name of the group you typed with (new) behind it InterfacesZabbix supports several host interfaces like Zabbix agent, SNMP, JMX and IPMI. By default when we create a host no interface is added. To add an interface press Add and fill in the needed info like IP or DNS depending on the host interface chosen. When an interface is in use (items created that use the interface) then the interface cannot be removed. DescriptionA place to enter a short description about our host. Monitored by proxyIf we have proxies configured we can select here if we like to monitor our host by a proxy. EnabledMark the checkbox to enable the host. This will make it monitored by Zabbix. When unchecked the host will not be monitored."},{"location":"configuration/zabbix-hosts/#host-menu-details","title":"Host menu details","text":"

Before we add a host ourselves there are a few things we need to know first. When we click on a host that we already configured before there are a few things that we notice. First of all we see a blue line under Host. This means that we are on the current tab of the host page. As you can see there are multiple tabs that we can click on like IPMI, Tags, Macros, ...

The next thing we see is that next to the tab Macros there is a number 2. This is because there are 2 macros configured in the macro tab. So when we add information in tabs like macros or tags ... Zabbix will show how many items we have added on these tabs by showing next to the tab name the number.

When looking at the encryption tab we notice the green dot. This shows us that an option on the tab has been activated. Now that we know this lets get a quick overview of every tab and see what it does.

"},{"location":"configuration/zabbix-hosts/#ipmi","title":"IPMI","text":"

So looking at the tab IPMI there are a few thing we need to fill in when working with an IPMI interface. IPMI stands for Intelligent Platform Management Interface and is basicaly a set of standards to manage hardware platforms. In short it allows us to monitor and manage ours servers hardware even if the server is not turned on yet. IPMI is better known as ILO on HP servers and DRAC on Dell servers.

ParameterDescription Autentication algorithmSelect the authentication algorithm that we have configured on our IPMI server this can be Default, none, MD2, MD5, Straight, OEM, RMCP+ Privelege levelHere we select the privelege level: Callback, User, Operator, Admin or OEM. UsernameThe user for authentication that was created on the host. User Macros can be used PasswordThe password for our user on the host. User macros can be used.

??? Note+ We will cover IPMI in more detail later in the Chapter IPMI Monitoring

"},{"location":"configuration/zabbix-hosts/#tags","title":"Tags","text":""},{"location":"configuration/zabbix-interfaces/","title":"Interfaces","text":""},{"location":"configuration/zabbix-items/","title":"Items","text":""},{"location":"configuration/zabbix-macros/","title":"Macros","text":""},{"location":"configuration/zabbix-templates/","title":"templates","text":""},{"location":"configuration/zabbix-users/","title":"Zabbix Users","text":"

Now that we know how the Zabbix dashboard is build up our first task will be to create a user. In case you missed it the standard Zabbix (yes the capital Z here is eeded to login.) user is Admin and has the password zabbix so we need to change this ASAP. The most confusing part is probably that the user Admin in zabbix is actually a 'super admin' but more about that later.

"},{"location":"configuration/zabbix-users/#changing-the-zabbix-super-admin-password","title":"Changing the Zabbix super admin password","text":"

In our menu on the right side of the screen click the 'Users' section and then choose '''users'''. As you see here in the screenshot.

You will now see a list of all the users that are created on the system when installing a new Zabbix instance. Here you will always see a list of all users that are configured on the system.

To change the password do the following steps - Click user '''Admin''' - Click on the button '''Change password''' - Fill in the current password '''zabbix''' - Fill in the new password twice and press '''Update''' at the bottom of the page.

"},{"location":"configuration/zabbix-users/#zabbix-user-types","title":"Zabbix User types","text":"

Before we create new users it's important to know that Zabbix has 3 user types that are built-in.

Besides these differences these users also have different accesses rights in our menu. Let's have a closer look.

This table gives an overview of all the permissions a Zabbix user, admin and super admin have:

Zabbix UserZabbix AdminZabbix Super Admin Dashboards\u2705\u2705\u2705 Monitoring\u2705\u2705\u2705 - Problems\u2705\u2705\u2705 - Hosts\u2705\u2705\u2705 - Latest data\u2705\u2705\u2705 - Maps\u2705\u2705\u2705 - Discovery\u274c\u2705\u2705 Services\u2705\u2705\u2705 - Services\u2705\u2705\u2705 - SLA\u274c\u2705\u2705 - SLA Report\u2705;\u2705\u2705 Inventory\u2705\u2705\u2705 - Overview\u2705\u2705\u2705 - Hosts\u2705\u2705\u2705 Reports\u2705\u2705\u2705 - System information\u274c\u274c\u2705 - Scheduled reports\u274c\u2705\u2705 - Availability report\u2705\u2705\u2705 - Triggers top 100\u2705\u2705\u2705 - Audit log\u274c\u274c\u2705 - Action log\u274c\u274c\u2705 - Notifications\u274c\u2705\u2705 Data Collection\u274c\u2705\u2705 - Template groups\u274c\u2705\u2705 - Host groups\u274c\u2705\u2705 - Templates\u274c\u2705\u2705 - Hosts\u274c\u2705\u2705 - Maintenance\u274c\u2705\u2705 - Event correlation\u274c\u274c\u2705 - Discovery\u274c\u2705\u2705 Alerts\u274c\u2705\u2705 - Trigger actions\u274c\u2705\u2705 - Service actions\u274c\u2705\u2705 - Autoregistration actions\u274c\u2705\u2705 - Internal actions\u274c\u2705\u2705 - Media types\u274c\u274c\u2705 - Scripts\u274c\u274c\u2705 Users\u274c\u274c\u2705 - User groups\u274c\u274c\u2705 - User roles\u274c\u274c\u2705 - Users\u274c\u274c\u2705 - Api tokens\u274c\u274c\u2705 - Authentication\u274c\u274c\u2705 Administration\u274c\u274c\u2705 - General\u274c\u274c\u2705 - Audit log\u274c\u274c\u2705 - Housekeeping\u274c\u274c\u2705 - Proxies\u274c\u274c\u2705 - Macros\u274c\u274c\u2705 - Queue\u274c\u274c\u2705 "},{"location":"configuration/zabbix-users/#user-roles","title":"User Roles","text":"

User roles have been in Zabbix since version 5.2 and make our live more easy by allowing us to make some custom adjustments to the standard defind user types in Zabbix.

Warning

Be aware the no permissions can be added to user roles only permissions can be revoked.

"},{"location":"configuration/zabbix-users/#creating-a-new-user-in-zabbix","title":"Creating a new User in Zabbix","text":"

So now that we are in the users section of Zabbix it's probably a good time to create a new user for our system. If you skipped previous step go to the menu '''Users''' -> '''Users'''.

Click on the top right on '''Create user''' and fill in the details of your new users. You will see that some fiels have red asterisks in front of them like Username and Password, ... this means that those feelds are mandatory to fill in.

Parameter Description Username A unique name that will be used as username when we login Name The users firstname this field is optional visible in acknowledgment information and notification recipient information if set. Last name Users last name. Optional, this field is optional visible in acknowledgment information and notification recipient information if set. Groups Select what group the user will belong to. Atleast 1 group needs to be selected. This feeld will auto complete or you can press the '''Select''' button at the end of the field. Passowrd There are 2 password fields they can only be used for internal authentication but more about this later. If the user has the Super admin role then clicking on the Change password button opens an additional field to entering the current (old) password. On a successful password change, the user for which the password was changed will be logged out of all active sessions. Language Language of the frontend. The php gettext extension is required for the translations to work. And the language needs to be configured on the system. See the chapter \"Installing Zabbix\" in case you forgot. Time zone Select the time zone per user or use the default timezone that is configured on the Zabbix server. Theme Here users can select their own look and feel by choosing one of the 4 themes provided by Zabbix or another custom made theme. Default will switch to the default theme chosen by the admin. Auto-login Check this box so that the user will be remembered for 30 days. The browser must accept cookies for this to work. Auto-logout Checking this box makes sure the user gets logged out automatically, after the set amount of seconds (minimum 90 seconds, maximum 1 day). Time suffixes are supported, e.g. 90s, 5m, 2h, 1d. Note that this option will not work if : * If the \"Show warning if Zabbix server is down\" global configuration option is enabled and Zabbix frontend is kept open. * When Monitoring menu pages perform background information refreshes. * If logging in with the Remember me for 30 days option checked. Refresh Set the refresh rate used for graphs, plain text data, etc. Can be set to 0 to disable. Time suffixes are supported. Ex: 90s, 5m, 1h. Rows per page Define how many rows per page will be displayed in lists. URL (after login) You can make Zabbix transfer the user to a specific URL after successful login. This can be useful for monitors in NOC team for example so you arrive on a specific dashboard that is maximised. The URL can be the full url or only the relative url like : zabbix.php?action=host.list"},{"location":"configuration/zabbix-users/#user-media","title":"User Media","text":"

The tab ''' Media ''' contains a list of all media that is defined for out user. Media is used for sending notifications to the user. We can click the ''' Add ''' button.

Adding the media here is not enough to receive notification we also need to configure our media properly and we still need to configure Actions as well. When pressing the ''' Add ''' button we get a popup where we can select some information.

ParameterDescription TypeA drop down list with the names of all media types. When a media type is disabled it will be in red. Send toHere we can provide contact information. For an email media type it is possible to add several addresses by clicking on '''Add''' below the address field. In this case, the notification will be sent to all email addresses provided. It's also possible to specify recipient name in the Send to field of the email recipient in a format 'Recipient name <address1@company.com>'. Note that if a recipient name is provided, an email address should be wrapped in angle brackets (<>). UTF-8 characters in the name are supported, quoted pairs and comments are not. For example: John Doe <manager@open-future.com> and manager@nycdatacenter.com are both valid formats. Incorrect examples: John Doe manager@open-future.com, %%\"Zabbix\\@\\<H(comment)Q\\>\" zabbix@company.com %%. when activeThe time when media will be active from monday till sundat, 1-7 and the time from 00:00 till 24:00 for example only in weekends from 6 in the morning till 5 in the evening: 6-7,06-17:00i. This is based on the user his timezone Use if severityA list of checkboxes from the severities you would like to recieve notifications from. Selected severities will be displayed in color. !! Read the warning below!! StatusStatus of the media we have selected either enabled or disabled ( in use or not ) Warning

When selecting the different severities be aware that you have to select '''Not classified''' if you want to receive notifications about non trigger events like internal events. For more info check out : Event sources. This is something that is not obvious and Zabbix documentation could be better in explaining this imho.

"},{"location":"extra-monitoring/SNMP-monitoring/","title":"Monitoring SNMP,IPMI and JAVA","text":""},{"location":"installation/Requirements/","title":"Requirements","text":"

Zabbix has a set of requirements that need to be met on the hardware level and software level. These requirements can change over time and also depends on the size of your setup and the software you choose. So before you start buying metal or installing a random database version have a look at the Zabbix documentation and check the latest requirements for the version you want to install. The latest requirements can be found here. Don't forget to select your correct Zabbix version from the list.

"},{"location":"installation/Requirements/#basic-os-configuration","title":"Basic OS configuration","text":""},{"location":"installation/Requirements/#firewall","title":"firewall","text":"

It's important for our Zabbix server to have an OS that is well prepared before we start to install our monitoring tool. First we need to make sure our firewall is installed.

# dnf install firewalld --now

Our firewall is installed now, and we are ready to configure the needed ports. For our Zabbix server, we need to allow access to port 10051/tcp this is the port where our Zabbix trapper listens on for incoming data. So we need to open this port in our firewall to allow access to our Zabbix trapper.

# firewall-cmd --add-service=Zabbix-server --permanent

or if the service is not known

# firewall-cmd --add-port=10051/tcp --permanent

firewalld

\"Firewalld is the replacement of iptables in Redhat and allows us to make changes available immediately without the need to restart a service. It's possible that your distribution is not using Firewalld in this case you have to look to the documentation of your OS.\"

"},{"location":"installation/Requirements/#timeserver","title":"timeserver","text":"

Another thing we need to configure is the setup of timeserver and sync our Zabbix server to the timeserver by making use of an ntp client. This needs to be done for the Zabbix server but also for the devices we will monitor as time is very important for Zabbix. Imagine one of our hosts having a time zone that is wrong we could end up looking for a problem in Zabbix that happened 6h ago while it had happened maybe only 2h ago.

# dnf install chronyd --now

Chrony should be installed now and enabled and running. This can be verified with the command:

# systemctl status chronyd

dnf

\"dnf is a packagemanager from RedHat you need to replace dnf with your correct packagemanager like zyper, apt, yum, ... chrony is a replacement for ntpd and does a better job being faster and more accurate. If your OS does not support chrony then maybe ntpd is still available.\"

Once Chrony is installed we also need to setup our correct time zone. We can have a look first with 'timedatectl' to see how our time is configured 

# timedatectl\n               Local time: Thu 2023-11-16 15:09:14 UTC\n           Universal time: Thu 2023-11-16 15:09:14 UTC\n                 RTC time: Thu 2023-11-16 15:09:15\n                Time zone: UTC (UTC, +0000)\nSystem clock synchronized: yes\n              NTP service: active\n          RTC in local TZ: no\n

Make sure that the service cronyd is active, see above on how to do if you missed it. We can choose the correct time zone from a list that we can lookup with the following command:

# timedatectl list-time zones\n

This will give us a list with all available time zones. Choose the one closest to you.

Africa/Abidjan\nAfrica/Accra\n\n...\n\nPacific/Tongatapu\nPacific/Wake\nPacific/Wallis\nUTC\n

We can now configure our correct time zone with the following command:

timedatectl set-time zone Europe/Brussels\n

When we look again we should see our time zone properly configured.

# timedatectl\n               Local time: Thu 2023-11-16 16:13:35 CET\n           Universal time: Thu 2023-11-16 15:13:35 UTC\n                 RTC time: Thu 2023-11-16 15:13:36\n                Time zone: Europe/Brussels (CET, +0100)\nSystem clock synchronized: yes\n              NTP service: active\n          RTC in local TZ: no\n
Note

\"Some people like to install all servers in the UTC time zone so that all server logs are in the same time zone when having servers all over the world. Zabbix supports user based time zone settings so it's possible to keep the time zone in UTC on the server and then add the correct time zone in the user interface if you like.\"

We can test if Chrony is syncronizing with the correct timeservers as well by running the command chronyc

# chronyc\nchrony version 4.2\nCopyright (C) 1997-2003, 2007, 2009-2021 Richard P. Curnow and others\nchrony comes with ABSOLUTELY NO WARRANTY.  This is free software, and\nyou are welcome to redistribute it under certain conditions.  See the\nGNU General Public License version 2 for details.\n\nchronyc>\n

Then we type sources

chronyc> sources\nMS Name/IP address         Stratum Poll Reach LastRx Last sample\n===============================================================================\n^- 51-15-20-83.rev.poneytel>     2   9   377   354   +429us[ +429us] +/-  342ms\n^- 5.255.99.180                  2  10   377   620  +7424us[+7424us] +/-   37ms\n^- hachi.paina.net               2  10   377   412   +445us[ +445us] +/-   39ms\n^* leontp1.office.panq.nl        1  10   377   904  +6806ns[ +171us] +/- 2336us\n

Here we can see that we are using a bunch of ntp servers that are not in our own country so we better swicht to some timeservers in our local country or if we have a timeserver in our company we could use this one. We can find some local timeservers here : https://www.ntppool.org/

To change this we have to edit our config file \"/etc/chrony.conf\" and replace the existing ntp server with our local one 

# Use public servers from the pool.ntp.org project.\n# Please consider joining the pool (http://www.pool.ntp.org/join.html).\npool 2.centos.pool.ntp.org iburst\n

And change it to a local server:

# Use public servers from the pool.ntp.org project.\n# Please consider joining the pool (http://www.pool.ntp.org/join.html).\npool be.pool.ntp.org iburst\n

Don't forget to restart the ntpd client of course.

# systemctl restart chronyd\n

When we look again we will see that we are now using our local timeservers.

chronyc> sources\n\nMS Name/IP address         Stratum Poll Reach LastRx Last sample\n===============================================================================\n^- ntp1.unix-solutions.be        2   6    17    43   -375us[ -676us] +/-   28ms\n^* ntp.devrandom.be              2   6    17    43   -579us[ -880us] +/- 2877us\n^+ time.cloudflare.com           3   6    17    43   +328us[  +27us] +/- 2620us\n^+ time.cloudflare.com           3   6    17    43   +218us[  -83us] +/- 2815us\n
"},{"location":"installation/installing-zabbix/","title":"Installing Zabbix","text":"

Before we can install Zabbix we first have to know how the design is. The Zabbix server has been build op modular based on 3 components.

All these components can be installed on 1 server or can be split over 3 different servers. The Zabbix server itself is the brain this part is doing all the trigger calculations and sending all the alert. The database is where the Zabbix server stores its config and all the data that we have gathered. The web server provides us with a front-end. Note that Zabbix has a API and that this is also located on the front-end and not on the Zabbix server side.

All these parts have to work together so as you can see in our image above. The Zabbix server needs to read the config and store the data in our database and the Zabbix front-end needs to be able to write the configuration in the database as well. The Zabbix front-end also needs to check the online status of our Zabbix server and needs to read some other information as well.

For our setup, we will use 2 VM's, 1 VM with a Zabbix server and our Zabbix web server and another VM with our Zabbix database.

"},{"location":"installation/installing-zabbix/#installing-the-zabbix-server","title":"Installing the Zabbix Server","text":"

Before you start to install your Zabbix server make sure the server is properly configure as we explained in our topic Basic OS configuration before we start. Something else that is important in this case is that we need to disable SELinux. We will see later in chapter Securing Zabbix how to do this properly. We can check the status of SELinux with the command sestatus :

# sestatus\nSELinux status:                 enabled\nSELinuxfs mount:                /sys/fs/selinux\nSELinux root directory:         /etc/selinux\nLoaded policy name:             targeted\nCurrent mode:                   enforcing\nMode from config file:          enforcing\nPolicy MLS status:              enabled\nPolicy deny_unknown status:     allowed\nMemory protection checking:     actual (secure)\nMax kernel policy version:      33\n

As you can see we are now in enforcing mode. To disable SELinux just run setenforce 0 to disable it. 

# setenforce 0\n# sestatus\n\nSELinux status:                 enabled\nSELinuxfs mount:                /sys/fs/selinux\nSELinux root directory:         /etc/selinux\nLoaded policy name:             targeted\nCurrent mode:                   permissive\nMode from config file:          enforcing\nPolicy MLS status:              enabled\nPolicy deny_unknown status:     allowed\nMemory protection checking:     actual (secure)\nMax kernel policy version:      33\n

As you can see our current mode is now permissive. However this is not persistent so we also need to alter our SELinux configuration file. This can be done by altering the file /etc/config/selinux and replacing enforcing by permissive. A more easy way is to run the following command :

sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config\n

This line will alter the config file for you. So when we run sestatus again we will see that we are in permissive mode and that our config file is also in permissive mode.

We can verify this with our cat commando.

# cat /etc/selinux/config\n\n# This file controls the state of SELinux on the system.\n# SELINUX= can take one of these three values:\n#     enforcing - SELinux security policy is enforced.\n#     permissive - SELinux prints warnings instead of enforcing.\n#     disabled - No SELinux policy is loaded.\n# See also:\n# https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/#getting-started-with-selinux-selinux-states-and-modes\n#\n# NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also\n# fully disable SELinux during boot. If you need a system with SELinux\n# fully disabled instead of SELinux running with no policy loaded, you\n# need to pass selinux=0 to the kernel command line. You can use grubby\n# to persistently set the bootloader to boot with selinux=0:\n#\n#    grubby --update-kernel ALL --args selinux=0\n#\n# To revert back to SELinux enabled:\n#\n#    grubby --update-kernel ALL --remove-args selinux\n#\nSELINUX=permissive\n# SELINUXTYPE= can take one of these three values:\n#     targeted - Targeted processes are protected,\n#     minimum - Modification of targeted policy. Only selected processes are protected.\n#     mls - Multi Level Security protection.\nSELINUXTYPE=targeted\n

And we can also verify it with our commando setstatus 

# sestatus\n\nSELinux status:                 enabled\nSELinuxfs mount:                /sys/fs/selinux\nSELinux root directory:         /etc/selinux\nLoaded policy name:             targeted\nCurrent mode:                   permissive\nMode from config file:          permissive\nPolicy MLS status:              enabled\nPolicy deny_unknown status:     allowed\nMemory protection checking:     actual (secure)\nMax kernel policy version:      33\n
"},{"location":"installation/installing-zabbix/#adding-the-zabbix-repository","title":"Adding the Zabbix repository","text":"

From the Zabbix Download page select the correct Zabbix version you would like to install. In our case it will be 7.0 LTS. Select the correct OS distribution as well. This will be Rocky Linux 9 in our case. We are going to install the Server and will be using NGINX.

Our first step is to disable Zabbix packages provided by EPEL, if you have it installed. Edit file /etc/yum.repos.d/epel.repo and add the following statement.

[epel]\n...\nexcludepkgs=zabbix*\n
Tip

Having the EPEL repository enabled is a bad practice and could be dangerous if you use EPEL it's best to disable the repo and use dnf install --enablerepo=epel. This way you will never overwrite or install unwanted packages by accident.

Our next task is to install the Zabbix repository on our OS and do a dnf cleanup so that old cache files from our repository metadata is cleaned up.

rpm -Uvh https://repo.zabbix.com/zabbix/6.5/rocky/9/x86_64/zabbix-release-6.5-2.el9.noarch.rpm\ndnf clean all\n
Note

A repository is a config in Linux that you can add to make packages available for you OS to install. The best way to look at it is maybe to think of it like an APP store that you add where you can find the software of your vendor. In this case the repository form Zabbix. There are many repositories you can add but you should be sure that they can be trusted. So it's always a good idea to stick to the repositories of your OS and only add extra repositories when you are sure they are to be trusted and needed. In our case the repository is from our vendor Zabbix so it should be safe to add. Epel is another popular repository for RedHat systems that is considered to be safe.

"},{"location":"installation/installing-zabbix/#installing-the-zabbix-server-for-mysqlmariadb","title":"Installing the Zabbix server for MySQL/MariaDB","text":"

Now that we have our repository with software added to our system we are ready to install our Zabbix server and webserver. Remember the webserver could be installed on another system. There is no need to install both on the same server.

dnf install zabbix-server-mysql zabbix-web-mysql

Now that we have installed our packages for the Zabbix server and our frontend we still need to change the configuration of our Zabbix server so that we can connect to our database. Open the file /etc/zabbix/zabbix_server.conf and replace the following lines:

DBHost=<ip or dns of your MariaDB server>\nDBName=<the name of your database>\nDBUser=<the user that will connect to the database>\nDBPassword=<your super secret password>\n

Make sure you don't have a '#' in front of the config parameter else Zabbix will see this as text and not as a parameter. Also make sure that there are not extra duplicate lines Zabbix will always take the last config parameter if there is more then 1 line with the same parameter

In our case the config will look like this:

# vi /etc/zabbix/zabbix_server.conf\n\nDBHost=<ip or dns of your MariaDB server>\nDBName=zabbix\nDBUser=zabbix-srv\nDBPassword=<your super secret password>\nDBPort=3306\n
Note

The Zabbix server configuration file has the option to include an extra config file with parameters you like to alter or add. In production it's probably better to not touch the configuration file but to add a new file and include the parameters you like to change. This way you never have to edit your original configuration file after an upgrade it will also make your life more easy when working with configuration tools like Ansible, Puppet, SaltStack, .... The only thing that needs to be done is remove the # in front of the line '# Include=/usr/local/etc/zabbix_server.conf.d/*.conf' and make sure the path exists with a customized config file of your won that is readable by the user zabbix.

Ok now that we have changed the configuration of you Zabbix server so that it is able to connect to our DB we are ready to start. Run the following command to enable the Zabbix server and make it active on boot next time.

systemctl enable zabbix-server --now

Our Zabbix server service will start and if everything goes well you should see in the Zabbix server log file the following output

tail /var/log/zabbix/zabbix_server.log

  1123:20231120:110604.440 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n  1123:20231120:110604.440 ****** Enabled features ******\n  1123:20231120:110604.440 SNMP monitoring:           YES\n  1123:20231120:110604.440 IPMI monitoring:           YES\n  1123:20231120:110604.440 Web monitoring:            YES\n  1123:20231120:110604.440 VMware monitoring:         YES\n  1123:20231120:110604.440 SMTP authentication:       YES\n  1123:20231120:110604.440 ODBC:                      YES\n  1123:20231120:110604.440 SSH support:               YES\n  1123:20231120:110604.440 IPv6 support:              YES\n  1123:20231120:110604.440 TLS support:               YES\n  1123:20231120:110604.440 ******************************\n  1123:20231120:110604.440 using configuration file: /etc/zabbix/zabbix_server.conf\n  1123:20231120:110604.470 current database version (mandatory/optional): 06050143/06050143\n  1123:20231120:110604.470 required mandatory version: 06050143\n  1124:20231120:110604.490 starting HA manager\n  1124:20231120:110604.507 HA manager started in active mode\n  1123:20231120:110604.508 server #0 started [main process]\n  1126:20231120:110604.509 server #2 started [configuration syncer #1]\n  1125:20231120:110604.510 server #1 started [service manager #1]\n  1133:20231120:110604.841 server #9 started [lld worker #1]\n  1132:20231120:110604.841 server #8 started [lld manager #1]\n  1134:20231120:110604.841 server #10 started [lld worker #2]\n

If there was an error and the server was not able to connect to the database you would see something like this in the server log file :

 10773:20231118:213248.570 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n 10773:20231118:213248.570 ****** Enabled features ******\n 10773:20231118:213248.570 SNMP monitoring:           YES\n 10773:20231118:213248.570 IPMI monitoring:           YES\n 10773:20231118:213248.570 Web monitoring:            YES\n 10773:20231118:213248.570 VMware monitoring:         YES\n 10773:20231118:213248.570 SMTP authentication:       YES\n 10773:20231118:213248.570 ODBC:                      YES\n 10773:20231118:213248.570 SSH support:               YES\n 10773:20231118:213248.570 IPv6 support:              YES\n 10773:20231118:213248.570 TLS support:               YES\n 10773:20231118:213248.570 ******************************\n 10773:20231118:213248.570 using configuration file: /etc/zabbix/zabbix_server.conf\n 10773:20231118:213248.574 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213248.574 database is down: reconnecting in 10 seconds\n 10773:20231118:213258.579 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213258.579 database is down: reconnecting in 10 seconds\n

Let's check the Zabbix server service to see if it's enabled so that it survives a reboot 

# systemctl status zabbix-server\n\n\u25cf zabbix-server.service - Zabbix Server\n     Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; preset: disabled)\n     Active: active (running) since Mon 2023-11-20 11:06:04 CET; 1h 2min ago\n   Main PID: 1123 (zabbix_server)\n      Tasks: 59 (limit: 12344)\n     Memory: 52.6M\n        CPU: 20.399s\n     CGroup: /system.slice/zabbix-server.service\n             \u251c\u25001123 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf\n             \u251c\u25001124 \"/usr/sbin/zabbix_server: ha manager\"\n             \u251c\u25001125 \"/usr/sbin/zabbix_server: service manager #1 [processed 0 events, updated 0 event tags, deleted 0 problems, synced 0 service updates, idle 5.008686 sec during 5.016382 sec]\"\n             \u251c\u25001126 \"/usr/sbin/zabbix_server: configuration syncer [synced configuration in 0.092797 sec, idle 10 sec]\"\n             \u251c\u25001127 \"/usr/sbin/zabbix_server: alert manager #1 [sent 0, failed 0 alerts, idle 5.027620 sec during 5.027828 sec]\"\n             \u251c\u25001128 \"/usr/sbin/zabbix_server: alerter #1 started\"\n             \u251c\u25001129 \"/usr/sbin/zabbix_server: alerter #2 started\"\n             \u251c\u25001130 \"/usr/sbin/zabbix_server: alerter #3 started\"\n             \u251c\u25001131 \"/usr/sbin/zabbix_server: preprocessing manager #1 [queued 1, processed 2 values, idle 5.490312 sec during 5.490555 sec]\"\n             \u251c\u25001132 \"/usr/sbin/zabbix_server: lld manager #1 [processed 1 LLD rules, idle 5.028973sec during 5.029123 sec]\"\n             \u251c\u25001133 \"/usr/sbin/zabbix_server: lld worker #1 [processed 1 LLD rules, idle 60.060180 sec during 60.085009 sec]\"\n             \u251c\u25001134 \"/usr/sbin/zabbix_server: lld worker #2 [processed 1 LLD rules, idle 60.065526 sec during 60.095165 sec]\"\n             \u251c\u25001135 \"/usr/sbin/zabbix_server: housekeeper [deleted 0 hist/trends, 0 items/triggers, 0 events, 0 sessions, 0 alarms, 0 audit items, 0 autoreg_host, 0 records in 0.019108 sec, idle for 1 hour(s)]\"\n             \u251c\u25001136 \"/usr/sbin/zabbix_server: timer #1 [updated 0 hosts, suppressed 0 events in 0.002856 sec, idle 59 sec]\"\n             \u251c\u25001137 \"/usr/sbin/zabbix_server: http poller #1 [got 0 values in 0.000059 sec, idle 5 sec]\"\n             \u251c\u25001138 \"/usr/sbin/zabbix_server: discovery manager #1 [processing 0 rules, 0.000000% of queue used, 0 unsaved checks]\"\n             \u251c\u25001139 \"/usr/sbin/zabbix_server: history syncer #1 [processed 0 values, 0 triggers in 0.000036 sec, idle 1 sec]\"\n             \u251c\u25001140 \"/usr/sbin/zabbix_server: history syncer #2 [processed 1 values, 0 triggers in 0.005016 sec, idle 1 sec]\"\n             \u251c\u25001141 \"/usr/sbin/zabbix_server: history syncer #3 [processed 0 values, 0 triggers in 0.000031 sec, idle 1 sec]\"\n             \u251c\u25001142 \"/usr/sbin/zabbix_server: history syncer #4 [processed 0 values, 0 triggers in 0.000014 sec, idle 1 sec]\"\n             \u251c\u25001143 \"/usr/sbin/zabbix_server: escalator #1 [processed 0 escalations in 0.005587 sec, idle 3 sec]\"\n             \u251c\u25001144 \"/usr/sbin/zabbix_server: proxy poller #1 [exchanged data with 0 proxies in 0.000010 sec, idle 5 sec]\"\n             \u251c\u25001145 \"/usr/sbin/zabbix_server: self-monitoring [processed data in 0.000016 sec, idle 1 sec]\"\n             \u251c\u25001146 \"/usr/sbin/zabbix_server: task manager [processed 0 task(s) in 0.002511 sec, idle 5 sec]\"\n             \u251c\u25001147 \"/usr/sbin/zabbix_server: poller #1 [got 0 values in 0.000009 sec, idle 1 sec]\"\n             \u251c\u25001148 \"/usr/sbin/zabbix_server: poller #2 [got 1 values in 0.000232 sec, idle 1 sec]\"\n             \u251c\u25001149 \"/usr/sbin/zabbix_server: poller #3 [got 0 values in 0.000015 sec, idle 1 sec]\"\n             \u251c\u25001150 \"/usr/sbin/zabbix_server: poller #4 [got 0 values in 0.000010 sec, idle 1 sec]\"\n

This concludes our chapter on installing and configuring our Zabbix server. Next we have to configure our frontend. You can have a look at Installing Zabbix frontend with Nginx or Installing Zabbix frontend with Apache

"},{"location":"installation/installing-zabbix/#installing-the-zabbix-server-for-postgresql","title":"Installing the Zabbix server for PostgreSQL","text":"

Now that we have our repository with software added to our system we are ready to install our Zabbix server and webserver. Remember the webserver could be installed on another system. There is no need to install both on the same server.

dnf install zabbix-server-pgsql zabbix-web-pgsql

Now that we have installed our packages for the Zabbix server and our frontend we still need to change the configuration of our Zabbix server so that we can connect to our database. Open the file /etc/zabbix/zabbix_server.conf and replace the following lines:

DBHost=<ip or dns of your PostgreSQL server>\nDBName=<the name of your database>\nDBSchema=<our PostgreSQL schema name>\nDBUser=<the user that will connect to the database>\nDBPassword=<your super secret password>\n

Make sure you don't have a '#' in front of the config parameter else Zabbix will see this as text and not as a parameter. Also make sure that there are not extra duplicate lines Zabbix will always take the last config parameter if there is more then 1 line with the same parameter

In our case the config will look like this:

# vi /etc/zabbix/zabbix_server.conf\n\nDBHost=<ip or dns of your MariaDB server>\nDBName=zabbix\nDBSchema=zabbix_server\nDBUser=zabbix-srv\nDBPassword=<your super secret password>\nDBPort=5432\n
Note

The Zabbix server configuration file has the option to include an extra config file with parameters you like to alter or add. In production it's probably better to not touch the configuration file but to add a new file and include the parameters you like to change. This way you never have to edit your original configuration file after an upgrade it will also make your life more easy when working with configuration tools like Ansible, Puppet, SaltStack, .... The only thing that needs to be done is remove the # in front of the line '# Include=/usr/local/etc/zabbix_server.conf.d/*.conf' and make sure the path exists with a customized config file of your won that is readable by the user zabbix.

Ok now that we have changed the configuration of you Zabbix server so that it is able to connect to our DB we are ready to start. Run the following command to enable the Zabbix server and make it active on boot next time.

systemctl enable zabbix-server --now

Our Zabbix server service will start and if everything goes well you should see in the Zabbix server log file the following output

tail /var/log/zabbix/zabbix_server.log

  1123:20231120:110604.440 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n  1123:20231120:110604.440 ****** Enabled features ******\n  1123:20231120:110604.440 SNMP monitoring:           YES\n  1123:20231120:110604.440 IPMI monitoring:           YES\n  1123:20231120:110604.440 Web monitoring:            YES\n  1123:20231120:110604.440 VMware monitoring:         YES\n  1123:20231120:110604.440 SMTP authentication:       YES\n  1123:20231120:110604.440 ODBC:                      YES\n  1123:20231120:110604.440 SSH support:               YES\n  1123:20231120:110604.440 IPv6 support:              YES\n  1123:20231120:110604.440 TLS support:               YES\n  1123:20231120:110604.440 ******************************\n  1123:20231120:110604.440 using configuration file: /etc/zabbix/zabbix_server.conf\n  1123:20231120:110604.470 current database version (mandatory/optional): 06050143/06050143\n  1123:20231120:110604.470 required mandatory version: 06050143\n  1124:20231120:110604.490 starting HA manager\n  1124:20231120:110604.507 HA manager started in active mode\n  1123:20231120:110604.508 server #0 started [main process]\n  1126:20231120:110604.509 server #2 started [configuration syncer #1]\n  1125:20231120:110604.510 server #1 started [service manager #1]\n  1133:20231120:110604.841 server #9 started [lld worker #1]\n  1132:20231120:110604.841 server #8 started [lld manager #1]\n  1134:20231120:110604.841 server #10 started [lld worker #2]\n

If there was an error and the server was not able to connect to the database you would see something like this in the server log file :

 10773:20231118:213248.570 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n 10773:20231118:213248.570 ****** Enabled features ******\n 10773:20231118:213248.570 SNMP monitoring:           YES\n 10773:20231118:213248.570 IPMI monitoring:           YES\n 10773:20231118:213248.570 Web monitoring:            YES\n 10773:20231118:213248.570 VMware monitoring:         YES\n 10773:20231118:213248.570 SMTP authentication:       YES\n 10773:20231118:213248.570 ODBC:                      YES\n 10773:20231118:213248.570 SSH support:               YES\n 10773:20231118:213248.570 IPv6 support:              YES\n 10773:20231118:213248.570 TLS support:               YES\n 10773:20231118:213248.570 ******************************\n 10773:20231118:213248.570 using configuration file: /etc/zabbix/zabbix_server.conf\n 10773:20231118:213248.574 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213248.574 database is down: reconnecting in 10 seconds\n 10773:20231118:213258.579 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213258.579 database is down: reconnecting in 10 seconds\n

Let's check the Zabbix server service to see if it's enabled so that it survives a reboot

# systemctl status zabbix-server\n
\u25cf zabbix-server.service - Zabbix Server\n     Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; preset: disabled)\n     Active: active (running) since Mon 2023-11-20 11:06:04 CET; 1h 2min ago\n   Main PID: 1123 (zabbix_server)\n      Tasks: 59 (limit: 12344)\n     Memory: 52.6M\n        CPU: 20.399s\n     CGroup: /system.slice/zabbix-server.service\n             \u251c\u25001123 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf\n             \u251c\u25001124 \"/usr/sbin/zabbix_server: ha manager\"\n             \u251c\u25001125 \"/usr/sbin/zabbix_server: service manager #1 [processed 0 events, updated 0 event tags, deleted 0 problems, synced 0 service updates, idle 5.008686 sec during 5.016382 sec]\"\n             \u251c\u25001126 \"/usr/sbin/zabbix_server: configuration syncer [synced configuration in 0.092797 sec, idle 10 sec]\"\n             \u251c\u25001127 \"/usr/sbin/zabbix_server: alert manager #1 [sent 0, failed 0 alerts, idle 5.027620 sec during 5.027828 sec]\"\n             \u251c\u25001128 \"/usr/sbin/zabbix_server: alerter #1 started\"\n             \u251c\u25001129 \"/usr/sbin/zabbix_server: alerter #2 started\"\n             \u251c\u25001130 \"/usr/sbin/zabbix_server: alerter #3 started\"\n             \u251c\u25001131 \"/usr/sbin/zabbix_server: preprocessing manager #1 [queued 1, processed 2 values, idle 5.490312 sec during 5.490555 sec]\"\n             \u251c\u25001132 \"/usr/sbin/zabbix_server: lld manager #1 [processed 1 LLD rules, idle 5.028973sec during 5.029123 sec]\"\n             \u251c\u25001133 \"/usr/sbin/zabbix_server: lld worker #1 [processed 1 LLD rules, idle 60.060180 sec during 60.085009 sec]\"\n             \u251c\u25001134 \"/usr/sbin/zabbix_server: lld worker #2 [processed 1 LLD rules, idle 60.065526 sec during 60.095165 sec]\"\n             \u251c\u25001135 \"/usr/sbin/zabbix_server: housekeeper [deleted 0 hist/trends, 0 items/triggers, 0 events, 0 sessions, 0 alarms, 0 audit items, 0 autoreg_host, 0 records in 0.019108 sec, idle for 1 hour(s)]\"\n             \u251c\u25001136 \"/usr/sbin/zabbix_server: timer #1 [updated 0 hosts, suppressed 0 events in 0.002856 sec, idle 59 sec]\"\n             \u251c\u25001137 \"/usr/sbin/zabbix_server: http poller #1 [got 0 values in 0.000059 sec, idle 5 sec]\"\n             \u251c\u25001138 \"/usr/sbin/zabbix_server: discovery manager #1 [processing 0 rules, 0.000000% of queue used, 0 unsaved checks]\"\n             \u251c\u25001139 \"/usr/sbin/zabbix_server: history syncer #1 [processed 0 values, 0 triggers in 0.000036 sec, idle 1 sec]\"\n             \u251c\u25001140 \"/usr/sbin/zabbix_server: history syncer #2 [processed 1 values, 0 triggers in 0.005016 sec, idle 1 sec]\"\n             \u251c\u25001141 \"/usr/sbin/zabbix_server: history syncer #3 [processed 0 values, 0 triggers in 0.000031 sec, idle 1 sec]\"\n             \u251c\u25001142 \"/usr/sbin/zabbix_server: history syncer #4 [processed 0 values, 0 triggers in 0.000014 sec, idle 1 sec]\"\n             \u251c\u25001143 \"/usr/sbin/zabbix_server: escalator #1 [processed 0 escalations in 0.005587 sec, idle 3 sec]\"\n             \u251c\u25001144 \"/usr/sbin/zabbix_server: proxy poller #1 [exchanged data with 0 proxies in 0.000010 sec, idle 5 sec]\"\n             \u251c\u25001145 \"/usr/sbin/zabbix_server: self-monitoring [processed data in 0.000016 sec, idle 1 sec]\"\n             \u251c\u25001146 \"/usr/sbin/zabbix_server: task manager [processed 0 task(s) in 0.002511 sec, idle 5 sec]\"\n             \u251c\u25001147 \"/usr/sbin/zabbix_server: poller #1 [got 0 values in 0.000009 sec, idle 1 sec]\"\n             \u251c\u25001148 \"/usr/sbin/zabbix_server: poller #2 [got 1 values in 0.000232 sec, idle 1 sec]\"\n             \u251c\u25001149 \"/usr/sbin/zabbix_server: poller #3 [got 0 values in 0.000015 sec, idle 1 sec]\"\n             \u251c\u25001150 \"/usr/sbin/zabbix_server: poller #4 [got 0 values in 0.000010 sec, idle 1 sec]\"\n

This concludes our chapter on installing and configuring our Zabbix server. Next we have to configure our frontend. You can have a look at Installing Zabbix frontend with Nginx or Installing Zabbix frontend with Apache

"},{"location":"installation/installing-zabbix/#installing-zabbix-frontend-with-nginx","title":"Installing Zabbix frontend with Nginx","text":"

Before we can configure our frontend we need to install our package first. If you run the frontend on the same server as the Zabbix server then there is nothing else you have to do you can just run the following command on your server to install the packages needed for our frontend to install:

dnf install zabbix-nginx-conf and zabbix-web-mysql or if you used Postgres dnf install zabbix-web-pgsql\n

In case the frontend is on another server installed you need to add the Zabbix repository first like we did on our Zabbix server. In case you forgot or just skipped to this topic and don't know how to do this have a look at Adding the Zabbix repository

First thing we have to do is alter the Nginx configuration file so that we don't use the standard config.

vi /etc/nginx/nginx.conf\n

In this config look for the followin block that starts with :

    server {\n        listen       80;\n        listen       [::]:80;\n        server_name  _;\n        root         /usr/share/nginx/html;\n\n        # Load configuration files for the default server block.\n        include /etc/nginx/default.d/*.conf;\n

And place the following lines in comment:

    server {\n#        listen       80;\n#        listen       [::]:80;\n#        server_name  _;\n#        root         /usr/share/nginx/html;\n

We now have to alter the Zabbix configuration file so that it matches our setup. Edit the following file:

vi /etc/nginx/conf.d/zabbix.conf\n
server {\n        listen          8080;\n        server_name     example.com;\n\n        root    /usr/share/zabbix;\n\n        index   index.php;\n

Replace the first 2 lines with the correct port and domain for your frontend in case you don't have a domain you can replace server_name with _; like in the exaple below:

server {\n#        listen          8080;\n#        server_name     example.com;\n        listen          80;\n        server_name     _;\n\n        root    /usr/share/zabbix;\n\n        index   index.php;\n

We are now ready to start our websever and enable it so that it comes online after a reboot.

systemctl enable php-fpm --now\nsystemctl enable nginx --now\n

Let's verify if the service is properly started and enabled so that it survives our reboot next time.

# systemctl status nginx\n\n\u25cf nginx.service - The nginx HTTP and reverse proxy server\n     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: disabled)\n    Drop-In: /usr/lib/systemd/system/nginx.service.d\n             \u2514\u2500php-fpm.conf\n     Active: active (running) since Mon 2023-11-20 11:42:18 CET; 30min ago\n   Main PID: 1206 (nginx)\n      Tasks: 2 (limit: 12344)\n     Memory: 4.8M\n        CPU: 38ms\n     CGroup: /system.slice/nginx.service\n             \u251c\u25001206 \"nginx: master process /usr/sbin/nginx\"\n             \u2514\u25001207 \"nginx: worker process\"\n\nNov 20 11:42:18 zabbix-srv systemd[1]: Starting The nginx HTTP and reverse proxy server...\nNov 20 11:42:18 zabbix-srv nginx[1204]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok\nNov 20 11:42:18 zabbix-srv nginx[1204]: nginx: configuration file /etc/nginx/nginx.conf test is successful\nNov 20 11:42:18 zabbix-srv systemd[1]: Started The nginx HTTP and reverse proxy server.\n

The service is running and enabled so there is only 1 thing left to do before we can start the configuration in the GUI and that is to configure our firewall to allow incoming communication to the webserver.

firewall-cmd --add-service=http --permanent\nfirewall-cmd --reload\n

Open your browser and go to the url or ip of your frontend :

http://<ip or dns of the zabbix frontend server>/\n

If all goes well you should be greeted with a Zabbix welcome page. In case you have an error check the configuration again or have a look at the nginx log file :

/var/log/nginx/error.log

or run

journalctl -xe

This should help you in locating the errors you made.

When you point your browser to the correct URL you should be greeted with a page like here :

As you see there is only a limited list of local translations available on our Zabbix frontend to choose from

What if we want to install Chinese as language or another language from the list ? Run the next command to get a list of all locales available for your OS.

dnf list glibc-langpack-*

This will give you a list like 

Installed Packages\nglibc-langpack-en.x86_64\nAvailable Packages\nglibc-langpack-aa.x86_64\n...\n\nglibc-langpack-zu.x86_64\n

Let's search for our Chinese locale to see if it is available. As you can see the code starts with zh

# dnf list glibc-langpack-* | grep zh\nglibc-langpack-zh.x86_64\nglibc-langpack-lzh.x86_64\n

The command returns us 2 lines but as we have seen that the code was zh_CN we only have to install the first package.

# dnf install glibc-langpack-zh.x86_64 -y\n

When we return now to our frontend we are able to select the Chinese language.

Note

If your language is not available in the frontend don't panic it just means that there is no translation or that the translation was not 100% complete. Zabbis is free and relies on the community for it's translations so you can help in creating the translation. Go to the page https://translate.zabbix.com/ and help us to make Zabbix get better. Once the translation is complete the next Zabbix minor patch version should have your language included.

Click next when you are satisfied with the transaltions available. You will arrive at a screen to verifiy if all pre-requisites are met. If not fix them first but normaly it should be fine and you should be just able to click Next

The next page will show you a page with the connection parameters for our database.

First you select your DB type 'MySQL' or 'PostgreSQL' and fill in the IP or DNS name of the location of your database server. Use port 3306 for MariaDB/MySQL or 5432 if you used PostgreSQL.

Fill in the correct database name, in our case it was zabbix. If you used PostgreSQL then you also need to fill in the correct schema name in our case it was zabbix_server

Next line will ask you for the DB users here we created a user zabbix-web. Enter it in the correct field and fill in the password that you used for this user.

Make sure the option Database TLS encryption is not selected and press Next step.

We are almost there. The only thing that rests us to do is give our instance a name, select our timezone and select a default time we like to use.

Press Next step again you will see a page that tells you that the configuration is successful. Press Finish to end the configuration.

We are now ready to login :

Login : Admin Password : zabbix

"},{"location":"installation/installing-zabbix/#installing-zabbix-frontend-with-apache","title":"Installing Zabbix frontend with Apache","text":"

ToDo

"},{"location":"installation/installing-zabbix/#setting-up-zabbix-ha","title":"Setting up Zabbix HA","text":"

ToDo

"},{"location":"installation/installing-zabbixdb/","title":"Installing Zabbix DB Server","text":""},{"location":"installation/installing-zabbixdb/#installing-zabbix-with-mariadb","title":"Installing Zabbix with MariaDB","text":"

Let us start with the installation of the MariaDB server, you need to create a MariaDB repository configuration file mariadb.repo manually in the following path /etc/yum.repos.d/. To create a MariaDB repository file, you can use the following command.

"},{"location":"installation/installing-zabbixdb/#add-the-mariadb-repo","title":"Add the MariaDB repo","text":"
# vi /etc/yum.repos.d/mariadb.repo\n

The above command will create a new repository file, Once it is created, you need to add the following configuration into the file. Make sure your version, in this case 10.11, is supported by Zabbix by looking at the latest requirements for your version. 

# MariaDB 10.11 RedHatEnterpriseLinux repository list - created 2023-11-01 14:20 UTC\n# https://mariadb.org/download/\n[mariadb]\nname = MariaDB\n# rpm.mariadb.org is a dynamic mirror if your preferred mirror goes offline. See https://mariadb.org/mirrorbits/ for details.\n# baseurl = https://rpm.mariadb.org/10.11/rhel/$releasever/$basearch\nbaseurl = https://mirror.23m.com/mariadb/yum/10.11/rhel/$releasever/$basearch\n# gpgkey = https://rpm.mariadb.org/RPM-GPG-KEY-MariaDB\ngpgkey = https://mirror.23m.com/mariadb/yum/RPM-GPG-KEY-MariaDB\ngpgcheck = 1\n\n\n

Lets update our OS first with the latest patches

# dnf update -y\n
"},{"location":"installation/installing-zabbixdb/#install-the-mariadb-database","title":"Install the MariaDB database","text":"

Now we are ready to install our MariaDB database.

# dnf install MariaDB-server MariaDB-client\n

We are now ready to enable and start or MariaDB database.

# systemctl enable mariadb --now\n

Once the installation is complete, you can verify the version of the MariaDB server by using the following command:

# mysql -V\n

The output should look like this:

mysql  Ver 15.1 Distrib 10.11.6-MariaDB, for Linux (x86_64) using  EditLine wrapper\n

And when we ask the status of our MariaDB server we should get an output like this:

# systemctl status mariadb\n\n\u25cf mariadb.service - MariaDB 10.11.6 database server\n     Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: disabled)\n    Drop-In: /etc/systemd/system/mariadb.service.d\n             \u2514\u2500migrated-from-my.cnf-settings.conf\n     Active: active (running) since Sat 2023-11-18 19:19:36 CET; 2min 13s ago\n       Docs: man:mariadbd(8)\n             https://mariadb.com/kb/en/library/systemd/\n    Process: 41986 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)\n    Process: 41987 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= ||   VAR=`cd /usr/bin/..; /usr/bin/galera_recovery`; [ $? -eq 0 ]   && systemctl set-environment _WSREP_START>\n    Process: 42006 ExecStartPost=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)\n   Main PID: 41995 (mariadbd)\n     Status: \"Taking your SQL requests now...\"\n      Tasks: 9 (limit: 12344)\n     Memory: 206.8M\n        CPU: 187ms\n\n\n
"},{"location":"installation/installing-zabbixdb/#securing-the-mariadb-database","title":"Securing the MariaDB database","text":"

It's time to secure our database by removing the test database and user and set our own root password. Run the command mariadb-secure-installation, you should get the following output.

\n\n# mariadb-secure-installation\n\nNOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB\n      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!\n\nIn order to log into MariaDB to secure it, we'll need the current\npassword for the root user. If you've just installed MariaDB, and\nhaven't set the root password yet, you should just press enter here.\n\nEnter current password for root (enter for none):\nOK, successfully used password, moving on...\n\nSetting the root password or using the unix_socket ensures that nobody\ncan log into the MariaDB root user without the proper authorisation.\n\nYou already have your root account protected, so you can safely answer 'n'.\n\nSwitch to unix_socket authentication [Y/n] n\n ... skipping.\n\nYou already have your root account protected, so you can safely answer 'n'.\n\nChange the root password? [Y/n] y\nNew password:\nRe-enter new password:\nPassword updated successfully!\nReloading privilege tables..\n ... Success!\n\n\nBy default, a MariaDB installation has an anonymous user, allowing anyone\nto log into MariaDB without having to have a user account created for\nthem.  This is intended only for testing, and to make the installation\ngo a bit smoother.  You should remove them before moving into a\nproduction environment.\n\nRemove anonymous users? [Y/n] y\n ... Success!\n\nNormally, root should only be allowed to connect from 'localhost'.  This\nensures that someone cannot guess at the root password from the network.\n\nDisallow root login remotely? [Y/n] y\n ... Success!\n\nBy default, MariaDB comes with a database named 'test' that anyone can\naccess.  This is also intended only for testing, and should be removed\nbefore moving into a production environment.\n\nRemove test database and access to it? [Y/n] y\n - Dropping test database...\n ... Success!\n - Removing privileges on test database...\n ... Success!\n\nReloading the privilege tables will ensure that all changes made so far\nwill take effect immediately.\n\nReload privilege tables now? [Y/n] y\n ... Success!\n\nCleaning up...\n\nAll done!  If you've completed all of the above steps, your MariaDB\ninstallation should now be secure.\n\nThanks for using MariaDB!\n
"},{"location":"installation/installing-zabbixdb/#create-the-zabbix-database","title":"Create the Zabbix database","text":"
# mysql -uroot -p\npassword\n\nMariaDB [(none)]> CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;\nMariaDB [(none)]> CREATE USER 'zabbix-web'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nMariaDB [(none)]> CREATE USER 'zabbix-srv'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nMariaDB [(none)]> GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix-srv'@'<zabbix server ip>';\nMariaDB [(none)]> GRANT SELECT, UPDATE, DELETE, INSERT ON zabbix.* TO 'zabbix-web'@'<zabbix server ip>';\nMariaDB [(none)]> SET GLOBAL log_bin_trust_function_creators = 1;\nMariaDB [(none)]> QUIT\n\n
Warning

\"The Zabbix documentation explicitly mentions that deterministic triggers need to be created during the import of schema. On MySQL and MariaDB, this requires GLOBAL log_bin_trust_function_creators = 1 to be set if binary logging is enabled and there is no superuser privileges and log_bin_trust_function_creators = 1 is not set in MySQL configuration file.\"

"},{"location":"installation/installing-zabbixdb/#add-the-zabbix-repository-and-populate-the-db","title":"Add the Zabbix repository and populate the DB","text":"
# rpm -Uvh https://repo.zabbix.com/zabbix/6.5/rocky/9/x86_64/zabbix-release-6.5-2.el9.noarch.rpm\n# dnf clean all\n# dnf install zabbix-sql-scripts\n

Upload the data from zabbix (db structure, images, user, ... )

# zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uroot -p zabbix\n
Warning

\"Depending on the speed of your hardware or VM this can take a few seconds upto a few minutes so please don't cancel just sit and wait for the prompt.\"

Log back into your MariaDB Database as root

# mysql -uroot -p\n

Remove the global parameter again as its not needed anymore and also for security reasons.

MariaDB [(none)]> SET GLOBAL log_bin_trust_function_creators = 0;\nQuery OK, 0 rows affected (0.001 sec)\n
"},{"location":"installation/installing-zabbixdb/#configure-the-firewall","title":"Configure the firewall","text":"

One last thing we need to do is open the firewall and allow incoming connections for the MariaDB database from our Zabbix server because at the moment we dont accept any connections yet.

# firewall-cmd --list-all\npublic (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces: enp0s3 enp0s8\n  sources:\n  services: cockpit dhcpv6-client  ssh\n  ports:\n  protocols:\n  forward: yes\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

First we will create an appropriate zone for our MariaDB and open port 3306/tcp but only for the ip from our Zabbix server.

# firewall-cmd --new-zone=mariadb-access --permanent\nsuccess\n\n# firewall-cmd --reload\nsuccess\n\n# firewall-cmd --get-zones\nblock dmz drop external home internal mariadb-access nm-shared public trusted work\n\n# firewall-cmd --zone=mariadb-access --add-source=<zabbix-serverip> --permanent\n\nsuccess\n# firewall-cmd --zone=mariadb-access --add-port=3306/tcp  --permanent\n\nsuccess\n# firewall-cmd --reload\n

Now lets have a look to our firewall rules to see if they are what we expected:

# firewall-cmd --zone=mariadb-access --list-all\n
mariadb-access (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces:\n  sources: <ip from zabbix-server>\n  services:\n  ports: 3306/tcp\n  protocols:\n  forward: no\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

Our database server is ready now to accept connections from our Zabbix server :). You can continue with the next task Installing the Zabbix Server

"},{"location":"installation/installing-zabbixdb/#installing-zabbix-with-mysql","title":"Installing Zabbix with MySQL","text":"

Let us start with the installation of the MySQL server, you need to create a MySQL repository first so that we can install the proper files for our MySQL server It's alwqys best to check the Zabbix documentation to see what version is supported so you don't install a version that is not supported or is not supported anymore.

"},{"location":"installation/installing-zabbixdb/#add-the-mysql-repo","title":"Add the MySQL repo","text":"

Run the following command to install the MySQL repo for version 8.0

# dnf -y install https://dev.mysql.com/get/mysql80-community-release-el9-1.noarch.rpm

Note

\"If you install this on RedHat 8 and higher or alternatives like CentOS, Rocky or Alma 8 then you need to disable the mysql module by running 'module disable mysql'.\"

Let's update our OS first with the latest patches

# dnf update -y

"},{"location":"installation/installing-zabbixdb/#installing-the-mysql-database","title":"Installing the MySQL database","text":"

# dnf -y install mysql-community-server

We are now ready to enable and start or MySQL database.

# systemctl enable mysqld --now

Once the installation is complete, you can verify the version of the MySQL server by using the following command:

# mysql -V

The output should look like this:

mysql Ver 8.0.35 for Linux on x86_64 (MySQL Community Server - GPL)

And when we ask the status of our MariaDB server we should get an output like this:

# systemctl status mysqld\n\n\u25cf mysqld.service - MySQL Server\n     Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; preset: disabled)\n     Active: active (running) since Mon 2023-11-20 22:15:51 CET; 1min 15s ago\n       Docs: man:mysqld(8)\n             http://dev.mysql.com/doc/refman/en/using-systemd.html\n    Process: 44947 ExecStartPre=/usr/bin/mysqld_pre_systemd (code=exited, status=0/SUCCESS)\n   Main PID: 45012 (mysqld)\n     Status: \"Server is operational\"\n      Tasks: 37 (limit: 12344)\n     Memory: 448.3M\n        CPU: 4.073s\n     CGroup: /system.slice/mysqld.service\n             \u2514\u250045012 /usr/sbin/mysqld\n\nNov 20 22:15:43 mysql-db systemd[1]: Starting MySQL Server...\nNov 20 22:15:51 mysql-db systemd[1]: Started MySQL Server.\n
"},{"location":"installation/installing-zabbixdb/#securing-the-mysql-database","title":"Securing the MySQL database","text":"

MySQL will secure our database with a random root password that is generated when we install the database. First thing we need to do is replace it with our own password. To find what the password is we need to read the log file with the followin command:

# grep 'temporary password' /var/log/mysqld.log

Change the root password as soon as possible by logging in with the generated, temporary password and set a custom password for the superuser account:

# mysql -uroot -p\n
mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY '<my mysql password>';\nmysql> quit\n

Next we can run the command mysql_secure_installation, you should get the following output:

Note

\"There is no need to reset the root password for MySQL again as we have reset it already. The next step is optional but recommended.\"

# mysql_secure_installation\n\nSecuring the MySQL server deployment.\n\nEnter password for user root:\nThe 'validate_password' component is installed on the server.\nThe subsequent steps will run with the existing configuration\nof the component.\nUsing existing password for root.\n\nEstimated strength of the password: 100\nChange the password for root ? ((Press y|Y for Yes, any other key for No) : n\n\n ... skipping.\nBy default, a MySQL installation has an anonymous user,\nallowing anyone to log into MySQL without having to have\na user account created for them. This is intended only for\ntesting, and to make the installation go a bit smoother.\nYou should remove them before moving into a production\nenvironment.\n\nRemove anonymous users? (Press y|Y for Yes, any other key for No) : y\nSuccess.\n\n\nNormally, root should only be allowed to connect from\n'localhost'. This ensures that someone cannot guess at\nthe root password from the network.\n\nDisallow root login remotely? (Press y|Y for Yes, any other key for No) : y\nSuccess.\n\nBy default, MySQL comes with a database named 'test' that\nanyone can access. This is also intended only for testing,\nand should be removed before moving into a production\nenvironment.\n\n\nRemove test database and access to it? (Press y|Y for Yes, any other key for No) : y\n - Dropping test database...\nSuccess.\n\n - Removing privileges on test database...\nSuccess.\n\nReloading the privilege tables will ensure that all changes\nmade so far will take effect immediately.\n\nReload privilege tables now? (Press y|Y for Yes, any other key for No) : y\nSuccess.\n\nAll done!\n

Let's create our DB users and the correct permissions in the database:

mysql -uroot -p

mysql> CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;\nmysql> CREATE USER 'zabbix-web'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nmysql> CREATE USER 'zabbix-srv'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nmysql> GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix-srv'@'<zabbix server ip>';\nmysql> GRANT SELECT, UPDATE, DELETE, INSERT ON zabbix.* TO 'zabbix-web'@'<zabbix server ip>';\nmysql> SET GLOBAL log_bin_trust_function_creators = 1;\nmysql> QUIT\n
Warning

\"The Zabbix documentation explicitly mentions that deterministic triggers need to be created during the import of schema. On MySQL and MariaDB, this requires GLOBAL log_bin_trust_function_creators = 1 to be set if binary logging is enabled and there is no superuser privileges and log_bin_trust_function_creators = 1 is not set in MySQL configuration file.\"

"},{"location":"installation/installing-zabbixdb/#add-the-zabbix-repository-and-populate-the-db_1","title":"Add the Zabbix repository and populate the DB","text":"
# rpm -Uvh https://repo.zabbix.com/zabbix/6.5/rocky/9/x86_64/zabbix-release-6.5-2.el9.noarch.rpm\n# dnf clean all\n# dnf install zabbix-sql-scripts\n\n

Now let;s upload the data from zabbix (db structure, images, user, ... )

# zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uroot -p zabbix\nEnter password:\n
Warning

\"Depending on the speed of your hardware or VM this can take a few seconds upto a few minutes so please don't cancel just sit and wait for the prompt.\"

Log back into your MySQL Database as root\n\n# mysql -uroot -p\n

Remove the global parameter again as its not needed anymore and also for security reasons.

mysql> SET GLOBAL log_bin_trust_function_creators = 0;\nQuery OK, 0 rows affected, 1 warning (0.00 sec)\n
"},{"location":"installation/installing-zabbixdb/#configure-the-firewall_1","title":"Configure the firewall","text":"

One last thing we need to do is open the firewall and allow incoming connections from our Zabbix server to our MySQL database because at the moment we dont accept any connections yet.

# firewall-cmd --list-all\npublic (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces: enp0s3 enp0s8\n  sources:\n  services: cockpit dhcpv6-client  ssh\n  ports:\n  protocols:\n  forward: yes\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

First we will create an appropriate zone for our MySQL Database and open port 3306/tcp but only for the IP from our Zabbix server. This way no one unallowed is able to connect.

# firewall-cmd --new-zone=mysql-access --permanent\nsuccess\n\n# firewall-cmd --reload\nsuccess\n\n# firewall-cmd --get-zones\nblock dmz drop external home internal mysql-access nm-shared public trusted work\n\n# firewall-cmd --zone=mysql-access --add-source=<zabbix-serverip> --permanent\n\nsuccess\n# firewall-cmd --zone=mysql-access --add-port=3306/tcp  --permanent\n\nsuccess\n# firewall-cmd --reload\n

Now lets have a look to our firewall rules to see if they are what we expected:

# firewall-cmd --list-all --zone=mysql-access\n
mysql-access (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces:\n  sources: <ip from the zabbix-server>\n  services:\n  ports: 3306/tcp\n  protocols:\n  forward: no\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

Our database server is ready now to accept connections from our Zabbix server :). You can continue with the next task Installing the Zabbix Server

"},{"location":"installation/installing-zabbixdb/#installing-zabbix-with-postgresql","title":"Installing Zabbix with PostgreSQL","text":"

For our DB setup with PostgreSQL we need to add our PostgreSQL repository first to the system. As of writing PostgreSQL 13-16 are supported but best is to have a look before you install it as new versions may be supported and older maybe unsupported both by Zabbix and PostgreSQL. Usually it's a good idea to go with the latest version that is supported by Zabbix. Zabbix also supports the extension TimescaleDB this is someting we will talk later about. As you will see the setup from PostgreSQL is very different from MySQL not only the installation but also securing the DB.

The table of compatibility can be found here.

"},{"location":"installation/installing-zabbixdb/#add-the-postgresql-repo","title":"Add the PostgreSQL repo","text":"

So let us start first setting up our PostgreSQL repository with the folowing commands.

# Install the repository RPM:\nsudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm\n\n# Disable the built-in PostgreSQL module:\nsudo dnf -qy module disable postgresql\n\n# Install PostgreSQL:\nsudo dnf install -y postgresql16-server\n\n# Initialize the database and enable automatic start:\nsudo /usr/pgsql-16/bin/postgresql-16-setup initdb\nsudo systemctl enable postgresql-16 --now\n
"},{"location":"installation/installing-zabbixdb/#securing-the-postgresql-database","title":"Securing the PostgreSQL database","text":"

As i told you PostgreSQL works a bit different then MySQL or MariaDB and this applies aswell to how we manage access permissions. Postgres works with a file with the name pg_hba.conf where we have to tell who can access our database from where and what encryption is used for the password. So let's edit this file to allow our frontend and zabbix server to access the database.

Note

\"Client authentication is configured by a configuration file with the name pg_hba.conf. HBA here stands for host based authentication. For more information feel free to check the PostgreSQL documentation.\"

Add the following lines, the order here is important.

# vi /var/lib/pgsql/16/data/pg_hba.conf\n
# \"local\" is for Unix domain socket connections only\nlocal   zabbix          zabbix-srv                                  scram-sha-256\nlocal   all             all                                         peer\n# IPv4 local connections:\nhost    zabbix          zabbix-srv      <ip from zabbix server/24>  scram-sha-256\nhost    zabbix          zabbix-web      <ip from zabbix server/24>  scram-sha-256\nhost    all             all             127.0.0.1/32                scram-sha-256\n

After we changed the pg_hba file don't forget to restart postgres else the settings will not be applied. But before we restart let us also edit the file postgresql.conf and allow our database to listen on our network interface for incomming connections from the zabbix server. Postgresql will standard only allow connections from the socket.

# vi /var/lib/pgsql/16/data/postgresql.conf\n

and replace the line with listen_addresses so that PostgreSQL will listen on all interfaces and not only on our localhost.

#listen_addresses = 'localhost' with  listen_addresses = '*'\n

When done restart the PostgreSQL cluster and see if it comes back online in case of an error check the pg_hba.conf file you just edited for typos.

# systemctl restart postgresql-16\n

For our Zabbix server we need to create tables in the database for this we need ot install the Zabbix repository like we did for our Zabbix server and install the Zabbix package containing all the database tables images icons, ....

"},{"location":"installation/installing-zabbixdb/#add-the-zabbix-repository-and-populate-the-db_2","title":"Add the Zabbix repository and populate the DB","text":"
# dnf install https://repo.zabbix.com/zabbix/6.0/rhel/9/x86_64/zabbix-release-6.0-4.el9.noarch.rpm -y\n# dnf install zabbix-sql-scripts -y\n

Now we are ready to create our Zabbix users for the server and the frontend:

# su - postgres \n# createuser --pwprompt zabbix-srv\nEnter password for new role: <server-password>\nEnter it again: <server-password>\n

Let's do the same for our frontend let's create a user to connect to the database:

# createuser --pwprompt zabbix-web\nEnter password for new role: <frontend-password>\nEnter it again: <frontend-password>\n

Next we have to unzip the database schema files. Run as user root followin command::

# gzip -d /usr/share/zabbix-sql-scripts/postgresql/server.sql.gz\n

We are now ready to create our database zabbix. Become user postgres again and run next command to create the database as our user zabbix-srv:

# su - postgres\n# createdb -E Unicode -O zabbix-srv  zabbix\n

Let's verify that we are really connected to the database with the correct session. Login from the Postgres shell on the zabbix database

# psql -d zabbix -U zabbix-srv\n

Make sure we are logged in with our correct user zabbix-srv.

zabbix=> SELECT session_user, current_user;\n session_user | current_user\n--------------+--------------\n zabbix-srv   | zabbix-srv\n(1 row)\n

PostgreSQL works a bit different then MySQL or MariaDB when it comes to almost everything :) One of the things that it has that MySQL not has are for example shemas. If you like to know more about it i can recommend this URI. It explains in detail what it is and why we need it. But in short ... In PostgreSQL schema enables a multi-user environment that allows multiple users to access the same database without interference. Schemas are important when several users use the application and access the database in their way or when various applications utilize the same database. There is a standard schema that you can use but the better way is to create our own schema.

Note

\"There is a standard schema public that you can use but the better way is to create our own schema this was if later something else is installed next to the Zabbix database it will be easier to create users with only access to the newly created database tables.\"

zabbix=> CREATE SCHEMA zabbix_server AUTHORIZATION \"zabbix-srv\";\nCREATE SCHEMA\nzabbix=> set search_path to \"zabbix_server\";\nzabbix=> \\dn\n          List of schemas\n     Name      |       Owner\n---------------+-------------------\n public        | pg_database_owner\n zabbix_server | zabbix-srv\n(2 rows)\n\n\n

Now we have our DB ready with correct permissions for user zabbix-srv but not yet for our user zabbix-web. Let's fix this first and give the rights to connect to our schema.

zabbix=# GRANT USAGE ON SCHEMA zabbix_server TO \"zabbix-web\";\nGRANT\n

The user zabbix-web has now the rights to connect to our schema but cannot to anything yet lets fix this but also don't give too many rights.

zabbix=# GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA zabbix_server TO \"zabbix-web\";\nGRANT\nzabbix=# GRANT SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA zabbix_server TO \"zabbix-web\";\nGRANT\n

There we go both users are created with the correct permissons. We are now ready to populate the database with the Zabbix table structures etc ... log back in as user postgres and run the following commands

Let's upload the Zabbix SQL file we extracted earlier to populate our database with the needed schemas images users etc ...

Warning

\"Depending on the speed of your hardware or VM this can take a few seconds upto a few minutes so please don't cancel just sit and wait for the prompt.\"

zabbix=# \\i /usr/share/zabbix-sql-scripts/postgresql/server.sql\nCREATE TABLE\nCREATE INDEX\n...\n...\nINSERT 0 1\nINSERT 0 1\nINSERT 0 1\nINSERT 0 1\nCOMMIT\nzabbix=#\n
Note

\"If the import fails with psql:/usr/share/zabbix-sql-scripts/postgresql/server.sql:7: ERROR: no schema has been selected to create in then you probably made an error in the line where you set the search path.\"

Lets verify that our tables are properly created with the correct permissions

zabbix=# \\dt\n                        List of relations\n    Schema     |            Name            | Type  |   Owner\n---------------+----------------------------+-------+------------\n zabbix_server | acknowledges               | table | zabbix-srv\n zabbix_server | actions                    | table | zabbix-srv\n zabbix_server | alerts                     | table | zabbix-srv\n zabbix_server | auditlog                   | table | zabbix-srv\n zabbix_server | autoreg_host               | table | zabbix-srv\n...\n...\n zabbix_server | usrgrp                     | table | zabbix-srv\n zabbix_server | valuemap                   | table | zabbix-srv\n zabbix_server | valuemap_mapping           | table | zabbix-srv\n zabbix_server | widget                     | table | zabbix-srv\n zabbix_server | widget_field               | table | zabbix-srv\n(173 rows)\n
Note

\"If you are like me and don't like to set the search path every time you logon with the user zabbix-srv to the correct search path you can run the following SQL. zabbix=> alter role \"zabbix-srv\" set search_path = \"$user\", public, zabbix_server ;\"

If you are ready you can exit the database and return as user root.

zabbix=>  \\q\n# exit\n
"},{"location":"installation/installing-zabbixdb/#configure-the-firewall_2","title":"Configure the firewall","text":"

One last thing we need to do is open the firewall and allow incoming connections for the PostgreSQL database from our Zabbix server because at the moment we dont accept any connections yet.

# firewall-cmd --list-all\npublic (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces: enp0s3 enp0s8\n  sources:\n  services: cockpit dhcpv6-client  ssh\n  ports:\n  protocols:\n  forward: yes\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

First we will create an appropriate zone for our PostgreSQL DB and open port 5432/tcp but only for the ip from our Zabbix server.

# firewall-cmd --new-zone=postgresql-access --permanent\nsuccess\n\n# firewall-cmd --reload\nsuccess\n\n# firewall-cmd --get-zones\nblock dmz drop external home internal nm-shared postgresql-access public trusted work\n\n# firewall-cmd --zone=postgresql-access--add-source=<zabbix-serverip> --permanent\n\nsuccess\n# firewall-cmd --zone=postgresql-access --add-port=5432/tcp  --permanent\n\nsuccess\n# firewall-cmd --reload\n

Now lets have a look to our firewall rules to see if they are what we expected:

# firewall-cmd --zone=postgresql-access --list-all\n
postgresql-access (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces:\n  sources: 192.168.56.18\n  services:\n  ports: 5432/tcp\n  protocols:\n  forward: no\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

Our database server is ready now to accept connections from our Zabbix server :). You can continue with the next task Installing the Zabbix Server

"},{"location":"maintenance/maintaining-zabbix/","title":"Maintaining Zabbix","text":""},{"location":"permissions/managing-permissions/","title":"Managing Permissions","text":""},{"location":"problems/zabbix-triggers/","title":"Triggers","text":""},{"location":"proxies/installing-proxies/","title":"Monitoring with Proxies","text":""},{"location":"security/securing-zabbix/","title":"Securing Zabbix","text":""},{"location":"visualising/Visualising-our-problems/","title":"Visualising our problems","text":""},{"location":"vmware/vmware-monitoring/","title":"VMWare monitoring","text":""},{"location":"websites/monitoring-websites/","title":"Monitoring websites","text":""},{"location":"windows/monitoring-windows/","title":"Monitoring Windows","text":""}]} \ No newline at end of file +{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"What is this book about ?","text":"

Hi, welcome and thank you for your interest in my Zabbix book. I wrote the Zabbix cookbook and co wrote with Richards Zabbix 4 Network Monitoring a few years ago for PackPub.

The cookbook the first of it's kind probably outdated and will be replaced by the Zabbix 7 IT Infrastructure Monitoring Cookbook, written by Brian and Nathan, 2 people I like a lot to work with and can higly recommend. There are many more books available from Packt about Zabbix a complete overview can be found here Zabbix books at pack. Or if you like to find some non English books Amazon has some books form Packt and other Publishers in Chinese, Spanish and maybe some other languages as well. Other books

As Zabbix is an opensource product and making money out of the books was never my intention, it got me thinking how to do things different. How to make a new book without using a publisher like I had done before. After a while, I came up with the idea to make a book that would be free and that would be updated when new versions came out. Since I am a huge fan of documentation in markdown or asciidoc I came up with the idea to share the book in git and use markdown. The only problem left was how to make those markdown files readable in an easy way like a book ? After some searching trying to look for a good solution I found MkDocs. MkDocs is a Python-Markdown library that can convert everything to HTML and can be templated. So the problem was solved and a new book was born.

"},{"location":"#who-am-i","title":"Who am I ?","text":"

My name is Patrik Uytterhoeven and I work for a Belgium company named Open-Future. I started at this company at Januari 2013 and that's when my journey started with Zabbix as well. They gave me the opportunity to build my experience and to get certified as Zabbix trainer. Since this year I am officially 10y Zabbix trainer. If you would like to follow one of my trainings feel free to register for a training at our website www.open-future.be. Why would you follow a training if you can read this book for free are you now thinking? Because trainings just like the book explain you all the details on how to set up and do things but also give you valueable tips and feedback that you never get from a book. Books just can't cover everything.

"},{"location":"#what-os-do-i-need","title":"What OS do I need ?","text":"

Since I work mostly with RHEL based systems and since I am convinced that RHEL is the better choice in Production environments I have chosen to focus on using one of the forks that is available for free. Zabbix is supported on Ubuntu, Debian, Suse, Raspberry .... and it can be compiled on any OS that is Unix based so it's almost impossible to cover them all. However the book is Opensource and in GIT so feel free to contribute the code for your favorite flavour :). I will use Rocky Linux 9 in this book, but it should work for most of the other installations as well.

"},{"location":"#what-version-of-zabbix-is-used-in-this-book","title":"What version of Zabbix is used in this book ?","text":"

Since we are almost at the release of Zabbix 7, I will focus on version 7 since it will be the new LTS. It should also apply to most other versions but of course there will be minor changes. In the future, if there is enough support from the community to update this book together, it would be great if we could build a book for every LTS version available.

"},{"location":"#how-to-use-this-book","title":"How to use this book ?","text":"

The book will try to cover all the topics, feel free to let me know if something is missing or feel free to make a pull request. There is no need to start from page 1 and read the book till the end. Some people will be looking for basic knowledge others might want to skip to the fun part, so I want the book to be useful for everyone. Therefor I will try to explain as best as possible in every topic the exact steps needed to reproduce.

There will be moments in the book where you need to type some code, I will show the commands you need to type in a box just like here.

# some command \n

Notes to some useful documentation will be added at the bottom of the page.

Here is a simple footnote1. With some additional text after it.

In case there is some important information to share I will add notes in the documentation like can be seen here :

Note

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Info

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Tip

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Question

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Warning

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Bug

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

Example

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nulla et euismod nulla. Curabitur feugiat, tortor non consequat finibus, justo purus auctor massa, nec semper lorem quam in massa.

  1. My reference.\u00a0\u21a9

"},{"location":"actions/zabbix-eventactions/","title":"Event based Actions","text":""},{"location":"api/zabbix-api/","title":"Zabbix API","text":""},{"location":"automation/automating-configuration/","title":"Automating configuration","text":""},{"location":"configuration/Dashboard/","title":"Zabbix Interface","text":"

This chapter is going to cover the basics we need to know when it comes to the Zabbix userinterface and the thing we need to know before we can start to fully dive into our monitoring tool. We will see how the userinteface works how to add a host, groups users, items ... so that we have a good understanding of the basics. This is something that is sometimes missed and can lead to frustrations not knowing why things don't work like we had expected them to work. So even if you are an advanced user it may be usefull to have a look into this chapter.

"},{"location":"configuration/Dashboard/#overview-of-the-interface","title":"Overview of the interface","text":"

With Zabbix 7 the user interface after logging in is a bit changed. Our menu on the left side of the screen has has a small overhaul. Let's dive into it. When we login into our Zabbix setup the first time with our Admin user we see a page like this where we have our main window in green our main menu marked in red and our links marked in yellow.

The main menu can be hidden by collapsing it completely or to reduce it to a set of small icons.

When we click on the button with the 2 arrows to the left:

You will see that the menu collapses to a set of small icons. Pressing \">>\" will bring the main menu back to it's original state. Pressing the box with the arrow sticking out next to the \"<<\" button will hide the main menu completely.

To get the main menu back it's not too difficult we just look for the button on the left with three horizontal lines and click it. This will bring the menu back and clicking on the box with the arrow agian will bring the main menu back.

Yet another way to make the screen bigger that is quit useful for monitors in NOK teams for example is the kiosk mode button. This one is however located on the left side of your screen and looks like 4 arrows pointing to every corner of the screen. Pressing this button will remove all the menus and leave only main window to focus on.

When wanting to leave the kios mode the button will be changed to 2 arrows poiting to the inside of the screen. Pressing this button will revert us back to the original state.

Tip

We can also enter and exit kiosk mode by making use of parameters in our Zabbix url: /zabbix.php?action=dashboard.view&kiosk=1 - activate kiosk mode or /zabbix.php?action=dashboard.view&kiosk=0 - activate normal mode

Note

There are many other page parameters we can use. A full list can be found here

Zabbix also has a global search menu that we can use to find hosts, host groups and templates.

If we look in the search box for server you will see that we get an overview of all templates, host groups and hosts with the name server in it.

"},{"location":"configuration/Dashboard/#main-menu","title":"Main menu","text":"

Our main menu on the left consists of a few sections, 9 to be exact:

Menu Name Details Dashboards Contains an overview of all the dashboards we have access to. Monitoring Shows us the hosts, problems, latest data, maps, ... Services An overview of all the Services and SLA settings. Inventory An overview of our collected inventory data. Reports Shows us the system information, scheduled reports, audit logs, action logs, etc . Data collection Contains all things related to collecting data like hosts, templates, maintenance, discovery, ... Alert The configuration of our media types, scripts and actions Users User configuration like user roles, user groups, authentication, API tokes, ... Administration The administration part containing all global settings, housekeeper, proxies, queue, ..."},{"location":"configuration/Dashboard/#links-menu","title":"Links menu","text":"

Our last part the links part contain a set of useful links that we can use:

Menu name Details Support This brings us to the technical support page that you can buy from Zabbix. Remember that your local partner is also able to sell these contracts and can help you in your own language. Your local distributors Integrations The official zabbix integeration page Help The link to the documentation of your Zabbix version User settings The user profile settings. Sign out Log out of the current session.

There are still a few buttons that we need to cover on the right side of our screen

The edit button allows us to change our dashboard. This is something we will cover later. On the far left side there is a \"?\" this will bring you to the Zabbix documentation page that explains everything about the dashboard. The button on the right side with the 3 horizontal lines is the one to share, rename, delete, ... our dashboards.

"},{"location":"configuration/Dashboard/#system-information","title":"System Information","text":"

There is also a box on the dashboard called System Information. This widget will show you the current System status of your Zabbix setup. Let's go over the different lines of information as they are important to understand.

Parameter Value Details Zabbix server is running This gives us the status of our zabbix server if it is running yes or no and if it is running on our localhost or another IP and on what port the zabbix server is listening. If no trapper is listening the rest of the information can not be displayed IP and port of the Zabbix server Zabbix server version This shows us the version of the Zabbix server so the version you see at the bottom of your screen is the one from the Zabbix frontend and can be different but should be in the same major version. Version Number Zabbix frontend version This is the version of the frontend and should match with what you see at the bottom of your screen. Version Number Number of hosts (enabled/disabled) The total number of hosts configured on our system How many of those are enabled and disabled Number of templates The number of templates installed on our Zabbix server. Number of items (enabled/disabled/not supported) This line shows us the number of items we have configured in total in this case 99 90 are enabled and 0 are disabled but 9 of them are unsupported. This last number is important as those are items not working. We will look into this later why it happens and how to fix it. For now remember that a high number of unsupported items is not a good idea. Number of triggers (Enabled/disabled[problem/ok]) The number of triggers configured Number of enabled and disabled triggers. Just as with items we also see if there are triggers that are in a problem state or ok state. A trigger in a problem state is a non working trigger something we need to monitor and fix. We will cover this also later. Number of users (online) Here we see the number of users that are configured on our system The nunber of users currently online. Required server performance, nvps The number of new values per second that Zabbix will process per second. This is just an estimated number as some values we get are unknown so the real value is probably higher. So we can have some indication about how many IOPS we need and how busy our database is. A better indication is probably the internal item zabbix[wcache,values,all] High availability cluser It will show us if we are running on a Zabbix HA cluster or not Failover delay once HA is activated Tip

System information may display some additonal warnings like when your database doesnt have the correct character set or collation UTF-8. Also when the database you used is lower or higher then the recommended version or when there are misconfigurations on housekeeper or TimescaleDB. Another warning you can see is about database history tables that aren't upgraded or primary keys that have not been set. This is possible if you are coming from an older version before Zabbix 6 and never did the upgrade.

"},{"location":"configuration/Dashboard/#the-main-menu-explained","title":"The main menu explained","text":"

It's important to know that we have so far seen our dashboard with the Admin user and that this user is a Zabbix Super Admin user. This means that the user has no restrictions. Zabbix works with 3 different levels of users we have the regular users, Zabbix Admin and Zabbix Super Admin users. Let's have a look

Info

More information can be found in the online Zabbix documentation here

"},{"location":"configuration/zabbix-agent/","title":"Zabbix Agent","text":""},{"location":"configuration/zabbix-agent/#zabbix-agent-linux","title":"Zabbix agent Linux","text":""},{"location":"configuration/zabbix-agent/#zabbix-agent-windows","title":"Zabbix agent windows","text":""},{"location":"configuration/zabbix-dataflow/","title":"Data Flow","text":""},{"location":"configuration/zabbix-dataflow/#data-collection","title":"Data Collection","text":""},{"location":"configuration/zabbix-dataflow/#simple-checks","title":"Simple Checks","text":""},{"location":"configuration/zabbix-hostgroups/","title":"Host groups","text":""},{"location":"configuration/zabbix-hosts/","title":"Zabbix hosts","text":"

To understand how Zabbix works it's important to know that Host in Zabbix are a reference to anything we would like to monitor it can be a physical host, a virtual machine, an application a device or even just a dummy host used to calculate data from existing other hosts into something new.

Its probably one of the first tasks that we will do as an Admin when we first login to Zabbix because we need a host if we would like to monitor some metrics. It's however important to know that hosts cannot be created without them being in a hostgroup.

With this said let's create our first host.

Let's go to the menu on our Left and select Data Collection -> Hosts. We see that there is already a hosts configured and that the availability icon is \"RED\" don't worry about it this is normal we have no Zabbix agent installed or configured.

To Add a new host to our system we press `Create host this button can be found in the upper right corner of our screen.

We now get a modal form where we need to fill in some information about our host. The fields marked with a red asterisk \"*\" are the fields that are mandatory.

ParameterDescription Host nameHere we need to enter the Host name of our machine we like to add. The name can contain alphanumerics, spaces, dots, dashes and underscores. HOWEVER you are not allowed to use leading and trailing spaces. The Host name in the frontend is what we need later for the configuration of our Zabbix agent so make sure you remember it. Visible nameThe host name as we have seen is neede to configure our Zabbix agent. So in case you like to give it a unique name that is random generated etc you can add a visible name here. This name will then be used in the frontend instead of what we call the technical name host name. This name has support for UTF-8 so special characters are supported.This name will be used in all the places like maps, latest data, inventory , ... TemplatesTemplates are like blueprints that we can use on our hosts to add items, triggers , .... We explain more about it in the topic Zabbix templates. You can start typing the name of the template and Zabbix will start to show a list with matches or you can press the ```Select``` box and choose one from the list. Host groupsEvery host needs to be in atleast 1 ```host group```. This is because permssions are set on host groups. You can type the name of the host group and a list of matching groups will start to appear. Another way is to select a host group from an existing list by pressing the Selectbutton. Or you can create a new group by just typing the name and pressing on the box that shows the name of the group you typed with (new) behind it InterfacesZabbix supports several host interfaces like Zabbix agent, SNMP, JMX and IPMI. By default when we create a host no interface is added. To add an interface press Add and fill in the needed info like IP or DNS depending on the host interface chosen. When an interface is in use (items created that use the interface) then the interface cannot be removed. DescriptionA place to enter a short description about our host. Monitored by proxyIf we have proxies configured we can select here if we like to monitor our host by a proxy. EnabledMark the checkbox to enable the host. This will make it monitored by Zabbix. When unchecked the host will not be monitored."},{"location":"configuration/zabbix-hosts/#host-menu-details","title":"Host menu details","text":"

Before we add a host ourselves there are a few things we need to know first. When we click on a host that we already configured before there are a few things that we notice. First of all we see a blue line under Host. This means that we are on the current tab of the host page. As you can see there are multiple tabs that we can click on like IPMI, Tags, Macros, ...

The next thing we see is that next to the tab Macros there is a number 2. This is because there are 2 macros configured in the macro tab. So when we add information in tabs like macros or tags ... Zabbix will show how many items we have added on these tabs by showing next to the tab name the number.

When looking at the encryption tab we notice the green dot. This shows us that an option on the tab has been activated. Now that we know this lets get a quick overview of every tab and see what it does.

"},{"location":"configuration/zabbix-hosts/#ipmi","title":"IPMI","text":"

So looking at the tab IPMI there are a few thing we need to fill in when working with an IPMI interface. IPMI stands for Intelligent Platform Management Interface and is basicaly a set of standards to manage hardware platforms. In short it allows us to monitor and manage ours servers hardware even if the server is not turned on yet. IPMI is better known as ILO on HP servers and DRAC on Dell servers.

ParameterDescription Autentication algorithmSelect the authentication algorithm that we have configured on our IPMI server this can be Default, none, MD2, MD5, Straight, OEM, RMCP+ Privelege levelHere we select the privelege level: Callback, User, Operator, Admin or OEM. UsernameThe user for authentication that was created on the host. User Macros can be used PasswordThe password for our user on the host. User macros can be used.

??? Note+ We will cover IPMI in more detail later in the Chapter IPMI Monitoring

"},{"location":"configuration/zabbix-hosts/#tags","title":"Tags","text":""},{"location":"configuration/zabbix-interfaces/","title":"Interfaces","text":""},{"location":"configuration/zabbix-items/","title":"Items","text":""},{"location":"configuration/zabbix-macros/","title":"Macros","text":""},{"location":"configuration/zabbix-templates/","title":"templates","text":""},{"location":"configuration/zabbix-users/","title":"Zabbix Users","text":"

Now that we know how the Zabbix dashboard is build up our first task will be to create a user. In case you missed it the standard Zabbix (yes the capital Z here is eeded to login.) user is Admin and has the password zabbix so we need to change this ASAP. The most confusing part is probably that the user Admin in zabbix is actually a 'super admin' but more about that later.

"},{"location":"configuration/zabbix-users/#changing-the-zabbix-super-admin-password","title":"Changing the Zabbix super admin password","text":"

In our menu on the right side of the screen click the 'Users' section and then choose '''users'''. As you see here in the screenshot.

You will now see a list of all the users that are created on the system when installing a new Zabbix instance. Here you will always see a list of all users that are configured on the system.

To change the password do the following steps - Click user '''Admin''' - Click on the button '''Change password''' - Fill in the current password '''zabbix''' - Fill in the new password twice and press '''Update''' at the bottom of the page.

"},{"location":"configuration/zabbix-users/#zabbix-user-types","title":"Zabbix User types","text":"

Before we create new users it's important to know that Zabbix has 3 user types that are built-in.

Besides these differences these users also have different accesses rights in our menu. Let's have a closer look.

This table gives an overview of all the permissions a Zabbix user, admin and super admin have:

Zabbix UserZabbix AdminZabbix Super Admin Dashboards\u2705\u2705\u2705 Monitoring\u2705\u2705\u2705 - Problems\u2705\u2705\u2705 - Hosts\u2705\u2705\u2705 - Latest data\u2705\u2705\u2705 - Maps\u2705\u2705\u2705 - Discovery\u274c\u2705\u2705 Services\u2705\u2705\u2705 - Services\u2705\u2705\u2705 - SLA\u274c\u2705\u2705 - SLA Report\u2705;\u2705\u2705 Inventory\u2705\u2705\u2705 - Overview\u2705\u2705\u2705 - Hosts\u2705\u2705\u2705 Reports\u2705\u2705\u2705 - System information\u274c\u274c\u2705 - Scheduled reports\u274c\u2705\u2705 - Availability report\u2705\u2705\u2705 - Triggers top 100\u2705\u2705\u2705 - Audit log\u274c\u274c\u2705 - Action log\u274c\u274c\u2705 - Notifications\u274c\u2705\u2705 Data Collection\u274c\u2705\u2705 - Template groups\u274c\u2705\u2705 - Host groups\u274c\u2705\u2705 - Templates\u274c\u2705\u2705 - Hosts\u274c\u2705\u2705 - Maintenance\u274c\u2705\u2705 - Event correlation\u274c\u274c\u2705 - Discovery\u274c\u2705\u2705 Alerts\u274c\u2705\u2705 - Trigger actions\u274c\u2705\u2705 - Service actions\u274c\u2705\u2705 - Autoregistration actions\u274c\u2705\u2705 - Internal actions\u274c\u2705\u2705 - Media types\u274c\u274c\u2705 - Scripts\u274c\u274c\u2705 Users\u274c\u274c\u2705 - User groups\u274c\u274c\u2705 - User roles\u274c\u274c\u2705 - Users\u274c\u274c\u2705 - Api tokens\u274c\u274c\u2705 - Authentication\u274c\u274c\u2705 Administration\u274c\u274c\u2705 - General\u274c\u274c\u2705 - Audit log\u274c\u274c\u2705 - Housekeeping\u274c\u274c\u2705 - Proxies\u274c\u274c\u2705 - Macros\u274c\u274c\u2705 - Queue\u274c\u274c\u2705 "},{"location":"configuration/zabbix-users/#creating-a-new-user-in-zabbix","title":"Creating a new User in Zabbix","text":"

So now that we are in the users section of Zabbix it's probably a good time to create a new user for our system. If you skipped previous step go to the menu '''Users''' -> '''Users'''.

Click on the top right on '''Create user''' and fill in the details of your new users. You will see that some fiels have red asterisks in front of them like Username and Password, ... this means that those feelds are mandatory to fill in.

"},{"location":"configuration/zabbix-users/#strengthen-the-zabbix-password-policy","title":"Strengthen the Zabbix password policy","text":"

Zabbix passwords rely on a minimum length of 8 characters and also block a list of easy to guess passwords. We can make our passwords more secure by telling Zabbix that our passwords must contain uppercase and lowercase characters, a digit and a special character. This policy is a global policy that will be enforced and we have to set this policy as Super Admin. Go to the menu Users -> Authentication in older versions you can find it under Administration Authentication.

ParameterDescription UsernameA unique name that will be used as username when we login. NameThe users firstname this field is optional visible in acknowledgment information and notification recipient information if set. Last NameUsers last name. Optional, this field is optional visible in acknowledgment information and notification recipient information if set. GroupsSelect what group the user will belong to. Atleast 1 group needs to be selected. This feeld will auto complete or you can press the '''Select''' button at the end of the field. PasswordThere are 2 password fields they can only be used for internal authentication but more about this later. If the user has the Super admin role then clicking on the Change password button opens an additional field to entering the current (old) password. On a successful password change, the user for which the password was changed will be logged out of all active sessions. LanguageLanguage of the frontend. The php gettext extension is required for the translations to work. And the language needs to be configured on the system. See the chapter \"Installing Zabbix\" in case you forgot. TimezoneSelect the time zone per user or use the default timezone that is configured on the Zabbix server. ThemeHere users can select their own look and feel by choosing one of the 4 themes provided by Zabbix or another custom made theme. Default will switch to the default theme chosen by the admin. Auto-LoginCheck this box so that the user will be remembered for 30 days. The browser must accept cookies for this to work. Auto-LogoutChecking this box makes sure the user gets logged out automatically, after the set amount of seconds (minimum 90 seconds, maximum 1 day). Time suffixes are supported, e.g. 90s, 5m, 2h, 1d. Note that this option will not work if :
  • If the \"Show warning if Zabbix server is down\" global configuration option is enabled and Zabbix frontend is kept open.
  • When Monitoring menu pages perform background information refreshes.
  • If logging in with the Remember me for 30 days option checked.
    • RefreshSet the refresh rate used for graphs, plain text data, etc. Can be set to 0 to disable. Time suffixes are supported. Ex: 90s, 5m, 1h. Rows per pageDefine how many rows per page will be displayed in lists. URL(after login)You can make Zabbix transfer the user to a specific URL after successful login. This can be useful for monitors in NOC team for example so you arrive on a specific dashboard that is maximised. You can make Zabbix transfer the user to a specific URL after successful login. This can be useful for monitors in NOC team for example so you arrive on a specific dashboard that is maximised."},{"location":"configuration/zabbix-users/#user-media","title":"User Media","text":"

    The tab ''' Media ''' contains a list of all media that is defined for out user. Media is used for sending notifications to the user. We can click the ''' Add ''' button.

    Adding the media here is not enough to receive notification we also need to configure our media properly and we still need to configure Actions as well. When pressing the ''' Add ''' button we get a popup where we can select some information.

    ParameterDescription TypeA drop down list with the names of all media types. When a media type is disabled it will be in red. Send toHere we can provide contact information. For an email media type it is possible to add several addresses by clicking on '''Add''' below the address field. In this case, the notification will be sent to all email addresses provided. It's also possible to specify recipient name in the Send to field of the email recipient in a format 'Recipient name <address1@company.com>'. Note that if a recipient name is provided, an email address should be wrapped in angle brackets (<>). UTF-8 characters in the name are supported, quoted pairs and comments are not. For example: John Doe <manager@open-future.com> and manager@nycdatacenter.com are both valid formats. Incorrect examples: John Doe manager@open-future.com, %%\"Zabbix\\@\\<H(comment)Q\\>\" zabbix@company.com %%. when activeThe time when media will be active from monday till sundat, 1-7 and the time from 00:00 till 24:00 for example only in weekends from 6 in the morning till 5 in the evening: 6-7,06-17:00i. This is based on the user his timezone Use if severityA list of checkboxes from the severities you would like to recieve notifications from. Selected severities will be displayed in color. !! Read the warning below!! StatusStatus of the media we have selected either enabled or disabled ( in use or not ) Warning

    When selecting the different severities be aware that you have to select '''Not classified''' if you want to receive notifications about non trigger events like internal events. For more info check out : Event sources. This is something that is not obvious and Zabbix documentation could be better in explaining this imho.

    "},{"location":"configuration/zabbix-users/#user-permissions","title":"User permissions","text":"

    When we go to the Permissions tab in our Users we will get an overview of all permissions our users had in the Menu structure. Or when creating a new user we have the option to select a User Role. Zabbix has 4 different User Roles built-in. There is a User role, Admin role, Super admin role and a Guest role.

    The Guest role is a role with very strict access limitations. Its a role intended to user for accesss to zabbix without any user account. I never advice using this role unless you know what you are doing as you open your GUI to users without any authorization. This could leak potential sensitive data like hostnames, IP, ..... .

    Choosing a User type is one thing based on the User type we choose, our user will have more or less rights in our main menu. But there is another important part when choosing the User Type. This also has in impact on the rights each user has on host groups. For example a regular user an only have read only right or none, A Zabbix admin user can have full, read only or no right and a Zabbix Super Admin always has full rights on host groups and his rights on the host groups cannot be revoked.

    Here is an overview of every user and his rights:

    Group rightsZabbix UserZabbix AdminZabbix Super Admin Read/WriteRead OnlyFullFull Read onlyRead OnlyRead OnlyFull DenyNoneNoneFull Note

    With all this knowledge we now know that if we like to create a regular user who also has access to certain parts of the Administration menu that it is not possible. We can never create a user that has only RO access to certain host groups and RW access to the Administration part. What we could do however is create a Super Administrator account and remove access from the menu for certain parts in the Administrationmenu by creating a special role. There is no limit on the amount of roles you can create.

    Note

    Also be aware that when you click on an item on the dashboard on Update , you will see a modal window popup that some options to change the severity, close a problem etc ... somwe will be grayed out. This is because the user needs write permissions. For example a user need write permissions to close a problem, change the severity level

    Update

    "},{"location":"configuration/zabbix-users/#user-roles","title":"User Roles","text":"

    User roles have been in Zabbix since version 5.2 and make our live more easy by allowing us to make some custom adjustments to the standard defind user types in Zabbix.

    Warning

    Be aware the no permissions can be added to user roles only permissions can be revoked.

    "},{"location":"configuration/zabbix-users/#creating-a-new-user-in-zabbix_1","title":"Creating a new User in Zabbix","text":"

    So now that we are in the users section of Zabbix it's probably a good time to create a new user for our system. If you skipped previous step go to the menu '''Users''' -> '''Users'''.

    Click on the top right on '''Create user''' and fill in the details of your new users. You will see that some fiels have red asterisks in front of them like Username and Password, ... this means that those feelds are mandatory to fill in.

    "},{"location":"configuration/zabbix-users/#user-roles_1","title":"User Roles","text":"

    User roles have been in Zabbix since version 5.2 and make our live more easy by allowing us to make some custom adjustments to the standard defind user types in Zabbix.

    Warning

    Be aware the no permissions can be added to user roles only permissions can be revoked.

    "},{"location":"configuration/zabbix-users/#creating-a-new-user-in-zabbix_2","title":"Creating a new User in Zabbix","text":"

    So now that we are in the users section of Zabbix it's probably a good time to create a new user for our system. If you skipped previous step go to the menu '''Users''' -> '''Users'''.

    Click on the top right on '''Create user''' and fill in the details of your new users. You will see that some fiels have red asterisks in front of them like Username and Password, ... this means that those feelds are mandatory to fill in.

    "},{"location":"extra-monitoring/SNMP-monitoring/","title":"Monitoring SNMP,IPMI and JAVA","text":""},{"location":"installation/Requirements/","title":"Requirements","text":"

    Zabbix has a set of requirements that need to be met on the hardware level and software level. These requirements can change over time and also depends on the size of your setup and the software you choose. So before you start buying metal or installing a random database version have a look at the Zabbix documentation and check the latest requirements for the version you want to install. The latest requirements can be found here. Don't forget to select your correct Zabbix version from the list.

    If you don't plan to run anything big just a small setup or a test setup Zabbix will run happy on a system with 2cpu and 8G ram. But all depends on how big your setup will be and how many items you will monitor, triggers you will create and for how long you want to keep that data. My advice in the days of Virtualization is you can start small and add more later.

    Tip

    While zabbix uses dashes \"-\" in it's names when we need to install packages like zabbix-get or zabbix-sender it's binaries use \"_\". like zabbix_sender or zabbix_server. This of course can vary depending if you use the packages from the original Zabbix repositories or not. Just be aaware that it's sometimes rather confusing and that if you installed somepackage with a dash that maybe the binary is with an underscore.

    "},{"location":"installation/Requirements/#basic-os-configuration","title":"Basic OS configuration","text":""},{"location":"installation/Requirements/#firewall","title":"firewall","text":"

    It's important for our Zabbix server to have an OS that is well prepared before we start to install our monitoring tool. First we need to make sure our firewall is installed.

    # dnf install firewalld --now

    Our firewall is installed now, and we are ready to configure the needed ports. For our Zabbix server, we need to allow access to port 10051/tcp this is the port where our Zabbix trapper listens on for incoming data. So we need to open this port in our firewall to allow access to our Zabbix trapper.

    # firewall-cmd --add-service=Zabbix-server --permanent

    or if the service is not known

    # firewall-cmd --add-port=10051/tcp --permanent

    firewalld

    \"Firewalld is the replacement of iptables in Redhat and allows us to make changes available immediately without the need to restart a service. It's possible that your distribution is not using Firewalld in this case you have to look to the documentation of your OS.\"

    "},{"location":"installation/Requirements/#timeserver","title":"timeserver","text":"

    Another thing we need to configure is the setup of timeserver and sync our Zabbix server to the timeserver by making use of an ntp client. This needs to be done for the Zabbix server but also for the devices we will monitor as time is very important for Zabbix. Imagine one of our hosts having a time zone that is wrong we could end up looking for a problem in Zabbix that happened 6h ago while it had happened maybe only 2h ago.

    # dnf install chronyd --now

    Chrony should be installed now and enabled and running. This can be verified with the command:

    # systemctl status chronyd

    dnf

    \"dnf is a packagemanager from RedHat you need to replace dnf with your correct packagemanager like zyper, apt, yum, ... chrony is a replacement for ntpd and does a better job being faster and more accurate. If your OS does not support chrony then maybe ntpd is still available.\"

    Once Chrony is installed we also need to setup our correct time zone. We can have a look first with 'timedatectl' to see how our time is configured 

    # timedatectl\n               Local time: Thu 2023-11-16 15:09:14 UTC\n           Universal time: Thu 2023-11-16 15:09:14 UTC\n                 RTC time: Thu 2023-11-16 15:09:15\n                Time zone: UTC (UTC, +0000)\nSystem clock synchronized: yes\n              NTP service: active\n          RTC in local TZ: no\n

    Make sure that the service cronyd is active, see above on how to do if you missed it. We can choose the correct time zone from a list that we can lookup with the following command:

    # timedatectl list-time zones\n

    This will give us a list with all available time zones. Choose the one closest to you.

    Africa/Abidjan\nAfrica/Accra\n\n...\n\nPacific/Tongatapu\nPacific/Wake\nPacific/Wallis\nUTC\n

    We can now configure our correct time zone with the following command:

    timedatectl set-time zone Europe/Brussels\n

    When we look again we should see our time zone properly configured.

    # timedatectl\n               Local time: Thu 2023-11-16 16:13:35 CET\n           Universal time: Thu 2023-11-16 15:13:35 UTC\n                 RTC time: Thu 2023-11-16 15:13:36\n                Time zone: Europe/Brussels (CET, +0100)\nSystem clock synchronized: yes\n              NTP service: active\n          RTC in local TZ: no\n
    Note

    \"Some people like to install all servers in the UTC time zone so that all server logs are in the same time zone when having servers all over the world. Zabbix supports user based time zone settings so it's possible to keep the time zone in UTC on the server and then add the correct time zone in the user interface if you like.\"

    We can test if Chrony is syncronizing with the correct timeservers as well by running the command chronyc

    # chronyc\nchrony version 4.2\nCopyright (C) 1997-2003, 2007, 2009-2021 Richard P. Curnow and others\nchrony comes with ABSOLUTELY NO WARRANTY.  This is free software, and\nyou are welcome to redistribute it under certain conditions.  See the\nGNU General Public License version 2 for details.\n\nchronyc>\n

    Then we type sources

    chronyc> sources\nMS Name/IP address         Stratum Poll Reach LastRx Last sample\n===============================================================================\n^- 51-15-20-83.rev.poneytel>     2   9   377   354   +429us[ +429us] +/-  342ms\n^- 5.255.99.180                  2  10   377   620  +7424us[+7424us] +/-   37ms\n^- hachi.paina.net               2  10   377   412   +445us[ +445us] +/-   39ms\n^* leontp1.office.panq.nl        1  10   377   904  +6806ns[ +171us] +/- 2336us\n

    Here we can see that we are using a bunch of ntp servers that are not in our own country so we better swicht to some timeservers in our local country or if we have a timeserver in our company we could use this one. We can find some local timeservers here : https://www.ntppool.org/

    To change this we have to edit our config file \"/etc/chrony.conf\" and replace the existing ntp server with our local one 

    # Use public servers from the pool.ntp.org project.\n# Please consider joining the pool (http://www.pool.ntp.org/join.html).\npool 2.centos.pool.ntp.org iburst\n

    And change it to a local server:

    # Use public servers from the pool.ntp.org project.\n# Please consider joining the pool (http://www.pool.ntp.org/join.html).\npool be.pool.ntp.org iburst\n

    Don't forget to restart the ntpd client of course.

    # systemctl restart chronyd\n

    When we look again we will see that we are now using our local timeservers.

    chronyc> sources\n\nMS Name/IP address         Stratum Poll Reach LastRx Last sample\n===============================================================================\n^- ntp1.unix-solutions.be        2   6    17    43   -375us[ -676us] +/-   28ms\n^* ntp.devrandom.be              2   6    17    43   -579us[ -880us] +/- 2877us\n^+ time.cloudflare.com           3   6    17    43   +328us[  +27us] +/- 2620us\n^+ time.cloudflare.com           3   6    17    43   +218us[  -83us] +/- 2815us\n
    "},{"location":"installation/installing-zabbix/","title":"Installing Zabbix","text":"

    Before we can install Zabbix we first have to know how the design is. The Zabbix server has been build op modular based on 3 components.

    All these components can be installed on 1 server or can be split over 3 different servers. The Zabbix server itself is the brain this part is doing all the trigger calculations and sending all the alert. The database is where the Zabbix server stores its config and all the data that we have gathered. The web server provides us with a front-end. Note that Zabbix has a API and that this is also located on the front-end and not on the Zabbix server side.

    All these parts have to work together so as you can see in our image above. The Zabbix server needs to read the config and store the data in our database and the Zabbix front-end needs to be able to write the configuration in the database as well. The Zabbix front-end also needs to check the online status of our Zabbix server and needs to read some other information as well.

    For our setup, we will use 2 VM's, 1 VM with a Zabbix server and our Zabbix web server and another VM with our Zabbix database.

    "},{"location":"installation/installing-zabbix/#installing-the-zabbix-server","title":"Installing the Zabbix Server","text":"

    Before you start to install your Zabbix server make sure the server is properly configure as we explained in our topic Basic OS configuration before we start. Something else that is important in this case is that we need to disable SELinux. We will see later in chapter Securing Zabbix how to do this properly. We can check the status of SELinux with the command sestatus :

    # sestatus\nSELinux status:                 enabled\nSELinuxfs mount:                /sys/fs/selinux\nSELinux root directory:         /etc/selinux\nLoaded policy name:             targeted\nCurrent mode:                   enforcing\nMode from config file:          enforcing\nPolicy MLS status:              enabled\nPolicy deny_unknown status:     allowed\nMemory protection checking:     actual (secure)\nMax kernel policy version:      33\n

    As you can see we are now in enforcing mode. To disable SELinux just run setenforce 0 to disable it. 

    # setenforce 0\n# sestatus\n\nSELinux status:                 enabled\nSELinuxfs mount:                /sys/fs/selinux\nSELinux root directory:         /etc/selinux\nLoaded policy name:             targeted\nCurrent mode:                   permissive\nMode from config file:          enforcing\nPolicy MLS status:              enabled\nPolicy deny_unknown status:     allowed\nMemory protection checking:     actual (secure)\nMax kernel policy version:      33\n

    As you can see our current mode is now permissive. However this is not persistent so we also need to alter our SELinux configuration file. This can be done by altering the file /etc/config/selinux and replacing enforcing by permissive. A more easy way is to run the following command :

    sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config\n

    This line will alter the config file for you. So when we run sestatus again we will see that we are in permissive mode and that our config file is also in permissive mode.

    We can verify this with our cat commando.

    # cat /etc/selinux/config\n\n# This file controls the state of SELinux on the system.\n# SELINUX= can take one of these three values:\n#     enforcing - SELinux security policy is enforced.\n#     permissive - SELinux prints warnings instead of enforcing.\n#     disabled - No SELinux policy is loaded.\n# See also:\n# https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-selinux/#getting-started-with-selinux-selinux-states-and-modes\n#\n# NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also\n# fully disable SELinux during boot. If you need a system with SELinux\n# fully disabled instead of SELinux running with no policy loaded, you\n# need to pass selinux=0 to the kernel command line. You can use grubby\n# to persistently set the bootloader to boot with selinux=0:\n#\n#    grubby --update-kernel ALL --args selinux=0\n#\n# To revert back to SELinux enabled:\n#\n#    grubby --update-kernel ALL --remove-args selinux\n#\nSELINUX=permissive\n# SELINUXTYPE= can take one of these three values:\n#     targeted - Targeted processes are protected,\n#     minimum - Modification of targeted policy. Only selected processes are protected.\n#     mls - Multi Level Security protection.\nSELINUXTYPE=targeted\n

    And we can also verify it with our commando setstatus 

    # sestatus\n\nSELinux status:                 enabled\nSELinuxfs mount:                /sys/fs/selinux\nSELinux root directory:         /etc/selinux\nLoaded policy name:             targeted\nCurrent mode:                   permissive\nMode from config file:          permissive\nPolicy MLS status:              enabled\nPolicy deny_unknown status:     allowed\nMemory protection checking:     actual (secure)\nMax kernel policy version:      33\n
    "},{"location":"installation/installing-zabbix/#adding-the-zabbix-repository","title":"Adding the Zabbix repository","text":"

    From the Zabbix Download page select the correct Zabbix version you would like to install. In our case it will be 7.0 LTS. Select the correct OS distribution as well. This will be Rocky Linux 9 in our case. We are going to install the Server and will be using NGINX.

    Our first step is to disable Zabbix packages provided by EPEL, if you have it installed. Edit file /etc/yum.repos.d/epel.repo and add the following statement.

    [epel]\n...\nexcludepkgs=zabbix*\n
    Tip

    Having the EPEL repository enabled is a bad practice and could be dangerous if you use EPEL it's best to disable the repo and use dnf install --enablerepo=epel. This way you will never overwrite or install unwanted packages by accident.

    Our next task is to install the Zabbix repository on our OS and do a dnf cleanup so that old cache files from our repository metadata is cleaned up.

    rpm -Uvh https://repo.zabbix.com/zabbix/6.5/rocky/9/x86_64/zabbix-release-6.5-2.el9.noarch.rpm\ndnf clean all\n
    Note

    A repository is a config in Linux that you can add to make packages available for you OS to install. The best way to look at it is maybe to think of it like an APP store that you add where you can find the software of your vendor. In this case the repository form Zabbix. There are many repositories you can add but you should be sure that they can be trusted. So it's always a good idea to stick to the repositories of your OS and only add extra repositories when you are sure they are to be trusted and needed. In our case the repository is from our vendor Zabbix so it should be safe to add. Epel is another popular repository for RedHat systems that is considered to be safe.

    "},{"location":"installation/installing-zabbix/#installing-the-zabbix-server-for-mysqlmariadb","title":"Installing the Zabbix server for MySQL/MariaDB","text":"

    Now that we have our repository with software added to our system we are ready to install our Zabbix server and webserver. Remember the webserver could be installed on another system. There is no need to install both on the same server.

    dnf install zabbix-server-mysql zabbix-web-mysql

    Now that we have installed our packages for the Zabbix server and our frontend we still need to change the configuration of our Zabbix server so that we can connect to our database. Open the file /etc/zabbix/zabbix_server.conf and replace the following lines:

    DBHost=<ip or dns of your MariaDB server>\nDBName=<the name of your database>\nDBUser=<the user that will connect to the database>\nDBPassword=<your super secret password>\n

    Make sure you don't have a '#' in front of the config parameter else Zabbix will see this as text and not as a parameter. Also make sure that there are not extra duplicate lines Zabbix will always take the last config parameter if there is more then 1 line with the same parameter

    In our case the config will look like this:

    # vi /etc/zabbix/zabbix_server.conf\n\nDBHost=<ip or dns of your MariaDB server>\nDBName=zabbix\nDBUser=zabbix-srv\nDBPassword=<your super secret password>\nDBPort=3306\n
    Note

    The Zabbix server configuration file has the option to include an extra config file with parameters you like to alter or add. In production it's probably better to not touch the configuration file but to add a new file and include the parameters you like to change. This way you never have to edit your original configuration file after an upgrade it will also make your life more easy when working with configuration tools like Ansible, Puppet, SaltStack, .... The only thing that needs to be done is remove the # in front of the line '# Include=/usr/local/etc/zabbix_server.conf.d/*.conf' and make sure the path exists with a customized config file of your won that is readable by the user zabbix.

    Ok now that we have changed the configuration of you Zabbix server so that it is able to connect to our DB we are ready to start. Run the following command to enable the Zabbix server and make it active on boot next time.

    systemctl enable zabbix-server --now

    Our Zabbix server service will start and if everything goes well you should see in the Zabbix server log file the following output

    tail /var/log/zabbix/zabbix_server.log

      1123:20231120:110604.440 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n  1123:20231120:110604.440 ****** Enabled features ******\n  1123:20231120:110604.440 SNMP monitoring:           YES\n  1123:20231120:110604.440 IPMI monitoring:           YES\n  1123:20231120:110604.440 Web monitoring:            YES\n  1123:20231120:110604.440 VMware monitoring:         YES\n  1123:20231120:110604.440 SMTP authentication:       YES\n  1123:20231120:110604.440 ODBC:                      YES\n  1123:20231120:110604.440 SSH support:               YES\n  1123:20231120:110604.440 IPv6 support:              YES\n  1123:20231120:110604.440 TLS support:               YES\n  1123:20231120:110604.440 ******************************\n  1123:20231120:110604.440 using configuration file: /etc/zabbix/zabbix_server.conf\n  1123:20231120:110604.470 current database version (mandatory/optional): 06050143/06050143\n  1123:20231120:110604.470 required mandatory version: 06050143\n  1124:20231120:110604.490 starting HA manager\n  1124:20231120:110604.507 HA manager started in active mode\n  1123:20231120:110604.508 server #0 started [main process]\n  1126:20231120:110604.509 server #2 started [configuration syncer #1]\n  1125:20231120:110604.510 server #1 started [service manager #1]\n  1133:20231120:110604.841 server #9 started [lld worker #1]\n  1132:20231120:110604.841 server #8 started [lld manager #1]\n  1134:20231120:110604.841 server #10 started [lld worker #2]\n

    If there was an error and the server was not able to connect to the database you would see something like this in the server log file :

     10773:20231118:213248.570 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n 10773:20231118:213248.570 ****** Enabled features ******\n 10773:20231118:213248.570 SNMP monitoring:           YES\n 10773:20231118:213248.570 IPMI monitoring:           YES\n 10773:20231118:213248.570 Web monitoring:            YES\n 10773:20231118:213248.570 VMware monitoring:         YES\n 10773:20231118:213248.570 SMTP authentication:       YES\n 10773:20231118:213248.570 ODBC:                      YES\n 10773:20231118:213248.570 SSH support:               YES\n 10773:20231118:213248.570 IPv6 support:              YES\n 10773:20231118:213248.570 TLS support:               YES\n 10773:20231118:213248.570 ******************************\n 10773:20231118:213248.570 using configuration file: /etc/zabbix/zabbix_server.conf\n 10773:20231118:213248.574 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213248.574 database is down: reconnecting in 10 seconds\n 10773:20231118:213258.579 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213258.579 database is down: reconnecting in 10 seconds\n

    Let's check the Zabbix server service to see if it's enabled so that it survives a reboot 

    # systemctl status zabbix-server\n\n\u25cf zabbix-server.service - Zabbix Server\n     Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; preset: disabled)\n     Active: active (running) since Mon 2023-11-20 11:06:04 CET; 1h 2min ago\n   Main PID: 1123 (zabbix_server)\n      Tasks: 59 (limit: 12344)\n     Memory: 52.6M\n        CPU: 20.399s\n     CGroup: /system.slice/zabbix-server.service\n             \u251c\u25001123 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf\n             \u251c\u25001124 \"/usr/sbin/zabbix_server: ha manager\"\n             \u251c\u25001125 \"/usr/sbin/zabbix_server: service manager #1 [processed 0 events, updated 0 event tags, deleted 0 problems, synced 0 service updates, idle 5.008686 sec during 5.016382 sec]\"\n             \u251c\u25001126 \"/usr/sbin/zabbix_server: configuration syncer [synced configuration in 0.092797 sec, idle 10 sec]\"\n             \u251c\u25001127 \"/usr/sbin/zabbix_server: alert manager #1 [sent 0, failed 0 alerts, idle 5.027620 sec during 5.027828 sec]\"\n             \u251c\u25001128 \"/usr/sbin/zabbix_server: alerter #1 started\"\n             \u251c\u25001129 \"/usr/sbin/zabbix_server: alerter #2 started\"\n             \u251c\u25001130 \"/usr/sbin/zabbix_server: alerter #3 started\"\n             \u251c\u25001131 \"/usr/sbin/zabbix_server: preprocessing manager #1 [queued 1, processed 2 values, idle 5.490312 sec during 5.490555 sec]\"\n             \u251c\u25001132 \"/usr/sbin/zabbix_server: lld manager #1 [processed 1 LLD rules, idle 5.028973sec during 5.029123 sec]\"\n             \u251c\u25001133 \"/usr/sbin/zabbix_server: lld worker #1 [processed 1 LLD rules, idle 60.060180 sec during 60.085009 sec]\"\n             \u251c\u25001134 \"/usr/sbin/zabbix_server: lld worker #2 [processed 1 LLD rules, idle 60.065526 sec during 60.095165 sec]\"\n             \u251c\u25001135 \"/usr/sbin/zabbix_server: housekeeper [deleted 0 hist/trends, 0 items/triggers, 0 events, 0 sessions, 0 alarms, 0 audit items, 0 autoreg_host, 0 records in 0.019108 sec, idle for 1 hour(s)]\"\n             \u251c\u25001136 \"/usr/sbin/zabbix_server: timer #1 [updated 0 hosts, suppressed 0 events in 0.002856 sec, idle 59 sec]\"\n             \u251c\u25001137 \"/usr/sbin/zabbix_server: http poller #1 [got 0 values in 0.000059 sec, idle 5 sec]\"\n             \u251c\u25001138 \"/usr/sbin/zabbix_server: discovery manager #1 [processing 0 rules, 0.000000% of queue used, 0 unsaved checks]\"\n             \u251c\u25001139 \"/usr/sbin/zabbix_server: history syncer #1 [processed 0 values, 0 triggers in 0.000036 sec, idle 1 sec]\"\n             \u251c\u25001140 \"/usr/sbin/zabbix_server: history syncer #2 [processed 1 values, 0 triggers in 0.005016 sec, idle 1 sec]\"\n             \u251c\u25001141 \"/usr/sbin/zabbix_server: history syncer #3 [processed 0 values, 0 triggers in 0.000031 sec, idle 1 sec]\"\n             \u251c\u25001142 \"/usr/sbin/zabbix_server: history syncer #4 [processed 0 values, 0 triggers in 0.000014 sec, idle 1 sec]\"\n             \u251c\u25001143 \"/usr/sbin/zabbix_server: escalator #1 [processed 0 escalations in 0.005587 sec, idle 3 sec]\"\n             \u251c\u25001144 \"/usr/sbin/zabbix_server: proxy poller #1 [exchanged data with 0 proxies in 0.000010 sec, idle 5 sec]\"\n             \u251c\u25001145 \"/usr/sbin/zabbix_server: self-monitoring [processed data in 0.000016 sec, idle 1 sec]\"\n             \u251c\u25001146 \"/usr/sbin/zabbix_server: task manager [processed 0 task(s) in 0.002511 sec, idle 5 sec]\"\n             \u251c\u25001147 \"/usr/sbin/zabbix_server: poller #1 [got 0 values in 0.000009 sec, idle 1 sec]\"\n             \u251c\u25001148 \"/usr/sbin/zabbix_server: poller #2 [got 1 values in 0.000232 sec, idle 1 sec]\"\n             \u251c\u25001149 \"/usr/sbin/zabbix_server: poller #3 [got 0 values in 0.000015 sec, idle 1 sec]\"\n             \u251c\u25001150 \"/usr/sbin/zabbix_server: poller #4 [got 0 values in 0.000010 sec, idle 1 sec]\"\n

    This concludes our chapter on installing and configuring our Zabbix server. Next we have to configure our frontend. You can have a look at Installing Zabbix frontend with Nginx or Installing Zabbix frontend with Apache

    "},{"location":"installation/installing-zabbix/#installing-the-zabbix-server-for-postgresql","title":"Installing the Zabbix server for PostgreSQL","text":"

    Now that we have our repository with software added to our system we are ready to install our Zabbix server and webserver. Remember the webserver could be installed on another system. There is no need to install both on the same server.

    dnf install zabbix-server-pgsql zabbix-web-pgsql

    Now that we have installed our packages for the Zabbix server and our frontend we still need to change the configuration of our Zabbix server so that we can connect to our database. Open the file /etc/zabbix/zabbix_server.conf and replace the following lines:

    DBHost=<ip or dns of your PostgreSQL server>\nDBName=<the name of your database>\nDBSchema=<our PostgreSQL schema name>\nDBUser=<the user that will connect to the database>\nDBPassword=<your super secret password>\n

    Make sure you don't have a '#' in front of the config parameter else Zabbix will see this as text and not as a parameter. Also make sure that there are not extra duplicate lines Zabbix will always take the last config parameter if there is more then 1 line with the same parameter

    In our case the config will look like this:

    # vi /etc/zabbix/zabbix_server.conf\n\nDBHost=<ip or dns of your MariaDB server>\nDBName=zabbix\nDBSchema=zabbix_server\nDBUser=zabbix-srv\nDBPassword=<your super secret password>\nDBPort=5432\n
    Note

    The Zabbix server configuration file has the option to include an extra config file with parameters you like to alter or add. In production it's probably better to not touch the configuration file but to add a new file and include the parameters you like to change. This way you never have to edit your original configuration file after an upgrade it will also make your life more easy when working with configuration tools like Ansible, Puppet, SaltStack, .... The only thing that needs to be done is remove the # in front of the line '# Include=/usr/local/etc/zabbix_server.conf.d/*.conf' and make sure the path exists with a customized config file of your won that is readable by the user zabbix.

    Ok now that we have changed the configuration of you Zabbix server so that it is able to connect to our DB we are ready to start. Run the following command to enable the Zabbix server and make it active on boot next time.

    systemctl enable zabbix-server --now

    Our Zabbix server service will start and if everything goes well you should see in the Zabbix server log file the following output

    tail /var/log/zabbix/zabbix_server.log

      1123:20231120:110604.440 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n  1123:20231120:110604.440 ****** Enabled features ******\n  1123:20231120:110604.440 SNMP monitoring:           YES\n  1123:20231120:110604.440 IPMI monitoring:           YES\n  1123:20231120:110604.440 Web monitoring:            YES\n  1123:20231120:110604.440 VMware monitoring:         YES\n  1123:20231120:110604.440 SMTP authentication:       YES\n  1123:20231120:110604.440 ODBC:                      YES\n  1123:20231120:110604.440 SSH support:               YES\n  1123:20231120:110604.440 IPv6 support:              YES\n  1123:20231120:110604.440 TLS support:               YES\n  1123:20231120:110604.440 ******************************\n  1123:20231120:110604.440 using configuration file: /etc/zabbix/zabbix_server.conf\n  1123:20231120:110604.470 current database version (mandatory/optional): 06050143/06050143\n  1123:20231120:110604.470 required mandatory version: 06050143\n  1124:20231120:110604.490 starting HA manager\n  1124:20231120:110604.507 HA manager started in active mode\n  1123:20231120:110604.508 server #0 started [main process]\n  1126:20231120:110604.509 server #2 started [configuration syncer #1]\n  1125:20231120:110604.510 server #1 started [service manager #1]\n  1133:20231120:110604.841 server #9 started [lld worker #1]\n  1132:20231120:110604.841 server #8 started [lld manager #1]\n  1134:20231120:110604.841 server #10 started [lld worker #2]\n

    If there was an error and the server was not able to connect to the database you would see something like this in the server log file :

     10773:20231118:213248.570 Starting Zabbix Server. Zabbix 7.0.0alpha7 (revision 60de6a81aca).\n 10773:20231118:213248.570 ****** Enabled features ******\n 10773:20231118:213248.570 SNMP monitoring:           YES\n 10773:20231118:213248.570 IPMI monitoring:           YES\n 10773:20231118:213248.570 Web monitoring:            YES\n 10773:20231118:213248.570 VMware monitoring:         YES\n 10773:20231118:213248.570 SMTP authentication:       YES\n 10773:20231118:213248.570 ODBC:                      YES\n 10773:20231118:213248.570 SSH support:               YES\n 10773:20231118:213248.570 IPv6 support:              YES\n 10773:20231118:213248.570 TLS support:               YES\n 10773:20231118:213248.570 ******************************\n 10773:20231118:213248.570 using configuration file: /etc/zabbix/zabbix_server.conf\n 10773:20231118:213248.574 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213248.574 database is down: reconnecting in 10 seconds\n 10773:20231118:213258.579 [Z3001] connection to database 'zabbix' failed: [2002] Can't connect to server on 'xxx.xxx.xxx.xxx' (115)\n 10773:20231118:213258.579 database is down: reconnecting in 10 seconds\n

    Let's check the Zabbix server service to see if it's enabled so that it survives a reboot

    # systemctl status zabbix-server\n
    \u25cf zabbix-server.service - Zabbix Server\n     Loaded: loaded (/usr/lib/systemd/system/zabbix-server.service; enabled; preset: disabled)\n     Active: active (running) since Mon 2023-11-20 11:06:04 CET; 1h 2min ago\n   Main PID: 1123 (zabbix_server)\n      Tasks: 59 (limit: 12344)\n     Memory: 52.6M\n        CPU: 20.399s\n     CGroup: /system.slice/zabbix-server.service\n             \u251c\u25001123 /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf\n             \u251c\u25001124 \"/usr/sbin/zabbix_server: ha manager\"\n             \u251c\u25001125 \"/usr/sbin/zabbix_server: service manager #1 [processed 0 events, updated 0 event tags, deleted 0 problems, synced 0 service updates, idle 5.008686 sec during 5.016382 sec]\"\n             \u251c\u25001126 \"/usr/sbin/zabbix_server: configuration syncer [synced configuration in 0.092797 sec, idle 10 sec]\"\n             \u251c\u25001127 \"/usr/sbin/zabbix_server: alert manager #1 [sent 0, failed 0 alerts, idle 5.027620 sec during 5.027828 sec]\"\n             \u251c\u25001128 \"/usr/sbin/zabbix_server: alerter #1 started\"\n             \u251c\u25001129 \"/usr/sbin/zabbix_server: alerter #2 started\"\n             \u251c\u25001130 \"/usr/sbin/zabbix_server: alerter #3 started\"\n             \u251c\u25001131 \"/usr/sbin/zabbix_server: preprocessing manager #1 [queued 1, processed 2 values, idle 5.490312 sec during 5.490555 sec]\"\n             \u251c\u25001132 \"/usr/sbin/zabbix_server: lld manager #1 [processed 1 LLD rules, idle 5.028973sec during 5.029123 sec]\"\n             \u251c\u25001133 \"/usr/sbin/zabbix_server: lld worker #1 [processed 1 LLD rules, idle 60.060180 sec during 60.085009 sec]\"\n             \u251c\u25001134 \"/usr/sbin/zabbix_server: lld worker #2 [processed 1 LLD rules, idle 60.065526 sec during 60.095165 sec]\"\n             \u251c\u25001135 \"/usr/sbin/zabbix_server: housekeeper [deleted 0 hist/trends, 0 items/triggers, 0 events, 0 sessions, 0 alarms, 0 audit items, 0 autoreg_host, 0 records in 0.019108 sec, idle for 1 hour(s)]\"\n             \u251c\u25001136 \"/usr/sbin/zabbix_server: timer #1 [updated 0 hosts, suppressed 0 events in 0.002856 sec, idle 59 sec]\"\n             \u251c\u25001137 \"/usr/sbin/zabbix_server: http poller #1 [got 0 values in 0.000059 sec, idle 5 sec]\"\n             \u251c\u25001138 \"/usr/sbin/zabbix_server: discovery manager #1 [processing 0 rules, 0.000000% of queue used, 0 unsaved checks]\"\n             \u251c\u25001139 \"/usr/sbin/zabbix_server: history syncer #1 [processed 0 values, 0 triggers in 0.000036 sec, idle 1 sec]\"\n             \u251c\u25001140 \"/usr/sbin/zabbix_server: history syncer #2 [processed 1 values, 0 triggers in 0.005016 sec, idle 1 sec]\"\n             \u251c\u25001141 \"/usr/sbin/zabbix_server: history syncer #3 [processed 0 values, 0 triggers in 0.000031 sec, idle 1 sec]\"\n             \u251c\u25001142 \"/usr/sbin/zabbix_server: history syncer #4 [processed 0 values, 0 triggers in 0.000014 sec, idle 1 sec]\"\n             \u251c\u25001143 \"/usr/sbin/zabbix_server: escalator #1 [processed 0 escalations in 0.005587 sec, idle 3 sec]\"\n             \u251c\u25001144 \"/usr/sbin/zabbix_server: proxy poller #1 [exchanged data with 0 proxies in 0.000010 sec, idle 5 sec]\"\n             \u251c\u25001145 \"/usr/sbin/zabbix_server: self-monitoring [processed data in 0.000016 sec, idle 1 sec]\"\n             \u251c\u25001146 \"/usr/sbin/zabbix_server: task manager [processed 0 task(s) in 0.002511 sec, idle 5 sec]\"\n             \u251c\u25001147 \"/usr/sbin/zabbix_server: poller #1 [got 0 values in 0.000009 sec, idle 1 sec]\"\n             \u251c\u25001148 \"/usr/sbin/zabbix_server: poller #2 [got 1 values in 0.000232 sec, idle 1 sec]\"\n             \u251c\u25001149 \"/usr/sbin/zabbix_server: poller #3 [got 0 values in 0.000015 sec, idle 1 sec]\"\n             \u251c\u25001150 \"/usr/sbin/zabbix_server: poller #4 [got 0 values in 0.000010 sec, idle 1 sec]\"\n

    This concludes our chapter on installing and configuring our Zabbix server. Next we have to configure our frontend. You can have a look at Installing Zabbix frontend with Nginx or Installing Zabbix frontend with Apache

    "},{"location":"installation/installing-zabbix/#installing-zabbix-frontend-with-nginx","title":"Installing Zabbix frontend with Nginx","text":"

    Before we can configure our frontend we need to install our package first. If you run the frontend on the same server as the Zabbix server then there is nothing else you have to do you can just run the following command on your server to install the packages needed for our frontend to install:

    dnf install zabbix-nginx-conf and zabbix-web-mysql or if you used Postgres dnf install zabbix-web-pgsql\n

    In case the frontend is on another server installed you need to add the Zabbix repository first like we did on our Zabbix server. In case you forgot or just skipped to this topic and don't know how to do this have a look at Adding the Zabbix repository

    First thing we have to do is alter the Nginx configuration file so that we don't use the standard config.

    vi /etc/nginx/nginx.conf\n

    In this config look for the followin block that starts with :

        server {\n        listen       80;\n        listen       [::]:80;\n        server_name  _;\n        root         /usr/share/nginx/html;\n\n        # Load configuration files for the default server block.\n        include /etc/nginx/default.d/*.conf;\n

    And place the following lines in comment:

        server {\n#        listen       80;\n#        listen       [::]:80;\n#        server_name  _;\n#        root         /usr/share/nginx/html;\n

    We now have to alter the Zabbix configuration file so that it matches our setup. Edit the following file:

    vi /etc/nginx/conf.d/zabbix.conf\n
    server {\n        listen          8080;\n        server_name     example.com;\n\n        root    /usr/share/zabbix;\n\n        index   index.php;\n

    Replace the first 2 lines with the correct port and domain for your frontend in case you don't have a domain you can replace server_name with _; like in the exaple below:

    server {\n#        listen          8080;\n#        server_name     example.com;\n        listen          80;\n        server_name     _;\n\n        root    /usr/share/zabbix;\n\n        index   index.php;\n

    We are now ready to start our websever and enable it so that it comes online after a reboot.

    systemctl enable php-fpm --now\nsystemctl enable nginx --now\n

    Let's verify if the service is properly started and enabled so that it survives our reboot next time.

    # systemctl status nginx\n\n\u25cf nginx.service - The nginx HTTP and reverse proxy server\n     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: disabled)\n    Drop-In: /usr/lib/systemd/system/nginx.service.d\n             \u2514\u2500php-fpm.conf\n     Active: active (running) since Mon 2023-11-20 11:42:18 CET; 30min ago\n   Main PID: 1206 (nginx)\n      Tasks: 2 (limit: 12344)\n     Memory: 4.8M\n        CPU: 38ms\n     CGroup: /system.slice/nginx.service\n             \u251c\u25001206 \"nginx: master process /usr/sbin/nginx\"\n             \u2514\u25001207 \"nginx: worker process\"\n\nNov 20 11:42:18 zabbix-srv systemd[1]: Starting The nginx HTTP and reverse proxy server...\nNov 20 11:42:18 zabbix-srv nginx[1204]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok\nNov 20 11:42:18 zabbix-srv nginx[1204]: nginx: configuration file /etc/nginx/nginx.conf test is successful\nNov 20 11:42:18 zabbix-srv systemd[1]: Started The nginx HTTP and reverse proxy server.\n

    The service is running and enabled so there is only 1 thing left to do before we can start the configuration in the GUI and that is to configure our firewall to allow incoming communication to the webserver.

    firewall-cmd --add-service=http --permanent\nfirewall-cmd --reload\n

    Open your browser and go to the url or ip of your frontend :

    http://<ip or dns of the zabbix frontend server>/\n

    If all goes well you should be greeted with a Zabbix welcome page. In case you have an error check the configuration again or have a look at the nginx log file :

    /var/log/nginx/error.log

    or run

    journalctl -xe

    This should help you in locating the errors you made.

    When you point your browser to the correct URL you should be greeted with a page like here :

    As you see there is only a limited list of local translations available on our Zabbix frontend to choose from

    What if we want to install Chinese as language or another language from the list ? Run the next command to get a list of all locales available for your OS.

    dnf list glibc-langpack-*

    This will give you a list like 

    Installed Packages\nglibc-langpack-en.x86_64\nAvailable Packages\nglibc-langpack-aa.x86_64\n...\n\nglibc-langpack-zu.x86_64\n

    Let's search for our Chinese locale to see if it is available. As you can see the code starts with zh

    # dnf list glibc-langpack-* | grep zh\nglibc-langpack-zh.x86_64\nglibc-langpack-lzh.x86_64\n

    The command returns us 2 lines but as we have seen that the code was zh_CN we only have to install the first package.

    # dnf install glibc-langpack-zh.x86_64 -y\n

    When we return now to our frontend we are able to select the Chinese language.

    Note

    If your language is not available in the frontend don't panic it just means that there is no translation or that the translation was not 100% complete. Zabbis is free and relies on the community for it's translations so you can help in creating the translation. Go to the page https://translate.zabbix.com/ and help us to make Zabbix get better. Once the translation is complete the next Zabbix minor patch version should have your language included.

    Click next when you are satisfied with the transaltions available. You will arrive at a screen to verifiy if all pre-requisites are met. If not fix them first but normaly it should be fine and you should be just able to click Next

    The next page will show you a page with the connection parameters for our database.

    First you select your DB type 'MySQL' or 'PostgreSQL' and fill in the IP or DNS name of the location of your database server. Use port 3306 for MariaDB/MySQL or 5432 if you used PostgreSQL.

    Fill in the correct database name, in our case it was zabbix. If you used PostgreSQL then you also need to fill in the correct schema name in our case it was zabbix_server

    Next line will ask you for the DB users here we created a user zabbix-web. Enter it in the correct field and fill in the password that you used for this user.

    Make sure the option Database TLS encryption is not selected and press Next step.

    We are almost there. The only thing that rests us to do is give our instance a name, select our timezone and select a default time we like to use.

    Press Next step again you will see a page that tells you that the configuration is successful. Press Finish to end the configuration.

    We are now ready to login :

    Login : Admin Password : zabbix

    "},{"location":"installation/installing-zabbix/#installing-zabbix-frontend-with-apache","title":"Installing Zabbix frontend with Apache","text":"

    ToDo

    "},{"location":"installation/installing-zabbix/#setting-up-zabbix-ha","title":"Setting up Zabbix HA","text":"

    ToDo

    "},{"location":"installation/installing-zabbixdb/","title":"Installing Zabbix DB Server","text":""},{"location":"installation/installing-zabbixdb/#installing-zabbix-with-mariadb","title":"Installing Zabbix with MariaDB","text":"

    Let us start with the installation of the MariaDB server, you need to create a MariaDB repository configuration file mariadb.repo manually in the following path /etc/yum.repos.d/. To create a MariaDB repository file, you can use the following command.

    "},{"location":"installation/installing-zabbixdb/#add-the-mariadb-repo","title":"Add the MariaDB repo","text":"
    # vi /etc/yum.repos.d/mariadb.repo\n

    The above command will create a new repository file, Once it is created, you need to add the following configuration into the file. Make sure your version, in this case 10.11, is supported by Zabbix by looking at the latest requirements for your version. 

    # MariaDB 10.11 RedHatEnterpriseLinux repository list - created 2023-11-01 14:20 UTC\n# https://mariadb.org/download/\n[mariadb]\nname = MariaDB\n# rpm.mariadb.org is a dynamic mirror if your preferred mirror goes offline. See https://mariadb.org/mirrorbits/ for details.\n# baseurl = https://rpm.mariadb.org/10.11/rhel/$releasever/$basearch\nbaseurl = https://mirror.23m.com/mariadb/yum/10.11/rhel/$releasever/$basearch\n# gpgkey = https://rpm.mariadb.org/RPM-GPG-KEY-MariaDB\ngpgkey = https://mirror.23m.com/mariadb/yum/RPM-GPG-KEY-MariaDB\ngpgcheck = 1\n\n\n

    Lets update our OS first with the latest patches

    # dnf update -y\n
    "},{"location":"installation/installing-zabbixdb/#install-the-mariadb-database","title":"Install the MariaDB database","text":"

    Now we are ready to install our MariaDB database.

    # dnf install MariaDB-server MariaDB-client\n

    We are now ready to enable and start or MariaDB database.

    # systemctl enable mariadb --now\n

    Once the installation is complete, you can verify the version of the MariaDB server by using the following command:

    # mysql -V\n

    The output should look like this:

    mysql  Ver 15.1 Distrib 10.11.6-MariaDB, for Linux (x86_64) using  EditLine wrapper\n

    And when we ask the status of our MariaDB server we should get an output like this:

    # systemctl status mariadb\n\n\u25cf mariadb.service - MariaDB 10.11.6 database server\n     Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: disabled)\n    Drop-In: /etc/systemd/system/mariadb.service.d\n             \u2514\u2500migrated-from-my.cnf-settings.conf\n     Active: active (running) since Sat 2023-11-18 19:19:36 CET; 2min 13s ago\n       Docs: man:mariadbd(8)\n             https://mariadb.com/kb/en/library/systemd/\n    Process: 41986 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)\n    Process: 41987 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= ||   VAR=`cd /usr/bin/..; /usr/bin/galera_recovery`; [ $? -eq 0 ]   && systemctl set-environment _WSREP_START>\n    Process: 42006 ExecStartPost=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUCCESS)\n   Main PID: 41995 (mariadbd)\n     Status: \"Taking your SQL requests now...\"\n      Tasks: 9 (limit: 12344)\n     Memory: 206.8M\n        CPU: 187ms\n\n\n
    "},{"location":"installation/installing-zabbixdb/#securing-the-mariadb-database","title":"Securing the MariaDB database","text":"

    It's time to secure our database by removing the test database and user and set our own root password. Run the command mariadb-secure-installation, you should get the following output.

    \n\n# mariadb-secure-installation\n\nNOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB\n      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!\n\nIn order to log into MariaDB to secure it, we'll need the current\npassword for the root user. If you've just installed MariaDB, and\nhaven't set the root password yet, you should just press enter here.\n\nEnter current password for root (enter for none):\nOK, successfully used password, moving on...\n\nSetting the root password or using the unix_socket ensures that nobody\ncan log into the MariaDB root user without the proper authorisation.\n\nYou already have your root account protected, so you can safely answer 'n'.\n\nSwitch to unix_socket authentication [Y/n] n\n ... skipping.\n\nYou already have your root account protected, so you can safely answer 'n'.\n\nChange the root password? [Y/n] y\nNew password:\nRe-enter new password:\nPassword updated successfully!\nReloading privilege tables..\n ... Success!\n\n\nBy default, a MariaDB installation has an anonymous user, allowing anyone\nto log into MariaDB without having to have a user account created for\nthem.  This is intended only for testing, and to make the installation\ngo a bit smoother.  You should remove them before moving into a\nproduction environment.\n\nRemove anonymous users? [Y/n] y\n ... Success!\n\nNormally, root should only be allowed to connect from 'localhost'.  This\nensures that someone cannot guess at the root password from the network.\n\nDisallow root login remotely? [Y/n] y\n ... Success!\n\nBy default, MariaDB comes with a database named 'test' that anyone can\naccess.  This is also intended only for testing, and should be removed\nbefore moving into a production environment.\n\nRemove test database and access to it? [Y/n] y\n - Dropping test database...\n ... Success!\n - Removing privileges on test database...\n ... Success!\n\nReloading the privilege tables will ensure that all changes made so far\nwill take effect immediately.\n\nReload privilege tables now? [Y/n] y\n ... Success!\n\nCleaning up...\n\nAll done!  If you've completed all of the above steps, your MariaDB\ninstallation should now be secure.\n\nThanks for using MariaDB!\n
    "},{"location":"installation/installing-zabbixdb/#create-the-zabbix-database","title":"Create the Zabbix database","text":"
    # mysql -uroot -p\npassword\n\nMariaDB [(none)]> CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;\nMariaDB [(none)]> CREATE USER 'zabbix-web'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nMariaDB [(none)]> CREATE USER 'zabbix-srv'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nMariaDB [(none)]> GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix-srv'@'<zabbix server ip>';\nMariaDB [(none)]> GRANT SELECT, UPDATE, DELETE, INSERT ON zabbix.* TO 'zabbix-web'@'<zabbix server ip>';\nMariaDB [(none)]> SET GLOBAL log_bin_trust_function_creators = 1;\nMariaDB [(none)]> QUIT\n\n
    Warning

    \"The Zabbix documentation explicitly mentions that deterministic triggers need to be created during the import of schema. On MySQL and MariaDB, this requires GLOBAL log_bin_trust_function_creators = 1 to be set if binary logging is enabled and there is no superuser privileges and log_bin_trust_function_creators = 1 is not set in MySQL configuration file.\"

    "},{"location":"installation/installing-zabbixdb/#add-the-zabbix-repository-and-populate-the-db","title":"Add the Zabbix repository and populate the DB","text":"
    # rpm -Uvh https://repo.zabbix.com/zabbix/6.5/rocky/9/x86_64/zabbix-release-6.5-2.el9.noarch.rpm\n# dnf clean all\n# dnf install zabbix-sql-scripts\n

    Upload the data from zabbix (db structure, images, user, ... )

    # zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uroot -p zabbix\n
    Warning

    \"Depending on the speed of your hardware or VM this can take a few seconds upto a few minutes so please don't cancel just sit and wait for the prompt.\"

    Log back into your MariaDB Database as root

    # mysql -uroot -p\n

    Remove the global parameter again as its not needed anymore and also for security reasons.

    MariaDB [(none)]> SET GLOBAL log_bin_trust_function_creators = 0;\nQuery OK, 0 rows affected (0.001 sec)\n
    "},{"location":"installation/installing-zabbixdb/#configure-the-firewall","title":"Configure the firewall","text":"

    One last thing we need to do is open the firewall and allow incoming connections for the MariaDB database from our Zabbix server because at the moment we dont accept any connections yet.

    # firewall-cmd --list-all\npublic (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces: enp0s3 enp0s8\n  sources:\n  services: cockpit dhcpv6-client  ssh\n  ports:\n  protocols:\n  forward: yes\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

    First we will create an appropriate zone for our MariaDB and open port 3306/tcp but only for the ip from our Zabbix server.

    # firewall-cmd --new-zone=mariadb-access --permanent\nsuccess\n\n# firewall-cmd --reload\nsuccess\n\n# firewall-cmd --get-zones\nblock dmz drop external home internal mariadb-access nm-shared public trusted work\n\n# firewall-cmd --zone=mariadb-access --add-source=<zabbix-serverip> --permanent\n\nsuccess\n# firewall-cmd --zone=mariadb-access --add-port=3306/tcp  --permanent\n\nsuccess\n# firewall-cmd --reload\n

    Now lets have a look to our firewall rules to see if they are what we expected:

    # firewall-cmd --zone=mariadb-access --list-all\n
    mariadb-access (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces:\n  sources: <ip from zabbix-server>\n  services:\n  ports: 3306/tcp\n  protocols:\n  forward: no\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

    Our database server is ready now to accept connections from our Zabbix server :). You can continue with the next task Installing the Zabbix Server

    "},{"location":"installation/installing-zabbixdb/#installing-zabbix-with-mysql","title":"Installing Zabbix with MySQL","text":"

    Let us start with the installation of the MySQL server, you need to create a MySQL repository first so that we can install the proper files for our MySQL server It's alwqys best to check the Zabbix documentation to see what version is supported so you don't install a version that is not supported or is not supported anymore.

    "},{"location":"installation/installing-zabbixdb/#add-the-mysql-repo","title":"Add the MySQL repo","text":"

    Run the following command to install the MySQL repo for version 8.0

    # dnf -y install https://dev.mysql.com/get/mysql80-community-release-el9-1.noarch.rpm

    Note

    \"If you install this on RedHat 8 and higher or alternatives like CentOS, Rocky or Alma 8 then you need to disable the mysql module by running 'module disable mysql'.\"

    Let's update our OS first with the latest patches

    # dnf update -y

    "},{"location":"installation/installing-zabbixdb/#installing-the-mysql-database","title":"Installing the MySQL database","text":"

    # dnf -y install mysql-community-server

    We are now ready to enable and start or MySQL database.

    # systemctl enable mysqld --now

    Once the installation is complete, you can verify the version of the MySQL server by using the following command:

    # mysql -V

    The output should look like this:

    mysql Ver 8.0.35 for Linux on x86_64 (MySQL Community Server - GPL)

    And when we ask the status of our MariaDB server we should get an output like this:

    # systemctl status mysqld\n\n\u25cf mysqld.service - MySQL Server\n     Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; preset: disabled)\n     Active: active (running) since Mon 2023-11-20 22:15:51 CET; 1min 15s ago\n       Docs: man:mysqld(8)\n             http://dev.mysql.com/doc/refman/en/using-systemd.html\n    Process: 44947 ExecStartPre=/usr/bin/mysqld_pre_systemd (code=exited, status=0/SUCCESS)\n   Main PID: 45012 (mysqld)\n     Status: \"Server is operational\"\n      Tasks: 37 (limit: 12344)\n     Memory: 448.3M\n        CPU: 4.073s\n     CGroup: /system.slice/mysqld.service\n             \u2514\u250045012 /usr/sbin/mysqld\n\nNov 20 22:15:43 mysql-db systemd[1]: Starting MySQL Server...\nNov 20 22:15:51 mysql-db systemd[1]: Started MySQL Server.\n
    "},{"location":"installation/installing-zabbixdb/#securing-the-mysql-database","title":"Securing the MySQL database","text":"

    MySQL will secure our database with a random root password that is generated when we install the database. First thing we need to do is replace it with our own password. To find what the password is we need to read the log file with the followin command:

    # grep 'temporary password' /var/log/mysqld.log

    Change the root password as soon as possible by logging in with the generated, temporary password and set a custom password for the superuser account:

    # mysql -uroot -p\n
    mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY '<my mysql password>';\nmysql> quit\n

    Next we can run the command mysql_secure_installation, you should get the following output:

    Note

    \"There is no need to reset the root password for MySQL again as we have reset it already. The next step is optional but recommended.\"

    # mysql_secure_installation\n\nSecuring the MySQL server deployment.\n\nEnter password for user root:\nThe 'validate_password' component is installed on the server.\nThe subsequent steps will run with the existing configuration\nof the component.\nUsing existing password for root.\n\nEstimated strength of the password: 100\nChange the password for root ? ((Press y|Y for Yes, any other key for No) : n\n\n ... skipping.\nBy default, a MySQL installation has an anonymous user,\nallowing anyone to log into MySQL without having to have\na user account created for them. This is intended only for\ntesting, and to make the installation go a bit smoother.\nYou should remove them before moving into a production\nenvironment.\n\nRemove anonymous users? (Press y|Y for Yes, any other key for No) : y\nSuccess.\n\n\nNormally, root should only be allowed to connect from\n'localhost'. This ensures that someone cannot guess at\nthe root password from the network.\n\nDisallow root login remotely? (Press y|Y for Yes, any other key for No) : y\nSuccess.\n\nBy default, MySQL comes with a database named 'test' that\nanyone can access. This is also intended only for testing,\nand should be removed before moving into a production\nenvironment.\n\n\nRemove test database and access to it? (Press y|Y for Yes, any other key for No) : y\n - Dropping test database...\nSuccess.\n\n - Removing privileges on test database...\nSuccess.\n\nReloading the privilege tables will ensure that all changes\nmade so far will take effect immediately.\n\nReload privilege tables now? (Press y|Y for Yes, any other key for No) : y\nSuccess.\n\nAll done!\n

    Let's create our DB users and the correct permissions in the database:

    mysql -uroot -p

    mysql> CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;\nmysql> CREATE USER 'zabbix-web'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nmysql> CREATE USER 'zabbix-srv'@'<zabbix server ip>' IDENTIFIED BY '<password>';\nmysql> GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix-srv'@'<zabbix server ip>';\nmysql> GRANT SELECT, UPDATE, DELETE, INSERT ON zabbix.* TO 'zabbix-web'@'<zabbix server ip>';\nmysql> SET GLOBAL log_bin_trust_function_creators = 1;\nmysql> QUIT\n
    Warning

    \"The Zabbix documentation explicitly mentions that deterministic triggers need to be created during the import of schema. On MySQL and MariaDB, this requires GLOBAL log_bin_trust_function_creators = 1 to be set if binary logging is enabled and there is no superuser privileges and log_bin_trust_function_creators = 1 is not set in MySQL configuration file.\"

    "},{"location":"installation/installing-zabbixdb/#add-the-zabbix-repository-and-populate-the-db_1","title":"Add the Zabbix repository and populate the DB","text":"
    # rpm -Uvh https://repo.zabbix.com/zabbix/6.5/rocky/9/x86_64/zabbix-release-6.5-2.el9.noarch.rpm\n# dnf clean all\n# dnf install zabbix-sql-scripts\n\n

    Now let;s upload the data from zabbix (db structure, images, user, ... )

    # zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uroot -p zabbix\nEnter password:\n
    Warning

    \"Depending on the speed of your hardware or VM this can take a few seconds upto a few minutes so please don't cancel just sit and wait for the prompt.\"

    Log back into your MySQL Database as root\n\n# mysql -uroot -p\n

    Remove the global parameter again as its not needed anymore and also for security reasons.

    mysql> SET GLOBAL log_bin_trust_function_creators = 0;\nQuery OK, 0 rows affected, 1 warning (0.00 sec)\n
    "},{"location":"installation/installing-zabbixdb/#configure-the-firewall_1","title":"Configure the firewall","text":"

    One last thing we need to do is open the firewall and allow incoming connections from our Zabbix server to our MySQL database because at the moment we dont accept any connections yet.

    # firewall-cmd --list-all\npublic (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces: enp0s3 enp0s8\n  sources:\n  services: cockpit dhcpv6-client  ssh\n  ports:\n  protocols:\n  forward: yes\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

    First we will create an appropriate zone for our MySQL Database and open port 3306/tcp but only for the IP from our Zabbix server. This way no one unallowed is able to connect.

    # firewall-cmd --new-zone=mysql-access --permanent\nsuccess\n\n# firewall-cmd --reload\nsuccess\n\n# firewall-cmd --get-zones\nblock dmz drop external home internal mysql-access nm-shared public trusted work\n\n# firewall-cmd --zone=mysql-access --add-source=<zabbix-serverip> --permanent\n\nsuccess\n# firewall-cmd --zone=mysql-access --add-port=3306/tcp  --permanent\n\nsuccess\n# firewall-cmd --reload\n

    Now lets have a look to our firewall rules to see if they are what we expected:

    # firewall-cmd --list-all --zone=mysql-access\n
    mysql-access (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces:\n  sources: <ip from the zabbix-server>\n  services:\n  ports: 3306/tcp\n  protocols:\n  forward: no\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

    Our database server is ready now to accept connections from our Zabbix server :). You can continue with the next task Installing the Zabbix Server

    "},{"location":"installation/installing-zabbixdb/#installing-zabbix-with-postgresql","title":"Installing Zabbix with PostgreSQL","text":"

    For our DB setup with PostgreSQL we need to add our PostgreSQL repository first to the system. As of writing PostgreSQL 13-16 are supported but best is to have a look before you install it as new versions may be supported and older maybe unsupported both by Zabbix and PostgreSQL. Usually it's a good idea to go with the latest version that is supported by Zabbix. Zabbix also supports the extension TimescaleDB this is someting we will talk later about. As you will see the setup from PostgreSQL is very different from MySQL not only the installation but also securing the DB.

    The table of compatibility can be found here.

    "},{"location":"installation/installing-zabbixdb/#add-the-postgresql-repo","title":"Add the PostgreSQL repo","text":"

    So let us start first setting up our PostgreSQL repository with the folowing commands.

    # Install the repository RPM:\nsudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm\n\n# Disable the built-in PostgreSQL module:\nsudo dnf -qy module disable postgresql\n\n# Install PostgreSQL:\nsudo dnf install -y postgresql16-server\n\n# Initialize the database and enable automatic start:\nsudo /usr/pgsql-16/bin/postgresql-16-setup initdb\nsudo systemctl enable postgresql-16 --now\n
    "},{"location":"installation/installing-zabbixdb/#securing-the-postgresql-database","title":"Securing the PostgreSQL database","text":"

    As i told you PostgreSQL works a bit different then MySQL or MariaDB and this applies aswell to how we manage access permissions. Postgres works with a file with the name pg_hba.conf where we have to tell who can access our database from where and what encryption is used for the password. So let's edit this file to allow our frontend and zabbix server to access the database.

    Note

    \"Client authentication is configured by a configuration file with the name pg_hba.conf. HBA here stands for host based authentication. For more information feel free to check the PostgreSQL documentation.\"

    Add the following lines, the order here is important.

    # vi /var/lib/pgsql/16/data/pg_hba.conf\n
    # \"local\" is for Unix domain socket connections only\nlocal   zabbix          zabbix-srv                                  scram-sha-256\nlocal   all             all                                         peer\n# IPv4 local connections:\nhost    zabbix          zabbix-srv      <ip from zabbix server/24>  scram-sha-256\nhost    zabbix          zabbix-web      <ip from zabbix server/24>  scram-sha-256\nhost    all             all             127.0.0.1/32                scram-sha-256\n

    After we changed the pg_hba file don't forget to restart postgres else the settings will not be applied. But before we restart let us also edit the file postgresql.conf and allow our database to listen on our network interface for incomming connections from the zabbix server. Postgresql will standard only allow connections from the socket.

    # vi /var/lib/pgsql/16/data/postgresql.conf\n

    and replace the line with listen_addresses so that PostgreSQL will listen on all interfaces and not only on our localhost.

    #listen_addresses = 'localhost' with  listen_addresses = '*'\n

    When done restart the PostgreSQL cluster and see if it comes back online in case of an error check the pg_hba.conf file you just edited for typos.

    # systemctl restart postgresql-16\n

    For our Zabbix server we need to create tables in the database for this we need ot install the Zabbix repository like we did for our Zabbix server and install the Zabbix package containing all the database tables images icons, ....

    "},{"location":"installation/installing-zabbixdb/#add-the-zabbix-repository-and-populate-the-db_2","title":"Add the Zabbix repository and populate the DB","text":"
    # dnf install https://repo.zabbix.com/zabbix/6.0/rhel/9/x86_64/zabbix-release-6.0-4.el9.noarch.rpm -y\n# dnf install zabbix-sql-scripts -y\n

    Now we are ready to create our Zabbix users for the server and the frontend:

    # su - postgres \n# createuser --pwprompt zabbix-srv\nEnter password for new role: <server-password>\nEnter it again: <server-password>\n

    Let's do the same for our frontend let's create a user to connect to the database:

    # createuser --pwprompt zabbix-web\nEnter password for new role: <frontend-password>\nEnter it again: <frontend-password>\n

    Next we have to unzip the database schema files. Run as user root followin command::

    # gzip -d /usr/share/zabbix-sql-scripts/postgresql/server.sql.gz\n

    We are now ready to create our database zabbix. Become user postgres again and run next command to create the database as our user zabbix-srv:

    # su - postgres\n# createdb -E Unicode -O zabbix-srv  zabbix\n

    Let's verify that we are really connected to the database with the correct session. Login from the Postgres shell on the zabbix database

    # psql -d zabbix -U zabbix-srv\n

    Make sure we are logged in with our correct user zabbix-srv.

    zabbix=> SELECT session_user, current_user;\n session_user | current_user\n--------------+--------------\n zabbix-srv   | zabbix-srv\n(1 row)\n

    PostgreSQL works a bit different then MySQL or MariaDB when it comes to almost everything :) One of the things that it has that MySQL not has are for example shemas. If you like to know more about it i can recommend this URI. It explains in detail what it is and why we need it. But in short ... In PostgreSQL schema enables a multi-user environment that allows multiple users to access the same database without interference. Schemas are important when several users use the application and access the database in their way or when various applications utilize the same database. There is a standard schema that you can use but the better way is to create our own schema.

    Note

    \"There is a standard schema public that you can use but the better way is to create our own schema this was if later something else is installed next to the Zabbix database it will be easier to create users with only access to the newly created database tables.\"

    zabbix=> CREATE SCHEMA zabbix_server AUTHORIZATION \"zabbix-srv\";\nCREATE SCHEMA\nzabbix=> set search_path to \"zabbix_server\";\nzabbix=> \\dn\n          List of schemas\n     Name      |       Owner\n---------------+-------------------\n public        | pg_database_owner\n zabbix_server | zabbix-srv\n(2 rows)\n\n\n

    Now we have our DB ready with correct permissions for user zabbix-srv but not yet for our user zabbix-web. Let's fix this first and give the rights to connect to our schema.

    zabbix=# GRANT USAGE ON SCHEMA zabbix_server TO \"zabbix-web\";\nGRANT\n

    The user zabbix-web has now the rights to connect to our schema but cannot to anything yet lets fix this but also don't give too many rights.

    zabbix=# GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA zabbix_server TO \"zabbix-web\";\nGRANT\nzabbix=# GRANT SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA zabbix_server TO \"zabbix-web\";\nGRANT\n

    There we go both users are created with the correct permissons. We are now ready to populate the database with the Zabbix table structures etc ... log back in as user postgres and run the following commands

    Let's upload the Zabbix SQL file we extracted earlier to populate our database with the needed schemas images users etc ...

    Warning

    \"Depending on the speed of your hardware or VM this can take a few seconds upto a few minutes so please don't cancel just sit and wait for the prompt.\"

    zabbix=# \\i /usr/share/zabbix-sql-scripts/postgresql/server.sql\nCREATE TABLE\nCREATE INDEX\n...\n...\nINSERT 0 1\nINSERT 0 1\nINSERT 0 1\nINSERT 0 1\nCOMMIT\nzabbix=#\n
    Note

    \"If the import fails with psql:/usr/share/zabbix-sql-scripts/postgresql/server.sql:7: ERROR: no schema has been selected to create in then you probably made an error in the line where you set the search path.\"

    Lets verify that our tables are properly created with the correct permissions

    zabbix=# \\dt\n                        List of relations\n    Schema     |            Name            | Type  |   Owner\n---------------+----------------------------+-------+------------\n zabbix_server | acknowledges               | table | zabbix-srv\n zabbix_server | actions                    | table | zabbix-srv\n zabbix_server | alerts                     | table | zabbix-srv\n zabbix_server | auditlog                   | table | zabbix-srv\n zabbix_server | autoreg_host               | table | zabbix-srv\n...\n...\n zabbix_server | usrgrp                     | table | zabbix-srv\n zabbix_server | valuemap                   | table | zabbix-srv\n zabbix_server | valuemap_mapping           | table | zabbix-srv\n zabbix_server | widget                     | table | zabbix-srv\n zabbix_server | widget_field               | table | zabbix-srv\n(173 rows)\n
    Note

    \"If you are like me and don't like to set the search path every time you logon with the user zabbix-srv to the correct search path you can run the following SQL. zabbix=> alter role \"zabbix-srv\" set search_path = \"$user\", public, zabbix_server ;\"

    If you are ready you can exit the database and return as user root.

    zabbix=>  \\q\n# exit\n
    "},{"location":"installation/installing-zabbixdb/#configure-the-firewall_2","title":"Configure the firewall","text":"

    One last thing we need to do is open the firewall and allow incoming connections for the PostgreSQL database from our Zabbix server because at the moment we dont accept any connections yet.

    # firewall-cmd --list-all\npublic (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces: enp0s3 enp0s8\n  sources:\n  services: cockpit dhcpv6-client  ssh\n  ports:\n  protocols:\n  forward: yes\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

    First we will create an appropriate zone for our PostgreSQL DB and open port 5432/tcp but only for the ip from our Zabbix server.

    # firewall-cmd --new-zone=postgresql-access --permanent\nsuccess\n\n# firewall-cmd --reload\nsuccess\n\n# firewall-cmd --get-zones\nblock dmz drop external home internal nm-shared postgresql-access public trusted work\n\n# firewall-cmd --zone=postgresql-access--add-source=<zabbix-serverip> --permanent\n\nsuccess\n# firewall-cmd --zone=postgresql-access --add-port=5432/tcp  --permanent\n\nsuccess\n# firewall-cmd --reload\n

    Now lets have a look to our firewall rules to see if they are what we expected:

    # firewall-cmd --zone=postgresql-access --list-all\n
    postgresql-access (active)\n  target: default\n  icmp-block-inversion: no\n  interfaces:\n  sources: 192.168.56.18\n  services:\n  ports: 5432/tcp\n  protocols:\n  forward: no\n  masquerade: no\n  forward-ports:\n  source-ports:\n  icmp-blocks:\n  rich rules:\n

    Our database server is ready now to accept connections from our Zabbix server :). You can continue with the next task Installing the Zabbix Server

    "},{"location":"maintenance/maintaining-zabbix/","title":"Maintaining Zabbix","text":""},{"location":"permissions/managing-permissions/","title":"Managing Permissions","text":""},{"location":"problems/zabbix-triggers/","title":"Triggers","text":""},{"location":"proxies/installing-proxies/","title":"Monitoring with Proxies","text":""},{"location":"security/securing-zabbix/","title":"Securing Zabbix","text":""},{"location":"visualising/Visualising-our-problems/","title":"Visualising our problems","text":""},{"location":"vmware/vmware-monitoring/","title":"VMWare monitoring","text":""},{"location":"websites/monitoring-websites/","title":"Monitoring websites","text":""},{"location":"windows/monitoring-windows/","title":"Monitoring Windows","text":""}]} \ No newline at end of file diff --git a/site/sitemap.xml b/site/sitemap.xml index 1b41e1c6..5e922753 100644 --- a/site/sitemap.xml +++ b/site/sitemap.xml @@ -2,152 +2,152 @@ https://trikke76.github.io/Zabbix-Book/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/actions/zabbix-eventactions/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/api/zabbix-api/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/automation/automating-configuration/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/Dashboard/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-agent/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-dataflow/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-hostgroups/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-hosts/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-interfaces/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-items/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-macros/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-templates/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-triggers/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/configuration/zabbix-users/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/extra-monitoring/IPMI-monitoring/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/extra-monitoring/JAVA-monitoring/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/extra-monitoring/SNMP-monitoring/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/installation/Requirements/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/installation/installing-zabbix/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/installation/installing-zabbixdb/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/maintenance/maintaining-zabbix/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/permissions/managing-permissions/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/problems/zabbix-triggers/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/proxies/installing-proxies/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/security/securing-zabbix/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/visualising/Visualising-our-problems/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/vmware/vmware-monitoring/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/websites/monitoring-websites/ - 2024-02-18 + 2024-02-19 daily https://trikke76.github.io/Zabbix-Book/windows/monitoring-windows/ - 2024-02-18 + 2024-02-19 daily \ No newline at end of file diff --git a/site/sitemap.xml.gz b/site/sitemap.xml.gz index f32ca412f6d0c476a8331615f0fa286d53828f91..d55c0a21c37692aaabe99434536b1cab82d3e711 100644 GIT binary patch delta 507 zcmVXc30{Bg_u}2# zLaNaAb)g*l1$C{C`A6sWtYm5Od@W!wuBkTb&6|9^$**tXlu4US<1JVzc3wPJ4JiFm zvY9eMu?y8d@Bt6;?2!E)HE|F&oVCTXck0ZY%*EsO!5K(LdoiudxwAVZdq3V-x(}~u zKLNJ21K$wiJ_n7A!A=vsfdGFy?FO3kt-~O_>pP^&PZV9*Ap8!vpvoU}Gf{K{+&iM| z@zgsFfojymHB!bhktThQ6wt*nc*u>jDmWi28+QNra6ccDbKuL}(;aCCzJGmqq~w6I z7(nYW_`iwgUU^|+jfS+yr$MUj$0wLLep4^r0RyS9v0%9v?RXJ7|4wUoqYzJD-3Bbk z#6A}n?|^r;PL&z8gd4$+DwZ{~pg&7XM@PYXufoe@(24eg!XC83l#-tQ+PUj}ehH+- xJ7EU!V(KU**+JCl4`+PQT$uBVws?4D8#laWpQQhee(F$!>JR^%THSXR008{O{(=Ai delta 507 zcmV|)6HyEu`E0yI{+=aq6-r;|KFW$W^ zB>J|m3$*MP)HNRSkJj#4$>QYsS|G1&Q*G9pH~D&#U*Ci&lQx^iTQE}WoOrGpK=o3x znKDAL3)MgH0r%nTi2WWlaS+CzwZ*e{c;=4g;&FR#HN>O6m`3K@njOmCjW?F=!)w}4 zKy7WoHHmSbgGPp6PZPZX4?BNlhcxM1OI|wLca$!FqUdP6a68~4RsN8h6Ghj+olTTI zoO-9gry4b3jg+BGOq0H+6wt-dJIJ*)=&cKt4ZDAQxSx-cbKuL}(_PXIeE<6Jn34l% z$b(X2@P8A}JvyO7jYesaPlH(9k56#o_)Wcd2QJNq?ZR~dz002*#1f&1} diff --git a/zabbix-7-book.pdf b/zabbix-7-book.pdf index 03b7b0993da17564968aa5d5099b399b15d34a2d..6ed8eb4e01b48c0f4de78c3f3f1be7c4fda6f6ad 100644 GIT binary patch delta 683080 zcmce82|Sir`~NJ>(mGR33oXo)Ha$G6=OOV%n>Dg!AA88opm4u46HO776k3d?ED6&h zJC!g+nL%kHLNQV#m7V`}?&Vo5WoF+0Z$6*qe$IW)`Cixcy{>cavwBr}{KK}epFjLU zN@wF{8bgLVP3mRbv9r^TAGVa5i#gbN$!a*-dP$nfNzx^^OY-plGZ-A=$&n|XTsrw= zkxwr1vokV6*akOeuUVk8qxIl^M59Qj_3 ztWPq;S<@? zjdER_ZQX3VAmTYPthJJ4%EbzbI$G_b$-`^v%eXE*!QD zYqdZf#4x3fzq_5Jtg4l_)h;&&Ssg2AKa#j3WViWv?{aj7B%4FL(6(}c6qvBl&dVGB zLA)_tB_pd~@2bF9Eoq7|$as<6VQd05W!P*vHis)I$6&~?nR0aG6LU$Tf~TE5UWY-3 z8eWCLWXZ6&JQkZF$zh@DJO*+sQD>){FU{MH=Hq2Y^WN#`MYBfiNty})U?!3*t_)j_ z5Xu8em~uRUP~V+a-ZZGluT8VEcJuK@7-W0El@LI1Ir1`cOqSdz2sba9tsBje=4xkW zD^eK)s|B^0EVc}r&c)jhVF9kdcXpm$j&80rH+$M{JPeRZV3aM*(N&?8LX5~V2T#Zd=2@9OTWYF2jKS&n^5xqs!9)+*Q(c7WM*{H51b3{wN0`ET9Y=XJEu;YHrhF>uxqM z)>PF}H`qb&MRsNHS7~AxTpu<@^ogT^M$@zd>0zMFF(F;aGSV>C*VhKuYOsw74-%dB zXdqD!svC|5!bFh>*NqSLex39<8`Un!xsSqrV?~eDeI4-mR znP7EXXlzXAjrNcx3dK#@92P|<@s%BI{rglDh9OwQaWKizK%z8isF-Y#GuGGAGBncL zV6t)Zw(WXGTTtJ|*|C9WoZ~w~RGo=YFo40;AqOAt(MB6d*VH4r3st7p=IvWHF*S)6 zKn^oTBaG5y6avPFAV`@^=xc1(H8LW)g)OSaECbNSh^@A9hqj6ydg^Xd-(j?gwQ;ky zp^4rGW0sD#p&rp|kOM1W4KeuEkLvsX5j?@+o@Ba#Jk%kt9DslM18>U~m+i19EUW z+K|!O80>&JQqkUy!4I;B-@w+_(NZ_sqQTN6zdMs@X&NRJ)C5R`XU2!(GBDwRiKe=) z(I#Vkb)5~mn^X-{)$s;K&PzrcBpTLZYT{BSs4C0_Cb`PW#v2A#Ub5uS3Js#Ysdt3( zBnX)(5F;`g7M2437u9d0mDf&dH!DxucQ$Teh<6~s ze8}00=3?jS1L{ySXAy5>(ESO=<2%4ytYEZHVU0igV6*8m3=Tt{0TVFr$Ap%-!HnWN zM>}7d8)gp^2s@ZZz^u^T%Ek`qDclzVAWWF?85vVfhRu*;knuhtwwJ$`w;fC^TV!?7N&! zwJiteJjf3^v05-%FK9e+Z2nZt1`}xC6wc&2#d{DZ2}pz3^zlRUzlm_c-wYmm ze18k8CaWNvqWL<)5{9qW#0tyFb7Z(&IsrVU{gGIO(<4!j(ZwF5|A9pW;NOEmV5JKeqZ(;@c`Uyj!-!uXjSv>}om{d*%6ayqe zHzv8RC(v#3Ca#2^8(YM1j1m90-+&1xp+V6Ckm8JQ*gN%bf(0FfKUYUr>kf zdwwcH#_y;n;Y(p8!EZc1CdR~s`oi(ruOoa*NX^J~+)QwK@Ua!S>^(`EFnqK|#*+{d|0k~7 zq&{Wixeu179UNfw5+BKv3-BVEq4CcoJjll(OdNkeJ_#IHGzDc42)R!&cKkbe6q}t^ zt`3ec!bPJKl0q*ZcRNp-m8}bm)!ePTynNj}(Sk3vD~$i8U#*AoU=q+BF|+*lbUg3W-1eh!<5de?C}It=Y9;9x+@J4INc<$5N$ zDKkn4lgpHW?>RLW8n+W1-waID4ofC3gxK*JEriaLp>yaQHmo3zV~MaKUf!N|t`6W9 zv^>uD4doA-yW1{D8-JWLOsFpw>WX0w1Yt` zIVxsMu-7F5@-7TmbaJ$z!TzI2dj|CgWZ3^6r5_u*0WO1_o=Lt7+8#9Z1=aarB$l9y zVsl|b6?SCF&)YbrVwA0(LY9vP6!cM}d^8Rqh3D-Eo6oSyfj3JL76s}tnQ|DkY5wO| z1ddFgFD}uI5W@!Y9L6ZpMzyr}0a@AFlH&%98aQ~`xx0CxCXRoX5Mfl$Akde~V9Ure znJjdO1bV*rNfEL@=qt!41wTsi{{H9RNTI|6&yOSwFb{JMQp?P>r1e0 zFGFX^anQ=vzcdaP3v|NN*A8UkLdX3uvsjoM%--M(!QYihgaktVcL9On`}r`*Bzgfs zw9)K6-C#`$x)WbV@0~O&cPm&AK=R1*Id}jHLW3m->@m4)axgGyr(sldkCKN5wth$) zdB|myI1Ym@BgcWG7L(%5%g!4gx%#+M(Y_NOErBWHt-r8f$SN<#p-;*dTWh>sGRV_I zf45y?yI>uR;s9Ym)5OP&WWdr;y96FY@CCHX$-#0SgTo!KgB#;g5qQ)n030LG$>U+8 zSY~r!2@Z~mq22cPHVI*LLF`ldGs$yiqa?5}7);4?8I$W$ghh};D?zt~fBM|r+u=dMDZ#|BlssfN%4QCT=0KC@p%oh#f4sY`{B4_w zDGYfSZIo!1JY7bfB`3$_ci@=d+dpo+P+x6=QQVyXvGx9m+&qE zVS@lR1>ie0Nf{G~Kyy8eI_NltDHuM(L99uKK0bFPSRx|?EvTX`H`IE`A}=7^2??$}z>_(KGdUQcKgCb~vKDoc!Dg)}GpfEv)4m&8X6`dEw{6-*>abSeIy zOG4c(9tfkBjxgfn9|xQz2b;N*CvFUH_-9(s@q#dsK3BjVo57Lc(8(@$QvHvYosAEg z`b`*itq-Hc=OgiG2J-1>v74k)VSHKXz0q2SX1zE}J*mE=NIF3I>ZY z)HqEzz(u$dv?SQvl;O!SIk4UU7NH$M7$RA@+StkBzacI7niI>R$fK0b0w3__5g4&- z|30L#=-^-KKrh~_jDt-;3$5jVlCDngr32A<9={sY8jFRX#(RrY zod_NiImF=Z>1MqPEx40isOYk*@W6dyb0>tLz;Jb_`HkrLSH4?F>O9^29ARBssQUm7 z@mIu31%)Dd8g&$B?*MUe!>DByqDLa(apz73oCsxae_4J^6U>pZH>$HC`Wg`iv+CtG;ve^0C_G=ml*-)===9=H}x`!8KjUj>4O4RnM4=TQ{ySnxX)ah+HazC0w~Lo z1~XDQHY{hcxbje!E5~9oB-!%#k}~AV!@@aN4z9&;xhx)BHsQeXFq^o$0=YbSjyzqC z4&!nDXj4Ooeq1gZ?fA+&bKmFKX5N)RFsxp*XjTsRuSK{Gh0Bgca)3vdw$ zRt1QvU<(~cK)aw^dAdC8RDj0B{w?5gpemdzk&|bzd1(AEN7N;?f(b90^K#_SVIz4k znF&&fJ3BxWM-JAy0e}h8<>Vm`0h226Kp(Vz1T4bJ9tUQ%U@UQH2Bfke8yo;M@PJNv zn6iVdOrrhEI&zr69K;M0E|7psu!s)1ly6}JjS1s-5G~IDmblp z@Q%xY{Szi^%P=`|JeWR0F6CPuxLpo*_So`lHird{LYb6K;59A_T#NQ!;Hnh_A6QFV zR03eI6z;jOp(Y05#DyQ=big3I2R6zfe^S5M7ov+H*>ghz%8A_VDTVY zxu6h=bv$NZw~@=h}#3|Kyb6^KoVS8frV1YC3V^kr&{$k zqjO^5MnV?x3f&mPIK=%n&<_5CFosP(a2SILl28RwJdMp|KxoKAX*yUZ2VMp@f(~R$ z0S_|3Iz$X?wZiEV$Rx!hx57Udv&zwVP>2B+-ypb&nh^icyFop;X2X>S&g57qm!br3 z^3WmB+0aWt?|^RkL9h{Z*`Nq?G{8L%nGVoE32_<@dM>yc21oi_QP1TL?};l@vhHw8 zic83L2X?tU499W@p=db-n!P(P$0OvsLyIP67P9UT9>kPW)*VzJyC!#@Bs3+Wnmqg@ zt3fXyNA?8nutEp{Oca3*K#pvy?hKYBe)9p=pFt@$B&f<9N$4HP3Uct9stmj3WPrK@ z2rxsI0l{PlxkC$pWkcdU^vx)4ag!jBV6l??4T4G6xTEv8(0P&>Aedqalz|xy`5tZ4 zQz6s1F=jj(kj|TR z^N+G)Grs=)_q8UgzNUMxIv464eJf%0@*ylK;Ke|6+nI&6m)72DT|8hB_V|T(ApN?n zVa8U)ypYTf)VioRfocLyW$jQTJzF2KEud!D=Y_2bT zQBQiR>9c3`hJW_=7|rs!GkX~~F<(XMp7w>EXFlyM^vEb}TwW)3QM&b$lto8Y+p?N8 z4Zbumtsav3=}m5zSg6#uhc^dHWj`nv_f2nXscO!Y#Uu)IzRT6?4Vo_b*Q30edX}GZ z-?b0?p0h#+4)iF##lqh#?)-6aXVA?@t&fe=nf1Tf9@%+*m+hSCPc{ZKjeo4vPE;)` z$StY0FnE{~p5eM{VYgR={1%_tmw(QE8NrJ&UQ*#@`|GgL;n`l|Gge!P%~*N)(HX;4 z#nx|1&1XdU%^ARki;9}7g65qt^%tx5OuTfhYgxC|bH{y;59uy?vUz_QS*UJKa3#5DObLcGk(xSd@F|n(xlkV;9^PD7-lM zAfe^AqGKWL{g;M+uJwr0)#y*v%sy8}Z+!GPaW+dszIltXL~XX>vfjm?4sUu`pwzrA z#Vu$iyGG{nbMucc%8V4b_IIv*A$#`NEY|Vs?r_-|f=uKZC%V1~Jp~+=@Fp*DYN3-1 zDsFy~rYIsga8wgMY8-inBz&`F;9Czp6}qpArrmI*6W{iSO-nDBS=gYPpLi7Odpf#| z3jtq!K8DIJxC%LLDM2A6rAWn(=oox7gu}c1kyeDQ+HT9fz`z3*({*kS6t zDgNN&4Ij_>fgZidC$c(W^?zbJzX)5uw5{UeZ@0TE*8I14^=zpX>x0^?#AIE+qjgN( zGu*})Zf#I59r1Okkgf5FD}9?-I9#@Eq&u(Xjt#J6Ya?trgtiJttcNZ_cds{{8 zrGP)vv`aJako=b<6xk=NMBqvnglPb*5BJBI_pDjEap$^tQ3ZIEJSt6$Z3 zL;gd#$`OTumZcfAiqe9`?cGV4b#IRa-Ye{`QFd#<%2Y@020du_bGR#0x%Tblp(U8| zK$=@$X!witk=Tl>BZIBj$RIZSx@V+x+sHt}NK;B*PT_@ipBJUQPD)EH!=L)Q#VsAK zP24BDbolk!s^;|cmd@c*GrA0V{S?z{xOK`y-jT*rR%5pE$$z-k?EZB7FH6$5S!Ef` z^p$9^{l410XV284e5b5Z&)|p=gQE4}w1B~M@eV)7nGz$pA$tn6!WdY31t&kH)$mDx%&qD}$4j%N^i(abasnPH9v6S*S?~Cp#!UafjyAoE z)zLM9YH#X7xc&Jd0WXaD zHJ@{ywAWWUSf?`@+F5~bo^x6TcvaEP1+^u&zYYv=x>38dIp)Zpw@>cr*RMXxwLkOP zDs8pfB8lg=PL;JK+Zi*n?ekrXK`Gs;`m4{kK%u-$nvF-a=0X1@>3P?y%efYYZ(k=T zCA-xwtzfrcu>)6K)&u^lMVI?xmF951r1X|4 zy`>$@vcL8sOQMl=v3f?OhRyS=WKOXy0PbrJ0fu0vX#lDCOJ(qB8$m1Mlc;~-1!TE__*UZRL zj<~`$clva3=_v0eR4o>#5@f!44!Rr2eT8d1!~R*d-Wdg2st=6h1uq=;=Tv{iEAXgP&bPnjvEk(WWDTwF2MQ7mP`2bAaZj!9_t1)uB!7)bY%xic z;e683x-3->spO^6UX2t|tWxkvUhQ6Z+VK=XWm%dM#hPdCuRhc%rS(1FHUDz*K8_oh z=!0;(c2uG|Fa2)T{22RTgvX;pN^?0Mhr2aj(F7wDOHQ6pQiOC$C!St>{ETBv4pu#b zCv*HhyCwF+(gjXP#%JNhyNIWOA@Q`^NIa*?6r_m18s6Goosn>@t10q+vNI@=`%S7| zP3%Xd$2ae`GIpM}*hU-AZ_WZ`Qdhs^#eo6$zw$e|Cuf?O^EAb~(s=O*XEnSS)~qfa zmtlXcIVXLm({DYoIA&>}Qsp5iD-m%;+Z-Tej}sV5ck#4hTm|{uW0IK0`Q&s3fmvav zHed=WwH{GY;Cy(xId>&Q(5H%}g*5zG(|n*aWpmzoq?g#sy2_gw_ow(_uB~EPGySmy zyJseIA7{G(CHJTB(r#BWeNv~sykK5o>r~Fsf~KX^RNrR8dhB0vrwY_%I3zkc0!m)f zTl{TtdV1^!744d3)sWd`9(nc4`>`KZtaFV|<9vMDw@%gE`P00m9&?f4-8aoqq4wFC zx;3#MVx^Z>(sn@MbcedFsMN8n$ejB#{AgWq7IPnG+{{O1oe!Q!Hof!Tnw)cX&kR|Q zGfG}mr^4INTKw(&OubB~PjgLl<$P?hr%wA3MCuobMA3$}+q+W4UMk%0O>_Ef3!ayE zH|tc+y%~O|Jl6T7U}Em&bHQjxn^*L*IZvcJ5?nbSS{T)7J#zXeuOsV3&b=u-Lorlj zir*s-u20HT_W<*=fIj!}(898xY)hg$9T4ucyf_57`ehJOFX5WUhmrLLcmCTm2dVc_ z=SA&^3h3IJzk6n=_c)&@vgcqemTao^eGhKJN1eC{pVSX53-Z19m0u?g=Wg~f_y+0( z-gK*s{jhTxGV_yq+>~i~6;d=D-3$6NXGkK;zT(ZlkJSCj&yrB6fDoD$rd@^<8&IlZ zS}%gu8lN~j0-Ngo6I41V_G^%2%(3L!=npGOS+0rU(l?nE606mbizChB9^Ta0a!U{cAC6sgTPz2;ya-INP9Y!GCiAi(gddw_IzTm#Nni`*ECao%VXCSpoHqf&S1v%9vIuU~iJ--Tg20`G+$- zjz2@cAvAtzxpwgqbR+P5Dwe4i5&Q9RDc8iM&^1N*n4qUjnNK34W--rVdX)kKFplus zVm{OVU~Tf2JKvW_G%j;=O>~r zA+EID*CZLqaj4T-?=;6OEh~O^^>SX?%S!b(Nowxd%^}ZpBOiMvX14=WcEy$LNPvWg zDnbstIrAPU{$@5;AG9d_D%$WoDAmq#O#;BQigl^zb&Z{tZ_Z*!W6D`eGNANlJ-^&v zoK>=Ddjxc)4;e%u8eS*7^9^fecFQ$R!%<{FOD>f8xF*09=^xvv0iqYDdpVv%dEv5$ zpeKh+XOt=4skPpDnpyXqWQRN7I~S~bb3xuczbWLIvDaf0EmbDx$+{!4*he)1d!8BV zJ&twT28HWhy-0S@`rfo)ea5RWtEM27^VY0;{R52{pa3*{I-pk(`*CIfhER@mLY-N4 z_pkh>09Eg=r|DP3ew5jDjQs>21ne_c+DDfjtr+O_T#~Ll^6HDiBx9xiliRe)3~E29@p~BCaoXn6h)Gs;MXd7a7Y5m{ zM~o#hKkTVF{<7b0&#uzwHEVqODn?#53|A=+anv8^d}Z?Ior>NA-a%N9;#C-!mqZ?H&+qz=!HRpS0fX5~_v8oe-c?%~ zcRXU`D%RisKyH0dms#1Xwq@N~c9#@O{YvJQ^~yv`N47N<2JZH2Y}{7CTt9qg!Q_qpF#sGOs!I!)^M^1}7RUs6l3I8OixzNMFU$l<6ej9vB#6(%T#nvo z(WGOMjfCMsjwQTJF*Pm?pbI$rB5BQ8tM*twzHv zk#-~$ihP2X*J(ePK$^hLy{1fP#A8~vCPuVkvW2^wI`dmK*~Wz&OnSXzW(P$%)ylQW z9)M5CjiGxa7yQSVAYESfOMMiET0&A^vF@C}HN_Fqk)02fH`_4_TnnBLWOej&!!(0l zD)ltfMF;G@AJ)#3gW=HWLNax;{}@5hAPEsA3vuDMfIsA$q!)!bnJ zO`aBOwv_ER>c4F~>b=6+`u4`7hxV`fdaka@iZgpPZ~k^vkia%hjrnOdbM`!gw~cj&_Gf)P*F$y18T;EC>%3PqLDiWtKP_U;=IE_x3ZW8Q+i#o_@WhF`8&BeO zbXj&d0KZP`YJ?-GBLKjNN=Y%y*#N|sN+A#`bl=^muZc_Mmx+#Hy`uu?4Elj(pe#|P zdQ^Q};HmvQ47U(8+j!?FX)dWIsdEBr_DWna3IQq!SfMBq1t99!w+K-LmQetNncgeT z*aEHC_y`2Mv3EC`3Fia*b18$sJL8h3FxNwcVtNAFwH&_D#@!1fViU30hVv&tAS#L4 zFj|E+&5gIlXOXZ6g^n#Ln+z=s#g?#*$PNAu-^ft$$6!G){vD&nWraW+Z4>Z`O&rc- z>?q9DWfI{`sfo7-DuF!jcIq1;*2h5%l3pD16Tf*-O$tF^RKsvvxt#hb(#ZJE>ZQd9 zH4tHpxgJ$`U=*fCy*uKXdOnR53UYu}#}Y)V3=TU9MHo0q7uqeq;X_*ricr9t6|0ap z{Y*quuhoiIfdil2+IYX!*}-M-99E?Lxq8kD z2IJmx^(3{UI+3g5SLmu}S=*i$B+l%Oz4%CQ)&u4PdFYslc}vMV11kxGN*7}cxZXdUa@XZ=Lrpf17 z&@7QoSY%ck9vKby)!!X)U3-2^7IF_@OA#%X-%Ntw0Dx#qgka(~d}vCATTbDvD#miL z*dK}82D4W5VQE7@RxckIekv|;gJBTBeV!F`JQnp}gD*I@pa+Y!H9M52e%RyG(88M3 zh!^P+n{Evc_P_0FeKBluda${);nCalk*J}vnmJF?C9shr_oHk9pcVN!>c~a)7 z(b4eGmsU?QJgSqrD&B;_G!P_oRWhviI&J!dD2$g1E5CPO(fN5?eQDPu!#bVRq!>t; zr}E-WJXAB9LYy|;(NE2y62&v`9f(cFa}rYKVJq=U)tUqXRSEh71jMf-gaDPGj#GjY z0^&=h00|2Bqpe9)X6DSP|stDELi~>LswTz^-aSK5)U6ui9E}QD-=Z(07k$Om143h-tL`0`i;JFsMWj>?qE85bs3U5^Xusu{V7d@nMAV4V$X5Zp zOvo0BEnypx8|v>Jm`+hs4#7Bin~?vAwmSr*uTtsEJi_l05%D-z4UaJFNU-^p~Q<6ZTHeXSR41M3tOmCFWu zxt1PPwQHq4DvkF?-c>)DcX`e{TPbY?{tIuzGkY)GRC5q|chuXk>CELhD^Er7+VCv( zgbT~D=)3Aav|U(EJZ{c3hSh@$%MbBi)*XtPQUxzhQID*zrKcubKJsn7v6>|Qa{r=B zN4`~%p4tMbO1vah1YV+&pp>fN98CwQ>)wWQ%GXIxJ$rc$*A`D{I$-2e%JnxPJ(fqO z8}FY^;1Upk1m9LZ41v}ZLMcw^ujL^1JxC#i!DAHcU3Fwo_g(dmNSiUB0vXM>53HTo zqA^Abl;c|@bv^I$k^d-2!xWmb4H-UG7hl7sy%#W2bIO1*x}5MeoU@VOjx-u%0z64A z;zdZbK#;#M6Jv=Y<#c0wDylUnpaI!P7%t>k!rK&6Q>jq^;ofEN&J>In~N}WDme6WNMEQh$fyK%kGv@CGg@|y9L@?G@; z=aGfL|4`m=_Gz10gF($*-JO3#4gPhizEFN`-(Xn!r6;ZFpT(WDEIXY3+0k8{l}~#6 zd*8lsKiVDmv)Y9%B}N^+O-U+$S(f@;VF*nIXAL+r>&eBN|;JYUIuwVbr-` zF6OJniXL^mm|gNJAgrsSJ$uQmun#+H+AY+%HaDB+I0mj@g(wyrzsoz#XzA_?Na#{5 zjjjl+t-}0H+mzb``JY8E(qCksL(kGD9>rZ@jE1s|vt4U#%6(sWFTWg=Y?{(;p~oGd z@5%o<+AHr#`0=aKF?*sT;-;k-#}x$(uC2VYu-nhvtkUm3qvdIHqKs=vbgA!OtZ;`g z|A50U92IL9cK3ep$WgKRp2wo9*Rds+4>H`Eu}J(!r_Fyn6m80zKN{TH{AX!&%4H4o zDBXC};z-=U!tTDTPWI`*u)f7*5y$|>6V}1jg*F9Ox9m1vDmzqUmOe08hxCoHh>j~= z*d17qcI{D}{|+q2tlsm+oESI@2XBc6(&Dk_xQ0aq|8)~xUWzio**zK3N#uzb}n|rgd&cJ5r7NqZ*4>i-vY_9h{yW3Rt z{GLL-lPb40<=0ykUPhO?a%TVMPW143sjZz(Ksx?h6c=*kzIjQVk#DSGrTa4@Zdgjm>oa*_ z*=}Z+UAs2fl?T3wtb1*zkWk=t!Lezjw`Sm*WhtmYa(a;VC7>+1)2wNa_*}~upSk^U zGGnU0xd*$)8Ebb|`$ddpd1uezYJ(0RlpKn1$f+|g zx#??Ic^EV+xZH8%rwUd`fNKvV6AHTXYI;v`kl2E^^wS=JO6C5ESdBtULHF?18Wa{1 z`A1K5mt`&8GqmH+JL}5}5;XdJG=pkvE__zyhm}0>U0>?70^%d6W{2Xrnx_{p^m`sm zui~J%z3^>S`zr761~+5 zVZJ9mz3laEGq;7ZYfN*_T9yv_9&}uv&y0{wd$>2C!$YyhS%RL=PPZA(Epb+X0$Ax3 zUcr;NwsZbV=048y{Ig1GNMXe_=YY>EP@wPee-wJ&zWl#6fzR8H1TA4bUO)dEU-63Q z4?9Z>&T8~`J>`_=TLS3uJ!Wd>H2OVOGs-g-gQC+GkGx)HUKwGOXcfL^TeFzg<9wy# z>ySl{BA_Xhf8Vpa0RehF#`0a9cL!ROuJv=PIV{swYVx#f$1LTgs4)&?CusEhl>gAf zka4Z@D`E32c1u8|REg=;2ls;z@x0Q^S93~PB?0vjz5R+U*DoghSqbX5Tpu`ZEE5CT zo6S7e73Tl4AcB^!WVEYmq0#F$lRWFthnKgdSIjdF+xFM7G;HshtA2_#?Xye00+Zw3 zoVD9oJm2O_T_q>5cz%RO+p()=(pUY$rn1bdjdn3)6yG{5u2|T;+p_IUfm3Ly-0%qd zv|X5g?ptqT%ZyDKLylz`@Y+K9A)JaSJ$eKxXZkH3IF;58&yx{SpoJ?#CKyVaWEb0% zXPGXpz!r9A$h5`&>=|0hIW`sVq=xdUf&-tQd7(cU5dd=v2P!+a4 zySRHWD^BeWCnO+f(3;D&`K`6|)FRiCL+PA?pUiD;)?_O;xtAO&y}iP`*2slXka4=J zxX+@Xx^tRl=d=1x#X?{147cidDz?w-AUABmOZv&%v||qaW(K=1hK(Gzh)KD+a5|Q= z9@V`VR+c3dZXf3NsOl+JJilyr>5}#Xv=YBg(D`C<^ycOuD|lOQmZOz1-{zyA_Hgc* zgx%|il`~7p*kMt)V>$F}5!*{|E$nK)d)&6)O;PikrC%PFd7g4*;qj}r;&H7DTNEo$Uumai zs$*bsp*f}fC)7EcwQb5)5A~o8Y1X`f*Aim!k&LE`cefsYGtcBgZI<=6A~C&&-jC|4 z>;i-5H=kdd`sDoOg+`HO%Vs&u@Hdl8T=4YS+7g4uQEAUoF7K$oXtbqk;OV?=!J8=K z3-d;b8^gY~^y&1W+dNyeKx0o%Qu@k@59sV$yx|Jh0xT>0^Vuo=yvS|Z|)iI zvQde!d}-5Bd%E?o3}8Mu)_Ur#89dL|hBk}YSV(Mn=$(4kI^Y-O%1xk=%^KsX>0ZI} z-|TsT(%5{PKVL(9l|=V2a-p^KxvjOWfDRY6tYf}PXn(3t+qrC&&=*-1%b*4K z)t$zZ7oXHtrfdT|1*Ixyuc-NN7PSFh)O^!oZ`62ug3g8Zuc4JR{S{+zGUdvH_8R5H zF8FG#bxwQTWOlCD;+)yy3Ql=8mWYbI?K*a)&E#D14ym<{>mhf?htD0WGSovE`3-nb zzpvFMnytAO8c2R9z_$)CJoxg2pKJYd4NI$-DehvDco1flraA~R6 zOxCeQj*13#$|bfjC3?j}UV&#r`<-adGBb;7T5H@M1)birc-zo7?ai|-<2q|(gX=-R zjQPzzjbZ5(Z!{cAzL9jvS(4kPozPYBirhbb3Xlnb->6j$Er60 zL-kljX_QQRMNOyqqI6pi#W(B9JJy@uhsI=oUD_qb5E|9pW8UUiK~Q`7r9`co?&i$9 zW=0@dE~NE{MI5xCkqhh19~ilK)b*UQh_lQnwlS>?9!k0DXI8o_yfw;A#pw31D&tnfrk<>W--LHmyyG!7oa;Hew*eO?vP}3 z`{J}cOTJ+B%vZjN9eRA`>IZ2qdEX6oTrYk-yYKqCA#pRsOv~BkdEqh(;~IxfIHax= zpWYwwm-PUzpn0Bop2VJjp@xcd-ICd=p+n8DJTDwp4xX<#xcbV2inhi+#WPun~@O*y4U3F)?JvI%MgDgk^w91{Y1PLT3b~TxELu=oB zZGnU(COo`OygdNqsZL+8mjsRmkt?Z0R@?6?xA=$&swjul`NS;RNf3;YN-11%SD|bZ z|62$oKz)4hbjsN3FG=kXS)jN2D4NR4`7~jZ^h^L}sRFQZ2 zo*L`6|Cu@%lA~}%hsh6&w%>0+u#tWzTn37u$Rb^a``rqd{e;irKLCga0FZ+b{QMIY z@X&i#?8eAbu{*I-Fn(JijU@H?zX^-om$4W8<^hC=G`R7V4l3pHX%|+~KFDM6KXJA% zrBy;Zn@22FL*JA&D=J@o;Hkl^ZzJ0%DuT$9*vvW?7v z1VAT&22hMhfE*o`0hMS|FPh31kbp_gT#1)M2q%2cHU2;Wvq0otD#0~(TqS_?Mmdzu zRZ$^x`8sJCiEHBuAemsmdjT-uKm_4VZl(JM%2@F=q;`m{Hg(loqiBlB{O# zsh*3sKTmn;A2^ETMHw=o*RaXDZ4&AL`RanWFn8n${EmB!3M@X~5FS`LF#9vb;y*#C z)hA?oQD<)gA`KHX zYqE`(%ifjw%jV0VP3O7-2R}<@-;LG3yJzrRXUm+7mwyHw*KGc*v-gqX;=|j}qda7)$^3uq_wej5C-&MQ<5a(0+~?{fps_vWqLdqLR&Law}@o zUlgR-I-Qd9V^<4kxt$)DU*kU3Iy$oa#IX+EWzbhvZTe+s`5 zm-^eXXz}i=yV{yB!-cr!!%Fkooi~^*(!5?B-NTvbkot9}kE#p3roH~rdi+LQmbXS6 zb|5t*;G{#p{w~gwi#IgSh6LQt*SKDdW{@MV;YJ)y1HTdHZ1xGSQ{)fqFvT3ON$+G5mn-3+F=4#yeZ>{mbHZZqh zS$+r&uD`VgcHXLvZa?-r++s3{I^zmg**Z$2O3YY~zjJfcMfb|EM@A-5=>D0F9k$#n z>d&eiZ@6`q{)Bz#;dwt9xTtpLzXRP{HLA|pU%Qy3>5QI3K3`lp@g^hR^X$F0?X1TI zN|mp?lf~REGp{J2J9eeEKs@J@aJwBQ@d&uta~0g3n-&l?UMP7 z?IGqnBO&2h{xR!YdEZ?OhihF<(-to{NZfggBksI~msR5L>(U+2J+x0cYL4O8-qNpr zb4dJE{@K;;pmD%a^1fUrURH6b29#}ezDzGzT0O&0Q35Um!A-YaRW|GM&n_FiSsnYOsF6(i28p@vGmsUEj!RVmhp0hsBOyKRg{V74`?nsWl;bvm`xX3K>@aNLldQ0Wq z2P`e&vRn;Ze#*GKe!g_YmEd0isorBcx~!JhywquE_~+)`H?@dMYrg2xTKbl{&2U$3 zaoOoB-x|Z6wbLHUP+^lM?Pt3SgKjJsX@eVN8g&}zKHL4Q7?Vx6=%ywKhPq76I_=am zPqMCNo$Bv*EXu&(cF-F2ko~pE21ggyEX~wQStYgt?suh2obB+y(K+Udi)FbG<}YZc4(nJrT9ZM7fle@*T^9 zB7r~&fb~4me{Py%43yt-P6nPJ>`my|y6Ug|;Hn%5#hMGiGSKTLGAw)`yf&G#Osqw- z?5An!7P|lW(kJ&fxb$YYZM*Uz%`&j;*{7GTXyW>xLd>@PXtv>&ap7my$CBqoos7t7=0Rt+ z#8*#xO|oVGoVbLJn%!_O?ST6EMvXFfAid^Ag@ty#i3w4(zh>2hxjGq0*)SG>kJgC6 z-8Dl4T-y03i&f#O-fi_~vtIQ|VQ}+VdMNDtr6b+h5HGj!0Js;0ypkd<9|!jxQ`2mt zdw+0;3u*o9rJ?VJdub-dxQi}<1CBWgQdU5>om4Bjot6Q4nE6(rOvZF@1Hh}bmz`HH zIfDFcz$}lAYh5+hH~IV;`Qs>T&O_LoGBLo>&mZwJ20#NT&VU{xnI;mKmXZ&7M{VHzz}KV`L83#Ki7&q@7R=IVrX=FeJM ztzNxIf-7mtSrTv~jZ=TfL`^MqNtJrWkt1G@K%|sZQP_025BpnRLbW>7>OC8U-obS@ zb@0ie^HC6TJ~FBL(tx~G8eZPzG{l;y-J*8|)y2X!GcTukQmwI_&;tO6@hEgLBhW{e znRaFw^x$_g6Ag7h(`~6gpAFh)Ws<~C9XWSJC-vtib*G&RKFd|v2Y1h;SN-{FC^`LS z+p?a-f*+318shq=sbA&LE?KNs8=CVYe*dh0=5rV^biYVWKW$rrluF!AF>;h6K#D>J9*O?uj|mJO69sXa?v+ARIoLTu2r+M{~kW6SgvG1B`7!?EEc zwV)kG@;>^}$3L~B#o@xr8$$U)M=5+?tjxfeRy}C`pfbsk0sjuS+k^I^R4l0M7w*X;JrF8tw>Fx zM)>tn%~GE!Rigj08neQ`?HBnsi@UgHwx)#0zs8Veg&#no@V`2Dvn}*M@*hV0*taOW z{quwfk$>(*9!su+ro#VRd1=d{mB@cR9!tK5eEvH!jmqQi(m~}v1ZpRN%Ks5oxgM;> zgzbPAQ-BJ-ZDbnRj=vL1o?w!;u*pQ8>K$((3jYOzN@*CPvuLJ(CCbr!5(JF>BL|PKoepaW5hs{X z!0>qz;#4G9#>YZ&^WIn?h#O;QHwM;E6|%k?3W5jt1<5p@C80EWr>X@m-Y69F zRtmKPNTZ{%;+E{cl5W(BAa#btD+SHvz}jbv+Ua1+vE@8^SD3L;bu8j~U9~^p_IL ze_hy|hU%TM6C zZs^6|vU-fz-N|{68@D~(G_>og#OXK;UHC|6)F(U*o^yM;)X@d%t7OA8g%U?~EEdL4 zIgnTtpGRjNU*Nh*wob<)D?ZO%)j!^TjUdq&@=E27KA8iF8#A8<$0nmsFfEII$te;6^RlssWJ4BYZf4r?I zO*hKTEV3}1!T0mTw-P}4%)Emp+&4O`sP{PvdxxiDvL|%g|4bc>A4Q0KDSlvp%T5aX zj=PMCEI#275%#NO&8RT^M*x`9DkO*qaKYE17r>)02;PPQ86NcQE99Jad1{OX(J?m2yL?CeBd=k& zL&;bHecqvt!c`q6KQ7uH+<;&s{Z4oc6hV>2_ZWnS6&UvkpTzM1Fd}j$M2H6j5JUvB z>v#z719*4rVi$vB`gc5NH2V+8VY=ir^il!o0DS z6oed+f^ftGnV-U=5@bTiAki3V1^)O)lX4iOz`YdtL<-49>IqVmdi)rL>SO)$UUo6Q zAR^MoMfv~O5(V)OCUa}&{EhZYM91uo-VQ20$!H~MfIn$6drDyJ_4J=;1rZ~X7dJgx zHoRDRmK!Z-m^uW~SBs%jAnpFg)<~b0kSZSNJ#bN{FG;q3i^-E4*7EHoFH8;vu2~Cz zAHa%HaL*6FRN*##dVNB0@SJJWrM{Z4zG`ilrcmOj&W?pKR1PFo#s5lYE|~ASYHgj) zj;#1!-Bqn%<|RlpVj(wRx=3al$zq)U*Lh_Nw7!avKNjV|2_NV|d2jx&ox81lg z6&HqdN|-)E1z&Sds zdGGMl`y3UM{ZG7xQJxZU8y+j~RtLzJ;>QJe?4$qy_ZWl^9$0*jK}6WET5CpyA@Uvo z!1xmnfJq`atwMr`Kqe9XCIEyUIGP`>*y!Mmj+ri?1I-pG(g?bVCT`WT0BfD~diJNvGHa)dFs6le~XkpJ z@!vnSiv7*AkN@hpGo7_haH1AJ`#cTJzXivg-*NVN{G*ufR>ym1ye&U2z+-b&;9G{D z3MNicgJ=x*J9U&A9af$pbc(rd5(uLKR6tV@L>?Y~9{>hAj6swk9!9S(mJ zj`-jD;kA7&zjeIRbJXGE&uN3bxmdJ_rY_pkETmanZG%KNZ|?f&tXgjSybZamoTRKcsh3q#O~U< zFLz{p4PWX{1POQ5Z{Zv?nFEQ&kZTafs2GvBG4p#^s1Qml`Ut`h6@wfs7*YW3lz>uX z0_0SK21Jgl0*q|<656ia0JTYkmL)r~Bq`wXuXgbGBDFq)6Zd??B`Al|+56kZy?74N zsS5i(crLC0lKJI7K98#6gDw?oCq#3H9@82s%wL5f@b z75s@XR1UHr0nqU0xC9B11AmT-%&GI%YTV10P{j$Ji{~JKJGlw&8z|fu5UD~XPNc0q zDnQIhz#xlKx-Is`R9qO+DZzQ#N?ZXX6KtChVIqJQbG@veNn=&OB0@VvmbX^CEkzSX zvQcjKZl3-HO}KA#Sog+t6o$L)y`GB67IoYIOdV|8zyb2%FN=|J0WLc!@OuvF3Ous- z9)no1Pg-q8g(33Ztj9-ACL>+Veg`hf4fLje6j~D*w0HhMP3hIR!eQS)#bZUGT^$8=ttp3M zib9E#{V_y;bwc)Ho6CF)UfatXYWo&wE9B{@_%)s_f|Yjao%-jpC%uK!G_yQ<%8&3y~5dsC0bkeA;?&yxM2je6Xe$wwf7f*0Ko0suG| zfC~X2IM>hl0RH=I}TsVS9>lxQM_ z3_}J9QeZ9I+mro>uRN^x`Zew)Ou^7wU%%N~1^N*wFdnx$y>Zi*1XTzaN*@yN0D5Z+ zj3V%>H7V6eiYfK@42v*>;S>u|L!i`sDeNTDBt8OS`d|A9hWFqgLO$u~{|hy`XUU!v z7}t&Aj-kQ{GD$Zf0t6`tJQb~d3pVfr5_W6gbP5rkgV>!%=AMfkW6c^h)a5?gv}saD1+V-17-iF4FGu$}TlBTvlYE3X-{*tAczQK$-_p-MAk56Fis2)6apMH#jbQ8+vf0f3Q>aQPF@AoJ0~spRFEXsCFLdQj@E zpakN${A^UXj*jHvMi3A8BC0ltH4z9VBl%QUGlY)x30P zF+?|b(dKzhB|^DSROOCvE)-1?qw11C92=@G0TgeKBSS9i|KeqHGg~yVX|T(rvpaw@PWtb;dmu zmHWM`TvnkF$|WLBcWqnbvWbeXD5<2j5E7^=;~`-hJz&KC8}Mzcc?cyG5kOzjj@9U!>_8B)=eeD<}Rfw|CjCLw;=BETcJ_=FI(elJtL-d(gx(qA; zS}>0CHps8x<0#$O18U>t_JrN9vFc05k z!y6Q1kqFijn7hBMBj<<^!u?axO~D-nZsG(j3e^X>w}~}7T(h> zBt7da<_-j{Lda~A?u%FPU0V4cxeeq$9U=cUoH0>Pi&g)B3K6*e5f1xh7GDfhcu|bB zAC5a*WTH*M{{H)DgHG;Dcgp*f6UXH%-1w~62O6@1uC{Ztx%xRb?(n21{gRMdXRMi<<6#%0ac^*FSJTV)bARD+|Jr2hz~j`lwDhpKhURRqTBdY_ z-`HIqw9}RL1$(adA(@_^b8A?$wgoTyl-IhWuVhbO-V`ZLmeY#f#+1O66@^p$~38FUe#(XFq39I z^K_7H)UCM6z4Pj-6QiTG9RdSjRO6PC0CJIMXzims}F z^cL&go8|X%l&QAClhc#;E6n%!5vmNNe~O&P4~NamYEd7TRt* z`R?7pw@V)QG3pCKik}w;7MF0-kH5Ue?9F{yT9u`aq=9oM$ZcOy!VJsy$hpZPvytFDIqbeKL16Y z70dEI-2Yyc^+WpPRW#NQwbx_1j?Xy3- zIeqU-vC7AR#o@v9D=uQ+$d_d42Nkov57=v8Y1o9gij9#k(brt2m8SQqvxRZ~bbN)> z$DTbNjTck=zR&%@vR=Zv@~|s-6HMm&fZ+TL>#{P9F`i3)ZK>|K9k!ntUX}Rl9DA8; z)}B3qHv0Ei-D&6J<140p49vUT4lTd4&pNaQrmgpCk7&gc3v<@gfR}l$ZZPrhd*>*t zZI(y&az5XN*?(uB&fIf4&?fXA%P)WBRTr@_>8y3vVz~z^($1%#lmZd=##EG2jeN_B z&f8NCFgXmorYFD)uhEvnYb0osmawFC%v+`g0A5Q{^%HA!;9%{lz0ELPFRzq6@qsz5 z%*m{T@d(T+2yssV=jLq?xUnmaIc*n5 z*8?5&ztv_g80xpo&Np3(wgvZE=oe60in}!LJ@e17|I~@{XG-nj+)v?uuzUK%x`gw? zTkzgPZ;@OF%RIZvz0G^`FYF7t-Co`vBHh$i11*5@U56_F1C21}ml80u+$jfGzqKcU zi%7IQZp;napH3&dw%xg?{VISq(cC+f;3IF(!YJh4RlR`=KrbATLvbD54q`A0Rm;vla>c=c^`8Kwy2=#@f0I?K+%o+S z_|RGsIH40J%-+s88VKzRwlI$I%j5j=1X{M-PC0+$9CO;oHhcNxcqn&Y*=SW#!jt z*fZQ6t2~<;V=d3AO|?&G(Y#euP@5Xhx@#lfy+J2J%-hhx4QY-$eJ%go&XiPl zo8MxqZZR7CzTcO}1PX8n6ikg(tYHw>!j`>m$gJzmg*{TU0ZP_brTxyc#?A8GwovO_ z=+gYQJYzXFlhe{w2d)BzB77#Be`Be_TvmNPpq z^&R-QNxnOi_va6)aM40_MS;;Cti~;w?SexL;14j_7EN=zNl~5KB48P@0R)hFQdEnK z1$f4hLYKukJD-_v+O@*!zi3cPLmak5{&zwe70BZd04`#LL6Ga z*BHUo8@FJ!U4E97R@iL1q*WU0>O2VLHRGrj6Tf0KOfG}U!J6M?(w_OHyzeRW zz|Xhu+tF?Ia;m%CZ%@Pk6#S|rCUBKsnz4#c zHtayc4m5^X!`W*R@5+D*I2MeE`IQCu6{oAwR?`|j6jxWqHs^$PhkVGoblne3!My`( z_XpLK>$?lN)vfrN0#krBMISoUMYi01X9RIo?PYFPg+P?DQr)-w7IMx}(-PJV{$Yi2 z%W6Ll;}0=xpZxJb9^yURR8D4nX{-6mEa{jKq&ZJEyMtrR_9%Q?ZT4H2YhlmcaV^qt z5pd=zbh%U*f5=MtP!?&NujQ9;+P0@9RiZ4?o$C z=V-k|`mcXh>Hl8mjc_?EUTt2ac3*e+#%Fa5S;GpiS1b>S{}x{<2ng7qmFe~4qx*H6 z8|oaojO#o$bnc405*oEm>s)ek;$id?f_{9xXuZgi)Iga;;**-;v-^fu#EsTIOFFYo z>$o9N+@HKYe5+Nb%wnPtQKeR+jjJsv)o9~gdPHwNmJkSnwjLIx;d0%(;gWYn*S9|1IzD~Px!;QOr8 znkbm0DN#v`xJy?sg`{RngDY64s4M!4`p=S1VdGl4Xs`u#R17yglWDC1R=n_fD#%9h9_nJvaVm06~}^q zJ}5A)z>uU7Wk7v3fdz2&Nq51uAZ$Wvf%;iFm~%C0RZw4K3F#-tarH4nBDges^-<@= z{SDJB>PqNYs%IpfNosz5n6Mb3KH>3Ugx;7baew2RZ0Hz3$VgI#*$5;gCM9qnAj6LV zL92i6EeL>p4NC1!aybW3g%DuYJ>Iy!y=QvdBg!J}y zW%RT@w|{K6DmWj}i4)I{{J6<(e~ZsPZf`QD=S?4%o2k00CNE9w5t|pl>$;it++9rn z=C&4^r{DIQk5XDW`&?#eKDv*D1b%*u{<7kVKIg}@8kdJtmMq<)W_a^{q2+svRmjcz zhR4Ostlsa6+!`7+Q#0Cv_;fD$`Rhdwr${f|bH{+%DAMx1%;JY(Tdjy*aCIsE;4@QmB9I|< zLx!+;((~7csnq)U1K;A{OC(nmh&r@D0{e$y3rKIZpn+GBei()f*$a9MC)@ztP!Aax z7eW${v&JS3=xT`w9vGxB1EZi;<5$AggF6HS+}jOzU?6p>!UKTxv(GCKx(bYr;9*Ec zp`~Y`$uQ1^%N|{2V?F$2fy&#OSJcU)OT++4^|O(DjRB;~m zO3}x%tp(vNUP_{yCH~+9YmV!2tMA@8QxhId^FGJ?B9@TQmN8e|Aum|RftfXq&8qyx z*8Xk;FVIiDMkjM&P=4K~B$tAMs_X6!pV-VtNPWPyj+NK5m_9Z3CGD9t8~m5Tz1;4X zDQgmXBv$mM@^;@14{f}4q9DIZC*W+CPW0bA3tgVx1g^-!Bwpg-zR>AC5=QS3nM9tW zQwOD1x&JrbVpV2$U!KH3)=_msCwk9U7ES46c#ry780JranZ8rr(8rBp*( zy<)O6j&yl0(V35=oP<0QIZ&}gk`kA&Gfgy@mXdkt*)V-y3ERoGAnPyCr(0Y7H@5lDO&{wri zf87*2SJ5I@rPHT*X}-^e~t7BjrfTL zR-c-*TTkx6f5 zt;Kq(79LT<8^%QtXgIVb4eN=*;LznK2sA#laF6-fQ-1&&O^%k9tPrBuj8Ma1g$vgDC(;BOQxyHleAb_679?(|`Q<$em#|LkM2|MZ*OG z#~!Ws3H1PWXCb?7`vDb*zcbx| zQ95%&6B>0xb|6tF3+wW@bzQ+R<|chzG3B~F9L7$bCU2{P6Zb?$=dI-UgaqH#Be{&D zi(1n~|E%rHp8i|N<0|cy*?CvQk$wL)?`kWQFEJ8tWp^e8Rh-&Up^e`GtKhHi{N^s| zb*nNos$BbAa@Xrc86t=@`Ef~Vu$p0u-h>Ru1)`ts8@frDS#d0s+$0_*cUhW{h3Dnq znNgK+_f8ad5~MR4kyH@% zw01H$hpqDlhtJ7Oah;vKOfbRLz6<>O`TuMYyKP?NX_f(4%wK?dgvl<%98w9r{0 zFgt=CiF8M*-SROYEh1P_*$K}&?6JO-5IaG?fkTtCh7}y^cX=*C3^9lu(2*9lzdqc5 zlEQXCCje;ENcLdr(6deuhPVvEe1%n7*p65lkX9Yk4ygL`W5ac^jv~r~`U8Jx+$|{n z&;YuF?+xV3_Xp^Q;C^v`!WZlSeggNXfnPC})@*8wA zbt2daNLQ2Hdsa>nhE4^;ziN_O<&HGW(^YZ>XiDTXzop>zH@|)dyV;@ZZVXEr7mDK=5 zqt+tO)@?1N8rrTdCOhLum**0l`AEu17&JM~1s4n&tu_5o((LknqDS(WH^7!ZMlmp1 zMGW=$#KdDWew2hCf5M0^{$Z-L0MzQ6-7sA~4X9coV2)MsXH#y0wj-vNJmvxz173iAiT7gP7E3EUU2!ad~z z5Cp&ZM{Yy0B{FD?DAJY@BjENRXnn1<630+NgsLb)8E5!N9n7&H>qpvegpLGRKhkvwr~u;-E)RdWmSol_LGWw_i*le&$EB$>Y^ss)G0^S(7c$r$^| z?Z|sxU#)}ZwW>u4oPb7ac}VYd>So?I<>&XT7t~y0OqK4?js6?bd-lhEehTS5`PCDM zbBaoVh?LR0BQlAQ(z8D{Jy2@xyCawXM;t)SoLI(G)ehb2zag(6|6no$oDh<5jHyeA zbE}Kr9l4VTc?kPs^8%$jq5E9CM>6F1uybx}v5u-uN7V3kaZd>_Kt=%Cl7{s}VQ}d3 z69gI`TBu9)e8$utfCf1vG}`LYMIi~e10X~LrOc>Q`Ly8q2frgW6GQn2U>*D%g%&>4 zP%|+lpf9)(V5q5tS>VXDTf)3AAi`amAiqb9Pq8?4su#dUv#H}Kcj%rY^${LaVDKpW zV>1XVQ)wbXJWC6c|Lon;-7^RTjBgW?|hxNe6$Ng(H7>#r+ z!r6qTjf2$RSMt`MtrcjJp&bl91lR0}?|(0B?X)kl$;fM)e@#L4L2l zpZ0S@$nRlPu=L)=&;&M?-kbYZ*TD*r<1hLazD(?Gi|IggLq3HuKh*cIem>RMbHKVp zz9c7p2j@x0Hg#_#&7elRVlk^W|GJ4>R?OybEuEUYnmx9fc&{+GA04-E+y)-YhyfRhs;?#PzV6;lkAuPEN%?JwOaarOZmdw^S09 zdYC-T%7iRDcO0G>wbnq5cQmdiyo1@ffXnbrQ*_)5`We~`J3sCeICZD2%uHP?R zeDc)Ru(bwK*ytE;uBg-+lHdjCgx6sNePDk4PNm;3Z2;zxB$>xgzhAlt&`Q7Gt+z1w zOwu$f1Cpg@>Gue~l0V|H8D!HG!w% z>XU{f)yL?e?uL-lt_E@f*8ugWE+Omq>JyU!f8*l4HhV4wx|@E<5NTG zvUw*t&YW9ywMtLs+&>84>Qj93`I*9>?K!otJ~#c$(`ltu)Na=4+WchsffJ#;-j0t% ze$N2%dq$FGR%3QYPCpiv^xcJnP(-ghm;BwEMbcB3EIlBTNPJQ=obbTVNYV(}Mo=3` zCn4WinHWhvOeTsqN2ePo>Q6{M6}|Gf;e_Nf(QrdIX6a(-Q(LWwVz(Z4{f zo;!>k(0*Y5H;4OAQrHe4k0+o_Bk7~2Ivc%mB028RDkXhqWk4ErP&*)~`tzkv>Ed=! zh8_d`fj>0v78HMI0Nug&2J+?m1KIDvgrV$!kbY4Oz9b+E+VMT4pM&HYNv|jouI=Ix*@2WQ{5F84t0?s?I7e2{8j+JTNjTDQWq*LZeB?55vJw`6f)5DAioDA z_)rxdfOHD-d!(@a{9F*dkl!1|w=mU_F-x;DE)73fpaS_lzL-O6dJ6J;131CF(J;fN zj}`38DcEROdavX)k|KQy&F}5>w*TQ|3+K9oxprSBx3zcU;gunuLYU?CUGn}bwY8c8 zOF41Grv{mp$_~5`QExNZG3wu%6sJ@3UBfC>P={a=f4khPMr80I{l4=(J@3usxR^I z=g^30L^ae#Pvt2n)k(ll<=m0#dwukC=)5=Zo?h?$$!#L44|J-h!b?=Wdd1XQXnJ`r zr50_fypZUN10}lPeGxqZsT^1Uv|yaLX(%){&d-P%FynWL`W!j~YljV@-+O;7F_r@D zjf5G=f$`hw1WZK-D>%ID#_A>+soFz>v_8KQ$ODa?~`2gTQ93KqKvm{M!Z{ zkv%aM7GNz;gfv%wSt%s{A2}ja(HFOgNDKUAI=oUzdKOeI5wOOp_#XHegj_{9QT3v} zL?_&{z!0XGI}pCOsP8rSHh-FU)g37Wb4$@t`^^BiL5(@2Em1#ye1Z}{&=jYI@FQrr z7#XFc!?73;r~@OF@nR2YKs?5Wi%hI3{BP8s2b-ME<9&=}@qzbC>Ld;#QCg4oNbU=& zNvJ|PTIV>O2>;8xrfn1A)cZ?YxVd>R&-vGzatmtM+~Sn_@gj&($cpRuKVNWQuFN%! zk}xs|k&)_7TvRABV_|pV;rh_&k^FOxPK$J+PxV^pe$tyzC?dT`=L8(AA`YNNK`BbY z(;(!IRQKzn^`Y}3Vfp%W-!xLf49+3=$+(E#U3#DHPc9TuU8GYD{b`X{7sF5Y0Ta%Z zpTK&0M)vN~#o8$^B+zi^L>H_hih@I5o=br7k%fDxM@sw%G!Sw~wAEu13QNEph_OiL z+$joGf)+VDbRtppp)+v$U@!qKd?ca=e?czc)74YuY zBeK^*i5Q<^aq3L+A1%w@AQFkIZ8~6ubQi@}cJw$QGBIklSo6yuz^Md-=^t<8rFX}^M zV@D?%sTr;hI5tJ*5qTfk10iN&7$P&g!$OxVGw?3l{e{DXoNUOl`QY`26e;^p|Gw7} z5D1S$kQtT@l050RpJii*wlW@)`Dwr60ZH1uzf!N+a(7#lf9~SNY(%T4t!XnmxKLhp ztvxF;KX|#RTvb(Ot9u=D8*|H+Uvu*r=@Qd#wjOhNzfHTZF{NN5vP3GpWJ#RY=ihe5 zdEI^mU-t-^8C9>Z=nApX1K$UPS5G*WCOJ^_zCQX%U(pb57`yZpe}8eoQF_!?13kl|^k^3YJ$-ue9OMdA&MURZ0i4%>GiB*9Ul=iz z?)yM5&QL2kv0iWD1&PwXr%iQTJT~HJfUkJFvphuC`82+_)||V%-{1qYcT4zH25L zZAwOBqv6m7dae=Gc(dT4#cWrZz0ebi0})59=Io|VUpV=qVyVRfD3nSqlopPCI@eVu z5$Z%;Wm2J~=+a})4fIk^(xa=v08qR#ST$2$)W|zIkq(7#a^gDui3>DgiVG)8uPC+n z3kof(sVxylr%SlXAe}G`D7g^_zduEf9%HCy2*o%w#a1ZRf{KgAK3(W4vnuka)go6J!|D1-hNTu4pw6h&;x{Oat)@Cc-C|c6 z*T|!#Q0$I8csYt5y~0qh35u15dP}2`nX4}VQ6o{KWFQK~rDRDB>B-XTN-d0_SYK*k zBRzK7GFO?5$fJ=^Fd~mmU%vF%R^WLWLAvfXk4tTV2|@?k(!VX`To*S*9^4T_ zj}9=@(`O{d)*Fi&LvvlM9(C|tEIs;vfb%ptc9E&5QCYI&1;AMkILfXvc7UU@RK^*OR9s~| z;7HZ=-Q}}0^=iOTq4lfe#H3xNCexRUeX8av6A^VZ>@P!F;W>Kr6T?-9%|tbfkR`>7 z{9wo>lco1qP0ffp8mS4B1e_JFG7qB;8pPA18(@-9G#ly_#;b|GggR|knYYjqik7H@ z#}eq#Jx~WlA57zaGgp6eF>#TFsL{6<6IVkq_M)Vc%;bxQN-cDuI9zIBB{TM^uB(h< z^ieB4S42iV`e>=%(qocFdP^_RqZb+Jxk4dhv}&EDsL`y8iM~+GxtJJjIdQ?sQj1EN z$_Ao$+)GHrQ=F1u0U}XWL()o_Ha?)Z)|9u)Hp71IJ!noww-MbhECx7WBkBbN=G`pV*>3S-DwLyzVrTmhh?j zXWk#dMQsS%ydbBoE1Mh9QNmNuIZzeq!WmP=D=A==KE?Q(7xc6(5}hk*1zL4 z^|f$vu4En8N?}^R=V`|Ggfp2{+g5N{OEVqXJ)g9$=<0mgl5nps+uq?8>*96!gS~84 zTYi4Xgt{2tz-(@Qw|t0UH^V=KJDnHs>(PeU#lIG42k$Ujkr^L^@LI#!yXQIV;^^?& zTT^+Herd0`Jki?Dud?Zz|K32|% zkC&hKHfJA6I(A}}r>7UxZc#^%Bo$F4D6jz}6_xNK8eU)>Bo&qMBNe>BU?mk%y3h|t zQNmG_a1VhK9q?a2Og6L&ITcI0_9%q2VYr9EFCX z&~OwwjzY&#=t>C2l#avDaTq!dL&st0I1C+!q2n;hIE*q5ql}YL#!-}U6lEMm8AnmZ zQIv5MWgJCCK@vd?rGmq#;4msUj0z5;g2SlbFe*5V3J#-!!>Hn9RB;ql97PpJQN>YI zaTHY?MHNR;1r!8^SH)q}a2PclMh%Bi!(r5L7&RP54Tn*~VbpLkYB-8Ijskv%&P*Lg zQO8l#aTIkNMIA*!pbZYAj>D+qFp3H|j-mn%q^N)+DJtMliV8TEq5=-4sDN`)RKU>` z6>vC31wJ0>%X~b(HzSIQ7@(c}I&W8xFNKfpPG@JQFErBDCW00nStw|+=#sbg+vES07p59q?zXmzTS&<5n*}-=zXNm<9UtLA-p0 z2@S%BCP$~?d{lv?DjkAORY5^c1v~lmbWkC@5bB~fh<*5Ul$B{<2{jdnNmWGwAAx?0n`=0f`GCdO{t$iDr!n{%Gk*v z1sY_0G^R#4K1C4~xYiH^1d5D|0pcMmWC1jqN60`BGAg98g(Og+$*HIeD}kdgBJ1TN z>*OWtD(eZMP1OQjPe#u~RaH(&vA-57bU8Y9a-bH7Ab5u&f-YzyBtjL1!h|A9e=5kJ z>&Q@4&^2|0R4D3@ItZx)4V0CYkuR)hdz`&}T)jMHyT-y-;NbRTbMcegzo?@=_`gRY^@w z5xc&kq9TJ_O25Qq6st5fAn5`!0`kE5PZ`E{=(nhNP=znn+z321v!Nw_dFwF z^TkCRfj!v3JqDGIK&yX&&w#ZY87A^!pToBfDGPN4g?l?Wr6DizuAV-=jyrcc`oii7 z6Ws0R>h0`--ulUFcvFt3`ycFnYlPatevBkX=kIi2lZr~Gj_zE6oBEL39||{QIC50K z8pX0s4LSvq9Az_2VTTN|o2JkkAv^5ebkvqZX&|_QLb|Hbek@dT!@m z9i6tyYYaFk>$FwY$JraMQxt<@_t9Qk5lT*BB(A8ero!J;QPl>x7;--{ zJmo?B0`&%jpJ2i=D5Lja6*Y7dhhFU|u@5XE^8_ac+couL3D1z4ZrE^7R!`ou(qEMs8U8?+}cw*6SM^uGWK#@kZ;- zv~|>rF_r-vUQ~p1KEdWdSy_RvlhH{OY^f(Pzh2FGp`Dc@5$o2C}f; zE{@xrmm-4v43?T4UM*5ADm^9smW>*Mit2L8L+<0K?BM!496bs+SIJLAT9(X|W@!v?E^YCASE|maeXXZSr9MN0FAUMw6orx%K-R zaszHS`fc)%!Pj1b9=eqmtiAs}JvH?C%Sb(slvW_35IZ!tHRR=dP~*9JBK(CI^mQc` zWgn`#gIzR+$O%)_RaGM{T?HP=_20e0`p?hd4?*w?{ICa6BQ>BPbm;^^;rstV zDgIN2!(KR$ewTlN#-y4;8l%asA$K8znh=fG?cQE~yFg;}vn+nV*BD#>u;+IpHKKqa zqzv(W88w3Gs&WcLZq^18L?EL%JVTTh_GEFS1Su*D7*eB{N)Z|GENLLekx?8)9*Pnu zkbmV1DkL)`#gs<0fAN&(FU!8p9=jmh;S4I1A1QH+J&hg2f{4)5xB(YnIy^haw|P{J zft~sY_kLeuhv3imv8Tj?&>NH;MPLCvs=%Y*hkS`3pWm0RBh<@?AVNqPg~Wxlo+7b- z8KM8Vf~M#ajTTf@hr6}te`i6V1rLU>-JPTgLZ+&Y#TJ40JqCRMOo>raFRF?(btO54(QQ?HyMF!!7y@xSUN|ay}aH7cf1yYF6ogxv8gOU0|B1z~bnzWNZ zB_Zt~yQGfqLhaNrOT;|ZVNXw zuMyofAo%MSlqjU}nF()w|5av`JBBYm{}Y&uR82@rG>bKg4F_Dzog94~U3Pl;%WF6} zBEF8Y=x3^+U$xfLV55ug%p`#)T?O7clY}d{obvFyHH6HP@O__3ZV+yxS?~p+Ng+oK zO`r$s?@&3dLBrq+^hUAr;|nZ;zVbsOH55`7&A5$jn*lEcdis)gs@M@lSnNHqevvwY z^`E8;&zZ2z7^oWS8LJ19AXd|L{8eXSq6Aumo8X$9=4(vFlK ztiQw#a!`H(dZWlM2~w#vQbQqS(exL-)fjC3HP*G!SJ}MI)O5o}>s26DJk&Z;TcTN5i=UiO#r4Lf<2<4(FB|X z>4txa)3DcpA@4tFq((x@p~&-w;~K=)hZ>F8RbZs=zX`4aitvm8 z+jmiSJ_<_w*Nz5LZ#Y^Az9pmb8qM-gi9-P|Y8-xv7%~cjjbiPmxI3vBRYxT>(S~j` zkU<|(8CzLy+^A$?Zc4Y**V{~6Z?<;RM!MnZO=h~*XlZF~v}xlS+Um7t8*HpsZKhe6 zZLqc!ip&vT2ZWygC_z#X-_~R2Bl;Q||0E@Vus5ei z$`TRKgp?eR?}ZGE7-Z1o6D4FwwS{~DQc~(eCZCLL)^E~RHqkY+f)c-quU$o7XJKlz zQQw$mA{597_C=L}yuL^ao;C6FPm1V0krLo2DJl;0!ujB=kiltT-iZw znzqhhjjk1Xjn+3?yKa*)eVwkk6?)AU+LL2nGaKLr$l%#;f*!C_gGW(Vj)=TwD@iJ< z!q>HiOdO4d9P$1g_U*R;>;@-C33v)Ss^BB1hm6p8qq)?OA*4uZD5NZ!6(sUn1E2pm z`uTc!;4e-QAK?-%oQ%^Ls)iCm_%{f@WK!b$cY-UqqAEO|BGX-XA`>=A!@L(ykbzVZ z@o~hA5l<(VaW~{sIAa_A z4d$CotWDQj>MPM`=4KH7D)e>eHxh(m9sic-m$XMWoQTkOFBO&Hp%$JSBR1#|>@@XZ z-m@P$r9tmxhFE{7AuixV7585vg^cDxBM59#B_Zw59O974u{|FC@O5>0ypZ+q@^tm} z@^(ew>aNl6oac6-m>9)Xg%ZV(QN(wMg2xexO0ZSyw`-)_{|!#?%lwAExfytGBe+y6 z;sgiy{~#O%x2RuBap+r`f%jjOOCPDHkjiLEZ^&nKMjIegrew0-OxcEiVWw>~-n?!d z8mY$g&D10r_SI};q;G#wXhEitzh9sPsRC`7SL26fg$$%M==Y?DdP+_aR6vUwr(fWO zjNDwQ$E(llIpd4rFF+V!F6li~Q@X)yOL-BM` zgH=-xi#xfjca40pKba@eQNyge?zbYcb>j5(v0G@qFA=GPV748Lis(^mrjy)D1@BaizxkK1`dp81&p-M%r1S@1D-SAyJU?Ea*=Dxo!F3?FIRLyW||6cm#Ku zd-WBis5;CEX-{D*F}V4?p*HX2`&2V7J8y1fF5tb5vUs!UWK{OV9erEF zsIF7H@7-$up>3yQw!b{P`oqWW{GjZ{?9dY4%c3-|f{)!uVD`oyEgeQBOZ4^Kw@uG# zie_x!bhx$lg#9;p;}+z}A2t;iV>s8CQ6}=A)w`5q?c3UyFO0SE4sMUvSK{jLPAxH4 zV3jsxw>r5MZ$reI^wNT&++RjENqZG#EGaXt>6(`3Rgo5xYiDlrslr&C6_Gb{OZwjV zTY9W^G8%T*HW}Y!*tcbB1&6Fn->VbTad8f#fva8?r=Q+E$5lNkX5TsU9;*}fpR(se zOLk;Qu&KjwM$A6@jXhTH8TIZbC9cHm6En8?RAZd?fyPBD!tFmXJerp6?ucxyGjsSE z0Ca+SjOH^MwqI+y+xSjdr}5W{YR=2NUI5NFT1CgZ1^nmjFF-tj0aJn-%0Oa6I*o7GEWE@b5e zJ5=0msNo=8!M3i&jP7Ti+Hl%GUrTIWMNMzlHl4DK7qarXcd|NueaH3Eaknh&I9{^N zeAx%FT{;QU`=m2#zG1uHt#Aq~X2#mzM~_&0!{CUmb{+kjaY>my<&I9#`HE`ISAFlB zEOI($-O=&a_|=m!R=g-K?BW)$0|nm6K21o)mRC2co3fs1{&fCE`0e_dZ^AoG^vlxx z?`f>NbgQXC^OfcJw;dPXiG6(j#8=~G;P@5I4;CO_s>$iATlaSs zsEJu;)qGP@=~I@H;(srv$E=_nrjRq!6fbQ>!N%WKsJfwu<0~9h&O`HWS<$}&a_a%V z69$dtY3zHIuik_^>2b-#{T0rvVi6X(NeCjWFzDR#Q1sh$Q#Yi$g>6w`YG?^%+OEDe^E1;?3a6m_$642sWC(8K7p5wQs%vig^*F+2s3gW|3lT`2J{AgTI{&e1}XZ~7I zP0DPQSd;Yb6Kpg6*8R*MyyC-ZzHu)xt11P=oVu1W7{ITfHNECP=^P{IrTG&#)i4X0 zx)vJG@JfWn=}T(##2DY!80Y@15jZ|KCSW!?ynLHV^E>+?Y5nXz^q){}D_@3{=?c`bN>7zPw{vh`BTzJj}{ zL0n^I2rn!F79Ha8(a)vtB(jXe2MMJPXRZk`iilGeQ$h0VIR z{Ui!ICP5j6MJ8RFbfzOQaQwbZl$h+tRG+|oI*j^hUMU|KW3?BeZ6@ton|nToJ?r!P zwmr=?TVCBNsDiN%l-zuvV+U>YvC2)%{Y_`kM(5f@TwC{-%*6q=<2`M+pwk?y&D?zn zyydek2K1BIwK4<<%6`nonKk~5F=Hudpfeql&}dX}jFEXyBQfO%=D1A@fQ$S1_xYzx z3d$LK?zyAW$Z7+I+z+q=xcz|l>^T1+#=m*R4!j>0)N;2M$?xuDsR-S9R z*gc0)PXnyA^4-S)>#1=biq#R<3cX;x)`Y4q`}W|A+nR5(H)Crtp`|9Phz%v9q@Y*_XItxQu@SEuX=EI9r{_+D>;b_u2!Wxy z#5ZkRg7*;v3ea{BzZJ{@9p_g>18WV=gaX@PjecT;q(otjAI`h7-RoeLnAhca#)OI= z>@`xM^fb>+4D4EbN6WQU1GvR6JHHO77EDJQjSrKqu>i*NjdKxbB))0OPiUXwxi9@f?mZZm;*|6dwc4})&oHy+MUf>yCj-U`N1_ae4*Gnw0X~ODG-Hs8Vjt` z5je!*<0YWqr0Vbhz0R|ty;^y@YU+w|I>nBq^*N@`E@IWy&uY?s`nD)IudmyS_quGy zedKSa`|i1K>Sq7aWxD@vjfdABcaKhIUbs&0$DX3LaCVpIv%m8zir&Y(&4HgX`k2G> zt ze8is;0j(wbxL#@UzklBJpFCy|_fz?^O4eiLd}fG#QXePjNwYp9iCfai%g^iMv~|{U zS`b_NUF9#3YZAQTIXV&r<~sS;BU)LP*|&RHCA`~x9a333S)WgFOSp&#r>~P?=TNM} z9bL?*F1J|4p&w2h+D1C)`WR zyw?*IGGAXQqdutG+}2FCJA`W|7g_mD_;$_GWj<*cCOT#jkK5kbR>(4xyn?kl+8)n| zO8K)rd3HmZ3Ucq(lk4U-W*+;sTBGdGWL5sB#N(HQdzHMvo;|-5?G60UzM{^qAzUIH^=ve#EVbatL44_Qb=OTtkTdcFI!h+y*<$opq0Q# zep~*5DKfTox4OBGUYwkAW@T?rcR|Ey>$47a>JA%W%n)ue!i+;t1kWwq?0=P!p5VH< z)Z49G}7fe9IR~71`CMEWDmlVY}pcN6rd2 z_Fa9hw~cvAh}I8r_Gei0x{agml+#2$+J@hWZ}iJoWYEL=Ea_1_<$1z%1ef?N58~## zYHdl|n;-7GxzB`;gJMlK{TA9A4e;*PnvMV@@##e8LxuNl;ir#Yz(bfey%NwULePUiD zbo5k5iLpMN@O7?*QsW7JY_oB@tCoJ+-l|7)nGnLiT=jKDt2f19)$Sfonohf$?kH->pmCdgH}wvPLUIO}pC^T(oCn@lFU`BI^~^G;I8v@9=*qUc=^cL|FZIN@ zb>Ei#8Z6>hJ}pGO&ijKrS8`3xZ>@=8Hy_0O65n*W^`5ldbGC`TUFC;`c?q{3``PVQ zn>&iY^ArETT@%(1y<*S7r$j?Qo(#)~m(EaDIoQb(*>x0dGPq>?hhKj$N z!wgRTr3XqampL)k#(A8jtv|W3uKsdyp_t+_buO`R65Bg z+_%I0Z{yjWTBVi+m);&@r7BBg+`ZUY-nVi5i)9QYwt>FgNjcXoFo(YGfToMt`WjvB zo$Y52r7Amc;_Tysl9R&r1qF6CMTAv`rFT?T)5N&9S^>WV#?71!aFu=O&7Ih0$@d!79Vyt*V@%7~sZNj&2+ zc)y;QzQ|uGo#k=?wsnT-NC`9xdh{HPO!l5j%trBMwGVw&g^=wrw^K~+EZ2Unb3+~| zTNJz~$$8XS?c97PqN3~;*VyBBHvu*3lMsiKX#*~^e+dK8l3gWLfmoP;Tb;bwZvJ6;7s`i?0?9{5TL_)fJ z%Q^$OhqKq`GU_$R#QZRMs{*%$4>>&)`O?`Tybq+a9>wy zK&WKTufLf&YAJTO-mbg**-Z_77N;c8b42D&y6;+h;zMh=;V0K=K)0VZ881%?~e|N z?OZ_=2V6wo|5W$;6czFJ2)|rOn@j}($p6KTqky20e*+%@2nx9a_y7oo0gyn8UWOBS z`qTIsI4zVFQ}FljIx!7%Cf zDT{HUD8sYtpTe z*1xuDhV*269nD3yt3CQ{e!km+`bPTswrjx!`4SKM=;vRnB5_YHxBP+MetPALaNX6; zA9zqU*I)%!tiIIr-$n6HR=y#N1!cbDrkihDqF6~Y-F^c==9v@4|6(suKv2lPO{gF!#W4_42?`N#kOMAX00C{k!Z8Nui45r(!h)^>Gc70O9Y)XrdY-&QJ0l1I zu$|!O(8)^(?G(kCL0X70LI)trcSX!qa4+WjG~vtwdgM3{ zd6)9%apVuzq*R3DrDdL8*|nHE`;zqo9(pY6TsIFS!%MS!J1kZy zFy1tF{#e-X{{FK);)TAgJDTQ+?yO)+wZQY^o>Ln_U$5>tv7zeWX%qRqSGm%V#78Q& zuT=@&GsiFZ-0AA=p^80@u|EYCcb1;V9wYxBZ`T2j)%X7^6{#piLq;K#{qQ{YNcKur zNg;dBY;I_0Q#OTYA}S*zgk*(`C_+}U_x_*zERWW=zQ6D5|9X}CJm;SKIq%Q=^ZA^6 z?)jYOo=FcGuC&MRU!>I5_VbPOfmCMq1*&0pg`&x*z~I{mH}HI}KwY)uW;r7Zr;T;A ztT0*RL3#AotCh#yDzwC2>{jHQ%dMR}Bj#2y^Wt9GYmnd=+`t7||1<+#^Bv$5Thb~4 zBI5;Ph#MBpT1{he$AgD>K-##xEqo9NZyz^jmXGgkAD^B#WNwIVFPPqCSTq@uWd$cp zr@wylO6HUrad%hIKHOkIJN1@Yal~UP!yZm8d%6dPGc{PWFKn3rnz^rdp5V&wb+qiy zbh*AP6b$LPmCBGG+t_e)IMUnDt+elH3S}Wj{NOj*0*W&u7Z)0{;(S0p!^CZSn;Y@R zv_63lkOpkHQvs4Qv=l}SAYIJntnC0QW~NA*tsILKij{}+x`OZGD?VBUIC6Y)+bZnV z${SRm@YEV)b4M&2q;!l(9J#^i@}+%fs#W;lxr(#QEAX#(U!b|dKXv-=;BB!w?pnr;2)w)JtX zJ*IMPD7tcA21vF#B;rxwhNGHva7!(%3zn z+=%kNs;JD%gS4zaoM(1^Wf9}Ncq+fkQx3=%`use_-(qsJ%TP0=66f5h2JQ>s3yr&A zazOjK!G~-#ATfSXt7A$rx%p$8Ay0lUqFo4NfzN5>xeB^b5I+_XvQhvd2LrNH%BSYf zq=Y_ts|eK&a?X68`gM;;ssd?g5yg{-+m(m(Lnhimf|B+yD@agIbIC=z2tB_lSF>;} zOAS<11ZmO2WwI%k`dc5C$DHpoc-=>5?55c&TtRluyf!2ZWcJ)|!xdXI8ASwWI{@|o zXEpb*q?KWQhz9;JJ>`OWE+h9AWC=y&L8D4Tsv*mjZyXiDkq4{;NM1>H1G!#M6PA+5 zXaur>isD!*PqXftq(a4$QYWhxf z#ixR#EJz6tL6|y$Au+Z4R)VI*VMHGGJ{WdifQg|nK2s@Ap^=EG`9&EJ34=wS z7;}PPv{Oe1Vp@sNl4)56=9ZYBTv< z=v;3>Tq3+aVxn816|~(a_jLiJ_d#9Q^=d=WxZ;u^{!>6nVPKY6b@w=+$z7Onr*dlO zA)r^~Xi6xktJAj2=02#jvU?D$_#w*blV@(EWzH!BnciuBxsE7B_$z1|e5=ra6TP5x zCFzCZ$sxNC9u>@2`qIfH1+f{O!(sug?w@CCChmh|@T|DGO6cSVZqRnrm;LUbao{yy zixH9M>>)1};2`tFvq_<#PS|x6sDg&qz^Ij9a}Ql8&>#ouqz2O|4VeM8TtBvNkn!RN zeLyP6^MdYyXY2~>n>nD`Rk^Q61ViBS!p}`WJTE*DQK%Oy;G$7S_W<#55AY<6?4gK) z{m|f>TD=*_PZA_{`4lqx`qXqY8R0B1{>y^w)yK^&ax05IfQ}6_%bkN2lOYq`57Jaa zK+<@AKhp>Bg)Wg%ChzWiwdAteqt3kY@C)vrd?J|T3QQn6U&bYd>kB60kA-FIR~D*+ z6(uR=x~KP6OmIt&f7%(cEMdMx1SQ7Rjy&tAoz>_*q${JaY?`?;&}}8+RX;t|u{hA( zJo9pS&X3`6_guZ$xBJVJwXT5!)zI8zue;mC;<@B32=Rt@X@8GM1j|U#aaZ!gZ{6wb z+I_E&(<+9|=q2P4@9Gf=;>VrhQbnJVP0o|ydh5P15k5fhk(jzq#7DKAVQ&xa(852m z({G%%hy`~jDsv6g3!5R4#vRC!HCPe2L%JQI1R&4Xe}X^)EYC6qFQGSfh6EsnaAHRC zWa!bL&|v1GW=M|Vo8kpcC9HxT0eYVNx$Gc3<_PC@h8;a3IL-4WXuUDo!=QUD+8Ibz*#Rdoji5;aRTWni!!RU{z}Lny zixa$-QV5R@Q2W1fifLM}dzGqHMt@;m2-d)q&?El;90J&?2zrgPa-bf@SUC8=JXoW{ zj)k=jmdkg5#7nF0xz+$!&-%GzVY~(F>AwEs5YEc5tHXf)6`r5lc8zIy)$pE%2{TM| zK)3+=Es1gT7(y(I=}&$Wy}y7b%pw$?;q6(~X~*T?|-3)fmStMf6)x^{FkF*er*w z^h*{mRL8f21tK;Rbjy5I5WU?p(e(*B*{~IQ?jErq{uS@nbL5OQaJlcBuodyHMPiCR zT=}6I=#DL>ehm6lu)s=D*&N^nN{7G&{u6Yj$&19)Jz^33xD$6G$LTC%R`j|-d7oGd zXu$X_lnz%Or&Gj~N3mimzlFF6grF;9r4tH43&#tYzzK(NQUDeprCMmk`#iQGe4WTu zxW8%$lmj|e0l!nksE4T!%0Yi5*21z<1ZaZQ2J}^j!PWGP zq2D{4YoFLDJXJxFz{Ggt5c(wE^f+(&W1oZwJo^VJ7?N<|f%g;STZsOb;ei(-D%gY7 z@s}zV1r|fVw^!})V^cNIX!j*N4y=R!pyi@$GQQpK!WEQbC=+Y?ii>4}@Pt-l1`dzf z%|bY|a5w^s%fdaws_FpGMC12(zIRUFcvWY#^BNX-zUg4UI?^lV^9d^Qi`v3EIt?=b4&fQ)H|22XtUyUyQ1*QWpYLi4|=;!qU&4fjwcrrQ|u89 z${zK8jV|92NlGWHGb`SOE0-|j@JP4o^!49L2U+UO>U9?rM?DxVD!WXM#Gfz)QmFTc zwq)bV?*J*-%9wI*<0CjJ|4Im@XhilXgqK1}r??8G_w1}*Ck}uFXow2~7j7uAm^fq= zt!k$)&>4sJ{%8@<8EAn572}v80+eB4!eZ}_dK-RELSzn(F)YP6Y(HfZLQ{+!J7;Xh0yNw zz%pC$ts;+j&=WW$+G2PX*SL~2q1{b^|KMGs2%Lf#SK$N4+O^67#<6f5;2jGX^$$3B zQ}u^Lg8MICCmaWuF!=v52Ly*O5#5W}zYp%k*I9(V1Kb2>fT}E&QlW;?qoj0&eh{FGJV8p?4{BSa0QQ($>7tuZ!AP#V0#Ux^+C3=9{2o44eDk2S_t%003;w!+df*~Uo z8Sd~SK5zj&z=yx?JHbHPAJqJ%meBvICKwJ8YK3i_fSWvErC(8;=mDXr2INFL7l0>h z0#V@ROXH2U(XW~42HcJivVpS{-soU(kG_1>=wJ*^z#Y1Mf~z6`j2##Pu{vO{{Lu_> zTo-p|~Zq*iNfB@q9hArSNgJ;|tFE;^LG zd)qv&N^b9{bzV$Z@>C3-taZv843t`u;g=pSFN9BLxDE z{gz<|8kDa;0OO(Ly74Z)sr@O!8}Ml1s=n7(0q3cK$s2rIy|LpY$I;EA5s!q)(Bo03 z0~we$(E7Wk2uENcLqPc|p`M-BPJ+ovjLPk-V9pT!hz32u*R%7|Dm&l=rV%tr?SSr8 z#V`!riNx2&GK&-ZGfE*0wf`%pn5NV1aE8U28O`Xg%?n0d(BEAF`^A6Y5WrS?U1%di zXurZ33kM&V2WxcLv9Q*`a%l=kJhtjwYYni*v%YsMjJIGty$HBC+Q<+_)+(UC#Pd7b zVoe*x`kUy0Ry_?LU~stMxWGIAKbZ308V33?RJ~f7Rtf%7cnrd0PjFF-?JlrBO;in! z20x50g%N-5sMsOh@u~f`+tBRQZTeNdo8}-Q70JDY?7d@iG%LQnT=Sx%10X_xufKx*Ry(e+ANS@mgp?pq>3+26ch8-eFuxZL-R`m}gg1~ElA zuKW;(`yE?MeI4|v;GAzoWk%rH&^;a0_pb!A-WkNy&@GXOY}|=Ek#A`&b*A;Y!HIB@ z7SMq45lrp3w2GMWs0WzJN8Gsxq@XKfr4tH43&#to#0kd<0ZuB{%{218U=>sN$rf zrQkUN-#jC96TAsGMpjspM% zlmp?bGyqqD2<(S*IM;BIQ+TR^B7uqV#=%v=s|Wik&Yk{^PeOPH!bw>hAFFVWxYPeK zJn%xmq~DJ^u2m6C`T^I*nFB&Ij}FDvra0Weq#qs!*1>W3@LGaNKYY92g)5#iFzJVj z<)4HnXb}PqT)X)tt_MJO4R2{>;jUo~o{7fq@qF)`@T4DF8T6#zrz<13Mc_%lEAsO) zqcP73WG&e(H1vE@^b8`cIeNz*L^I{9# zwS!9ywIb_8&e^oAEKZ0$5%ZiHnNeN&WLKsdx-ius?-tdsHV!987Vq0^FT@N9X{^W7 z^v8*=htkQ$EQ)u1Ar5Ap^L|}H&Zz7~Z-*{Fp8SQFf*B-6aOKdB$WV|sSk&wOLQKsJ zCZy-Qjpe=4?Z$om@#Rshb46tpU^Ij)Hw98Km9gb_B18VA5D0FvNV)=yqr7lZ62B1d zT7}}u45q+w0D?e6imPZ@=DZD8(S|MR0iAJZ<-NEtTAN5B!9JRC=O*FbZGZxUwZpM-=hLgG9areP^) zli{V{O@@|2X!kb&Vlkn`WLH^~{*5cCuG;+z@qT95B|!g=5u`d!Q~^wkh0iiq1mXq< zALCfS;g)_#KfD?1q0J1qTIhrvJzs&?=2+qryMg`1{}%8youhMf4Lx zYGc*{i#NWMb9Q%BI7;hYntW0|NXHY$?WqY?B&R@gejO2uvy%ZUGqt9Z9X;;_3h2t? z9OxUOSH=gb!@(LDILBdp(sZ8htv8n{*`@3D^os2QJ9gLLzl9O$CmbN5=o61%Auc{H zu;Vbg;zm%B4RdN&4}8kU@U8d8!~?Qi_(QrK86y=#Q`*a4l8@I9&2~z>COpp!Wv2uwtY! z(xe4;Ai?DT4TOWE>p;&IL$n270d7?SK`8a-_`n6?03ZH3oM4>Xx85+kUup?qw8i23 zAJz0R#*>Ss`a5o1ftA)!3<0WfjT7iFazJ(mp(qmS9`Owr6aCgw?SyRLEQL2Z33VUZ zN~>&agsKV2gGnd63c#Sp5Qw!e_R3$n304I_qkb2ms{uA}jjwu23-B`N+Rwa=fC=Cx z6MV!Jm+;k0lYw9iu%C0h>VH*2#1t6$KcSew|1hrn6M$<>^`oW!OwHLk)?XVB!i5{{ zWwqb9DK;i)nbm(0YOAVJ&{q7a5-bH1j}){P8fZz-&!ZMt29_ANU2{!)Ke#X4QN*RK ztpxLL4+lL?HPCG5z6p=I|;@q!s| z_t(ygz4UMTX6B=ibA3i1X6{|}7F%xKbr^EXZy1^%=vxk^)+JVa;T7{-^viS~zgT@@ z>4JraskMh9`ptf64bgq@i~XX_k_Vdaj};yFCqHcN!KK-*tz;yiq!KC0aed+~>s?6IAG`{|1A;|@h-{(*Y$XGx@S2Xdsf$Hv4m z87_0&A>EEp0+8qHPfZ{JmS_19BLTuo((7IoF;XT&Zw@k37%{FW(G3_(Fqo?5GMOFt zrtW|`JMdtAK-Gv^Y~n)iO1B{`1P9*tR-noeSs9Y71F5j07ls$SQsUYMq$9^km#=?9^y#Yz5e zIQ=Q5SS?ZCnHTy8`-&r0$z8RXv!nh08=$1eT#>!|{|F?Ml!L(@qyAw$mU_T)P1T8^y{KAy~ zU`e3GPa+ip@v|E2zYSG9sh_V}fe66+D(vWg0Izsg2O9X=egcA9f9J8Fo=3F3!^UIX za;%@uqzaRE>ioGS8ATn%_^?I06z`iInzOT$UMpv%Ioeld<{!@xC8^}UTO1Or(oLD) zEquZM(@IDAu_>Fr!Sz9j&<1ziak0cyGiYEJS89CuazpLXsZ+XUsSDHdkW9GrbYT6P zLDWQ=!iqi|JLFWW(xE&uav|J>AA#EhV ztCka?Svb^2J~O|eprd(iYH5hBW8?e?coWzB{Fw+Zg*L63d7I_Z!h2Km^H(iBme`f| zQF}HVP-`__X?tGSJUTzpLDwBq(0OiUF$+pwhWHJZh{JatS-%VHMD+dk#3#U(jGQOH zTf?m#>ESoypX5|BGBndaX5&JC2HwkBL{lScl1tI4)kZZx#4$$E2l!3dZ~?sE0XXu& z&A>-=^WX@->mL3Nzd#s1q6LB@j2-@t703g>6deAJmB)jXhrr51VC5mO@(>7m2z>zp zD-eMdh`Sb4lydAtG;MgSjH zARksBA66iG3wodtA66iGLv{E&Rv>sgG5~OvQ{CRo>YogB%+kon@cT;8cV+}{KQ_W_ zK8`WdAHGt0^*!Mz6gPO8KjOO$22kL2`U2c=>32K0Kt>LZ^ejKVDO_HIS6x9>T2)m_ zO+!*yUJC38h)|c3Iwmb8si}5s%?r(8H~RbcnWKUlD5L0y*02&(EE$6T<}{epdem;u-_2cUGY1J zp%7r3b9C8v&Wd&dBbWaSG6?oReiJ{z-V~@+%mgn)|97Y%+?&wXyuJPROv8QC-!qMO zgf;E~aU;PS=zr}W-*GK3p(#P=9&0=R|9bg9c)L8#10e9?doHlm(03ld4faV#m;I3k z{1z45bN`wxh!r3-u7$8))I!ZBR$v*4s0N_){IC2usb@s?3ZSQ2)$_))=yCV#a)IlR##yW zm~j=@Pj`a&p^Nz~u%F&ne%|q|-llN|gVt^YgyiP}8v*^wjz8X}5n5_|$K|As$;nC~ z5T});)lSK*wdFtEN+5y_PYKcS;sz0`_huwN*byB)viO-b{~jB9R0#d4qpe0JQUDK* z(4_wk9rR1;(1X=KMTZZARRgXGPb3f6Bj{&lh2Y^A*x1j-3~W4NX6@jpZ)u6%yc1hQ zc>i@ab2NoF0fg%k1}u6w{r5=0c4-3K(037w1Y45-Y@CR`_5QCoe{zF>{$R6vBpN9i zD51gs6R6OyIQ{)?V@)SW5I1-`udzNaFW5WiXV!Ocgm zM{(`0LFgx=KeRCc9`q*FXyypw7@X(A4GDkTiSEzf{LMXrAaqypU@Zx8gJ(am70xQ6 zA2zrBGeCcHdsvNDUI=HJH3s8Bf{lWHZZLWl2P1Gdx?}AP5Q2@&9tj_Lt}&L)fXnW^aFS&nK|wDm=o-{0o2( z+}ZsBf9NOvzxRKPh1CcG0AN&pN3kN_0wmm|2p!1Omy2VnjKJRS1Gn>-=G7HpUi z3?A7G-N9zf^{|G~o+LBOu! z!~`tZ2^w_3e+2d4BK_^H0$RJh=jyF%)yQj14`#Rce>pz+aSW;mN3xVMAL6@lF?u2p zwleew{1JlU!;a$!w#DT`flbhVI=K7!)Y=+M5W$2WdRFpJU2oNb(NMZdbyqq7;9`gC5q0Ux$#?Kl`+jWBA_ z^S6IW-6}{V3c`-e2*Q>R>?Zz;(HcF={{Ru5TK)mzKhHn%AyGJtgy#K^P=fov^O}bV z^vw4UF#qXs7EIS+4ZFtN@I>A(M=FZ)s#;ReX?6J%5~@;?8j|vBo?Ov0?|+X2gau~g zMi`(7u&4PihI3&2jmGgy7=Q5`Krrn9f5hS-G}@0qK>h*0_xtaG{7r|y>fv|`tg#C` zi-j3$K%74gfb?z6I59&qcKD;<>gP2f_uGDbZMVL9qvS(?^aQ~)5d>0L^nBc4xA9-j z6a68azj**y?L1Wp01;a1-y;g&MzbC~R`Vg(Y-Fi(I`AWs!fQmgu68}!gy_X0;cvlL zH&J=-A@iYcA@=`9Ms>}(^V~RU*=b1sN)(SWF$2o3%tbN%NT9uz(Ljt=fHs6bR783Gd za3r2n?Ci4VmfAC%%#{%rrr+l52<>g>ry2g-JUX$E7CwWBZ<%UdIcJ^z?uGi?Q_?ss zZ3nxadZkv|t(9ImEMl(t6uwuWM^}{gr5a0gi+K_oCYVITSCvIe-#0wpP<~S{^y&G`q}kJh z3GSBT2mDIUih1SatxU{7D`RwG7c-!|vtF*}{a%_(O+JR0IUXD7c`B2ZKiQ@=*-si; zJ2ESlMz_**=0mO=>8aY_TP5emCrsrpxZn0YD!E~*lFZxp126TtNEt0BWA~i+_^f;4 zbDfsPELmfeW9v4REV*8L(c^VG&}`RX)~~u^shhuq43N+%R!9?dS%&CcKEu)~N}c|K z{nf=%B^}@99gm>(OQYSj9V@dA-1K7`VmQQ0*-ub7alc_SUAGuT-;mzdb}Bn{w@2S- zn*U5m;nz+6P(ZhW2U4WZJ3NIyIjeS3RG8M3bmGZGqQ#&|rhoTBQ%(y~ca}}eikFoJ zD)HnT+eg#9n>t@ul#}Xsvrd!F$aAU9k$qDO4y^}~TdH3{cCW}DTXP)unypdqp;}mA zVyEB0{Dew|`bA~LgME+ov0pl$;&CoT?}Z$v~)G$YXzDh8~qGhfW{pyFBu>;QnWGuc76Auc9{7CpwzU zkW&x8l}Xa?=yX{RRhkx7FI6@ehdxq~XnSFGdUvOey1^G_!`x=egsmOEwIm50-%vOE z2Jh`)xF~GQ@6vcwk))+;1L@f27pM(`+p|V3W`Zf7UhP9(IzgLi?DMjHWiZybj73jP zn>_pDe({~ng^MPaJIRN`S$J7($*)Y@sa#q*R<)IZ`6By)T`&5ICv%l)4=`$JU)SQ%b!lcxlGWbk5`GIII_@n(9N_5jfRcAp zuAGK^GgVeI0C7%ehg;>`7^)Co(rc*uZOtVb1B(IBdFR1KyNsQMantHPF#Wxwd zS7BoXhT<;g{QGA&dqdSk8LB=OUfIF!WEWByo;|A_9@uBk7lcYga|4S5A;(?YrOKxY&Gv4tB|ZNoX#RlQZiCz#nm27JZ5qY<=a-Y*MEGJQps-EFXaA5RE#&~z?U@{?|b-I)x*gPQN8>W4|aA;$zea?i;iMWzsv zyCu_Fn*Q%eBnLL8G{kUw%oQB-eQ1-J_e`8$O{T1g^3dhT{nGqSo?L!JnbUQQd%lP{ z=2O3aMG>BV=SeVUj@m zZOiFdB6{6M8e5KCIaN|GY0MvpuZ1eyzHijL0xg9 zg^9MO)_3nU;W2#roWdZx;pS0&VZo>QT;X)jX(%WuDz_dBW?@ukWahmx#cd3wF<7>@ zv`}2AygQ|0{@VK9I);=S%b~Y{pCkhLiTTxz6&m<6Myr<6SJK>bbvDcI++iJ7WEN=? zyv_;rAGT=B{hG!95&b&UL=_(Z$`tY#Z@(u^6pYr{uoKdNs1Y-*0`%wnRT}}qf+$%f%RhX&E zBuuARCPn?MyXiwG)=I-SOS!EpQ|EJX5rP_byOs6p*jO4Y1*b?f7NtY$IIVK7%BdHl zNQkO8CD1h)2$C|sesoL`m4g^E^W|aRUC|c&!fl_A|+dpWu|OoID%nckVI%$ygK`uvSU>k>*NksV@+W}!Yb zva)CM4pZ(sr_MKRC0svi7!$M3UEtunzshnnpJ?MzvDR5$>k!wZeKL<0&bTwaT!}=P zQeRm() zeESuBnc_2h6&03iY~wq3Jy>CsVe{B>XR;-=t=?eAn`XZI_Ye3Ez2~eFpdFp)+Lf!k zz9J-`{4;8CYjd_hBwbCC({Tr39ftY$O>gCC29FCrmsd%sS+8>KY1?ZD+iZsu@*?iS zFYZ_#r!1wT%GEh*_@2?B^6lkXuW&NK_jaLBxS)O-vc&3uiBZ|+p;or+6cX3`oCEGX zEQ%-Ai=LFTP`}}oz;Z@_R_g1*{OJf$TQT`j_ZN*8yIPNKe*Ix7lVUzrG5S0Cwjvpf-x*|T%}iYoVRKIX z_P!E&7_(0|{^qjdU?B0>*KMDa6#Jh&G`@OIRidh3;6b`Qm9?g{LxS=4>{FEI+jF0m zHe`nFa(*kc>5{|2*cKv1ux{vWV-*u+eP1xbJSPQOA+#s1SEe z+pOemwdu99ft23eRkw^a^EcG&xZf}IkW!}9Tzemsq{kyA)+% zDlGIk%iPha|Bb+g%Y~NT4o~HqJbBiu823r2px~xh%m&CQ!NJQrnRsmb5eIfgcj=vH zXrFE5>&p)q^*<|YQ|teHpR?ZQ`_~7m>tg7VOp-5cyg}6(5VEVT#g%(bP*vpZ^yU$T z6KbX}RD<_S(GIbTZaL-9*l8FZiQII2id5`Y6vI=6s~2~1MxGotf6B!0cz?eggJGHk zMPzQ-*R(D5vd^Kd=T@BR>M|T2Ckc&IC%ru^C^1}dQBzd%mS)^X==xT3PUep>{rS!g z#~MW@LQ@?cZWO#;Ueka`B27M}MIK?C;dJp-V_-$A$KB>Kq~)?uTd@B8<%z_yiqx-+ z^Szli9qQE6Z|zkmefxKkyw$n#A(nOdoXGrPp5de8u_#E;0qS#5?uZZd^*vuXTWv6Z zUMqHAVfD?;?aFb~R=iI`sP+y}T+`%)dOyC}ig1~nHGS(gm$ z8SqmaN9~-N-OAR!$M?-?Sbe=x`>@xs&rG|Po2In;llAnbeT7eARnk5U={UQ$=aP^0 z4bJPfo0jEwHct~lbu#1&dzLNRA`ACbGnah!a&1g6J(sb(P+?I`tFdX5R)sJ02YH}~v-naxxO<<$DcJY>0bxuorkm8Y= z4@a*#P^%7;Qj4-$U;g5~*OrP(+M}?f<5_9NV=aXGLy*ALW4 zq)lIIS8(PZzRPfTaq$kr$@^X+!R2IB9Bs}jW@QPk9bYK64^CtWhRStGY??8&r&}f# z)zd$TULU!hFI>WqX&3ZAE{WtrFZlcQl1L857vO9z%wi#KR+)>E`Sm+&yVB- zTA;W3GHERd( zh4UN+HddSEnpuj*f9V|WC>G!-8b$&H}r1yjmk#)=08K7z$&{78rk1zeGr4wJR`w zZ@WKL6~%7m$ZlqBY_IR&Xb((!!QKe3GX%19IMe<_dwwo%E|4bT;rhbtSAF1qJL*O$eBam zO5e@K8Xa>EVis7)hYjq_3`G#&#3hjiMk51=SK zt``fsq?pyQk>MK zWOAHlk(mu6F;-D2#=9R4b46TN_PRFMFlSSER zKD4qOewZ91oBw6!z;3mVRi?Me-)(unezsF@(^gHs^q#7!o$E^uMi?b}A+|jfrq`L| z@b$i)>lAnL&XVQ@NKM;?Qo#Rs{m$@{Vw^mxKChmAhVYJ8%^@wdS5h{KC}lBWApCDXFt?NqTvYD`u74{<98NsfA(wIXtLLV z{uPsVkuAxgA|^h~jYLq))RjwT6yHCeaP&_L_fLDq733p$k0|Yu{Z}2bXPON?a>-bv zgCQG*Z$H>BU%B&T|JLk=_r&CPd)@?lhV8lA`zDxKh~`-J&O2{*z5@SBUvVAqIgR{6 zqV9VC^J5hMacVrg2o4vLt% zsL$IB$Tns(a_uFPV9ZV`yP;`|hV&OyKw&m%CN|;q5~zy-#%>MIBNJI1r=GCw1|V)H(*Kb$b?y zZApxw4?%}c^xXByZ2wGN3QT6BM*m{=BP-X9H=co?{j^wj*eag8wD}3jRLZuD+GoAi zabL9yq<+FK&zblW`HJ?H?Iy9U&;{zs+E(~c7OgYMKiEM93?qEDd(f!+CW7)lsh@&= zVd{0)&%4?BPToy9`1^EtJ>WXSu-b9!c*L4JR} zx^$_<^7J(QgKLiV1q@jSs6$8ew`d!ja6>N7PB(Nmc62Oue+ukS`<9ORyor+I!dGo2;V0c1%(vQy1K;J`J^xOus=1WuaR`N++N_Tl)hkd<$ z{K$Qld-BF!&-6t(D$c$;*u&FfB%jn#2rbN2zl>Knq=B4YU%}k(EIh56VEWYl@rABY z3p+J~dC^wkuT*>~bi~b^Y%Gx4l{C#jo(u5*46YOJk6Ko z`jQXzx+w)tPonN;MA-z&Y3)xqO~IZzLfT3t@~}WKnJv{xUcymSF~&eJg6nFbQmA&lZG0Q96 zexmR|&m)iI;~LN8wDz2-Nr^Z5#wVZ4@xqVp?1gF;>Zp{m3tzf;=mwWFmMq#xAcutc zK*q7R8}D{0-3_uI_Y}MF^590%o#hXB4j2}1SIMGTaGY0edA7YRxF(|KNc?0hSIqP! zY3QBbQ6qWNZ;G<+4rUoAPlePy9EchT7dUopSIs4r(bc0o;mrRA&ttz zam(1)7O4-Py36Mv%E;!f5l+tKBt(_`uym(aIf_5EjeD$uKJtx1$_%P4=PbFVK%#ci9$Af-&pGVx zDXT;NB}SAY8{c|n+6$>=C5O-&w($?&_u@)Fd1gcA9$r_CK66s(N?)XGli)LL5%y=1 z-qD64>V1njx!UhJ)N(#}(u{thG?qyf@d^svnab>O`t2RR{Kmna+*I{br$k~eIG2iK zHd4rLzfHlQ%EA7MvxeI1T#HF~Q>lo^Hv$-DJ4{NSOtiKw$V`IF-7zwO#SL!g0fg$%scE zRV%ndjE)?=cQ*7*My?LR*oL$`#OR*>NZiTiIrcAYrp_EbXnVQ#ju!QiTb|*!@|REW zD3L`kNI{%zdjzLD`m`muhc2N6U*5j>CGd>(kWPoPeKLKe6vXZVkz1&ZA*bGQAS_rTlArsKxXR_2)XJb<-u5^nre5Kx@gRXK?X^JY zm4^A-<;<-25BmjPt?SUy$|5og?rO>44InNyHIc3J4)wKh+;oDZ4_(9k zj_Vg~vbgZ!k@l8Tf<1SHt*IuY?M$_pXsS}uZ`2(1IMcD`U4gn^KYV;Uc8BcvXChO9P7(Y)2N}gQfPg< zQGP4&##8nQQaV%$QH#0H0$27#eHfX*JN3HtHV@3s9%=B8$z$A;$?x2xvb(0PXu^0N4ySA^LuVGG9S2Q zz4vXiY_4?up1pFAa>XoLuE$f^@nWt=++k_Kj{ZrUTp@WBilq9wY#}};s?KcdL5tYx zmqbt0AU{!v3^`X=t(&b4Q5QXnp7Gmm!pj^vDR6(b{!-Y$6v?YTEw*gR?PQ$i?$6fk zE=RFkC~tV)I7t0=bH=*TwEMapcWArLreEv6Hs*eWqskNtPP?<~q1xxGlDjo7Z|0zj z_vu{6mZ3Cy7kjhiIt3421_xDJltiz`7v1P8ZC04hr!PI7erd3K`p!&F=A*57*;_~X z{RJ%o#!3`hUx&M?x6ZT=cRCC_*PR*b6Z2!1G>zMsTz|V)4MLr3CTs8e@Og|8=aJzP|rr z-15eQ9G`|;zD(*xM4WCC<*IDvfgE(Dz%SE}4<4ga-kBw*tj+so4*GCEZTZ4NUpyVO zGR41S=Q5@1wP-MZL8h&7zZlz!x#$=*|I68rjh~?n@rkv$-+CRgcGP}ua4FBzxmmqE zo~MIDu6FM4-TG&iMvE~0`cxSoHr_w06#e6x-MoxJFl zPl;l_r*fkP^ro)0w1qxHF@w42e&06|Y&J~`b)(A)+D_ze4(~BJ-_&#HL+(NM_b-^- znPRrlZjWK>IKX>PPw&W5R;%$`CBMR^2e%|jkElbNN*4lSZ}tYCXMHxwTUxb(s_?QM zX&-_@zi``-Y1SV7oG3k9mA|xggjz0#Rcq#q#yh{~hR=F}{d-h;HtlK^x)uc=Bw^@39$}H>fd{^1fglsthUrnFSuzyxG-Sjg2<3p%8A)zn%v|@T_@C zk5LFbP`>lh$i&fUHt}jVLru-~K4e#n*5|ftU?IuqBzk`M!of|0V=JB4;^Ky*KE&=Y zD&Dazh=}8APMwCX2!ln6`-EiiV1pm$r}6rQYsTb(Bg$g2^%MnO&QRu+!m^HdWxm^c z&n1X#JM(zvW4YuPsNhSCyi|Hq>6512HwuLlj@Go8FaOD+(e;X?aFh;q(5 zEgs^}cexclIaP{+!E7qI-Z_P9-QgLX1)5$9c5#w`4t=ZF%N? z!NJxY0wb$Fxq!w9o@^$#&s&4`JWnS-O*BK z?L3#B4j$DPvb0{+P}PDQefAtvZn0wYFoO#$D2y*^$|upe&2|@|kOG zN}W_))4`8|b~vkRQFNUTKC;EuHH<1GipA_M?6&h$ciZD>$;t4 z8|nQ;n=*B0))nwoTQgf)$AYx^`XK9#pdB+!C#@M@-^(J|Vs{2^+A!u={WWT-PGpxf z3-nR?V;rS5gSGSJwrfHm#oN2c)Up-DxdwJ~#5|^KxfjAKf2^~(QoEw1eMCXeI7ly= zg5vXSpXY}eU$aMW9Xs~XM|0~IyGN`#g4z$xcGlOYpQGduc|zZKf}*R-Hj(l5)M4AL zXP?;K+(XfYtd&3Z5ve10jrs!17Q4ibj=iKxPoPPPV-lwt7cSq{R1eVXH#M5wK^oK) zwvlz|@!?%b&oZObp?B5k2e+P#I$eEGcEITQZVCCLkM3)zHzW0vk%^Kn;165}gA!=lQn1 z?^~C$TOz_PWuG!Rc8m_8xR>c5hxQZ3*L+&pliZniZ3hfkj)Rt}V37xd)j*-e-D!#W zh)p#Y0ad2wJJKe(2Oj`QLiO?o4_ebDGwygz^Ze)*yQ>)woH z+DdZQ&Lo19+nbzqk104qe#FdRUr_Y&%g*d@@-21mv`Q|1AugD0DQ%b6;1u-Z)|~r?CG1q1;L;t z_G0+YhAnxNN^U%|Hlf*(-tZb*YaUMHl450(h%qKXy!OQ1%{Z?9EZ|hf4-P?2QE# z+ron0H3~LGfsebS<*wb-1XfxAO7nr`c!1W+EFY%~TGatItNXQCe#uDt;bV0Vc4XF@ znI&F3-qbLEJ!7l)6T4lcK8L2LNPQkk_48)l9d}9ze~_8bP;q6RA9`nISaSAaeYy0m zn=NJriP!Tw2F^<^o+=;EXE4{G2$8-Nvg3I;8{;IGBIqBA19$E z>`a|;OG*WwgY8wb%N7jmS#(_XBF(2lbx>WmlWk+O`B-(BtxE+dDY}~OY6k9VwiVq$ z(WSj7`f}Eka#R9j3^AmlK#$OtQEc_PwDT0uQI#Tu-Z}zw5Yk%N5+6BclIg9D>g=~%7P@vO zvzX@f6Q$2Dj_W9-g4m%3T@tkhXki(+(jm!RA&NSX7ZnTR>mF})*=vxHTI*5!YnpQsT95MP zPRK&nDpg)xx|A&pZP{WsM*#?+=LA6;(+SI)P6pRsFa+`*0h^z#K6w(zSAYv|=K^v2 zOm7D9${zwAaqpT?o=@tPi8SDy7W+YPeg*K1FMxoKiUh77bs7dXamY6QV@TZXr=Kz* zVMm`EtpZ?<6v`X0?e)xF>}g<*k1048uP)a|J={<~m#)T1Y3i|;)n#QV{#@MVnVAVh zLSI(Pqt4dBCyP{DLyVGg$vHb>&n-?xk1UT@JDV0)qEaA_E4_Jg{HMmItq#}&6gSa9P)Y{A_r&MV=D9do!bk{UW}h!YONVsSXSH@KCU1Xp>J_|9WrEa^)!9_2Vmiggxy17<8ZSP-jPc?Q&+Vq$=WG@b0JNxzQ;A0u; zX$y{SA^%U5kV$Jn2a+SYH9U~JqpuoSxX44cJSRqX&Wp)}Zx;h~x9}r@;Gvr11z&?) z?fVwe1y&A=bL+BQrdvm+RbPH<63Py7;q3UlWf;m0DR9YY4Np^f*IN4etH^@jVn*+& z*~t$y3lA;7b@#>h)*`R?yT;RpBfnTB%v2h-TBv(cd#y z*YT*iHoD!jil03)@Z*>}U-Q%#!Ijp_9krt`5nFc0bm#RM>$(+Gh3(Px9P0^(mKVb0 zW{pIK&sJKCq|zBYMI0hM(#Pp;Q!v~1NEh;4ng}EhEQ~p~*hc5&x;U1_neSNA+&1X8 zw~tt%!{PwcG3e8=|BX>H_9s;Rmw-`H_V);O6|W{-X=bhyl^Uce90 zcJIwRC9fObQu=`>YiKam>-uxu_QCPC)Eq_6XZ^x`aZo{IeDhiN#8ilbCS%EF>AHG% z=$?SNm+jVLmVuKMPYXM$x*DGkCc9-HKz*v5`L@7-IJNzC)?nnpy!N+jD#*SWoBd*b zJ@GAGMm5VFtrHyPpCb#QBI)O|t>-3*vXculI$ zUz)AJ?;+M%y&YKbOn@c3eUQEZrm}u51X)a>nJE0Iz29d0*`#To?6|9$v)$J;jHz&0qww?y}QHP5Ff4nL-k5Rr2s+zd^U9d zU+*$m|C(0%&!?L{cXEFXDY1U`_dkJe|G!Kr{dJ6gVz>F(Nypb0a}5km0ZG=D*U?{#@HXZr=an-LCZi+v6u? z3Vn8^ndzARVZVz#5{WHzudO3zLfl(J8#_NkhXGDZC(Hutw=bJWOp zUs4Zoj)S$KW^rxMA$L+$K>$DpVNoluWH6^?!!N|LL3TBXvI`1|-KYSeg|D{E(7sJy z%@9%H9_UijO&5MKddc=f_+aMtU3e41$%N2_B6g#eXyFfw{vyPb6|{}w_}-fg9tnw@ zoe)0)53Ra-dFnfo#E-O3Y_Uwp_e=RCyTC{oYNarI?8;ks0VBK0?zd(-c{cw%nowhk%8c37sgYD$uizA0MHx zq1ez79ijw>pM@Ba?cWb_{lNcXfv#>FhU~uwmjfEAX#s$vJfVrW%Qc8_64`tKA4h5a zM$(6MLX$uec{~V3FXCTO@p8+Dg_{qW&icxEkIt)WvIhrZj8&n&CvYkLgouq~jKQW) z&Pf(M)?1fw&9@7bINqAbJ?O&%d2GJNsC)K$T$+HuS9483r~CtyCe^R7uR9z|`G?@B zC)lK8-Ut9XEYRb;g3BvU)vY-$Z!@ZVg=>YPm~?kH1O5=MP8TQF%K`dE z`_ntg_|3D&;}d(q=~;w_7YLi30a?C@vh7&-rOVtYJSuBe?FX(7fIIb@NAM&iIh;kMGM<|U5MWs{qcTI>rOEX74cibJ^b^lY{Sd0SQnBlska8U2k|Z9 zAz!LGYMnZ0?!!R*<$`_OqHo7oc{~AE`$dFiS7?{9mu1@*+XuG{H$NNK6*#;SPjo)i z)E_OjP2jU|bZ@x4luw*o2fJ)`nlYqzbQ&Y$_AeLR)|q~2WWjY6avdDNxt82%d(Yys zet0oAS{+KbKGDm-QE|IR?z9FEwOkT!nn2so@ysO{)Ow#pxO?q%XXs^ZHb?`K+4%Db z#kOlSlUikCc{T`-rA=|Q>7)%z&S{Jykz9NWGhmW{$NOspd!+OumZEjDH>RFgR5x(S zd`_5+_D9AYN89?zHLjy)%7V{jfxyYml_0rT(FDA&d_lra5nFXY-Ecn(3h%TMJ29A{ zDD*>3!mvEd`Y@^xrZDI$st!QV0hBo4d}w@-WGnm;bFe^Eix^V|l_=rJa*nYKO1_|c zy;6Cxo(^Sd4=46Ua4=1nY5T&c1YCk{c4j;2Xd`a{Q7_1rs?15dhedls%5w8tj&4{n zu9Y0PIh!Ufr{H|aSxL1>#A{FBik6Aaha!9f3%XlPs5=@~a@yAiK3_l%evQv7KPaJx z64Va`wSsRypifan_g^U~XyoEYra@U7Sg zK$I+!aU_`BDq}K<<6>T``(rbjfl4eg24iV1rjpA2spc6b1ts21K3uP^=cAH<>z=y7 z8MMCRt2Os8{sy0!|5^zUc8#K!kHi2!a=fY`%Bzbn=wHgztGJ&>Pzc67k(q7HHn z|F)zHPt0H*U@z&-JVW#K%cQ9fiH{JtF-U~uw6>;it}aOU+HEvzTy{Rn<+o|qpSpE?ixoO|wUJ08hYfcJ$hRvvlp@u@DFS|zWsuZpObmaU{kCtk-iYUW&g?vym zR-RKR2WsfSmht4&=bOyTrTwB`XU*#|tiwnq=-TRh>yTy-_PDU2n5R#q6u zW9C%shF>TE9L3=5<}mXQ+2Tvf6;bTJ3s&D*z3%_xcWm2w z5(XDW@7#r+WuRk&{^H8xZA4Dbr7u;Kww=oY#h~VtRgVU zWsNsS6FHDqHh3#yzW+*Em@Yn%;9)pjI?%|JspqYsT@3<*YCA6~M=g%TZdXIuqMewD zMwjMIttT1K{;*Ni`L?B_1Gkc+I)lb)BJ!ZfaH?_!#Zez~oQ7I1v~(8)AP` z+a+KEaM?8jIUB*rDRL>q7#B%1_%gj6o>_u{#$Ir1&9TBTut^}_+@TGf7C%X7OcJb? zWCS=34NbxfU?vN{cH7fBV)p#*ELgFWwYV1D4KRMT0g zHa2d!EzpZ|bGq376meY@w}{Wal~pAWRifF6Ol2L#s^40a;;8Fkb-DY&ALvclOEoPL zfU|+qyx})kzlq&<0fN16vze}zE99a6gbpF=Iw6n*5{M;SU&jy`v6)UrV1!XH4%vx} zEB?!0$A>049T>iCu-Og{sF-;8rEq5W`{vM|`O$&#lL1w0W@~nY|vM4URKfb(0-iG82aha#c1-3>Z zf8iGd8eZ7!d}ZKppS1Ym*A)`3qQU91Fyb+Ka`;`e`AB$KYHunA|1DfFBj=Ab8D zATZTSYsrL|sO~xgy(y2+>v1x$S5iEewYp|2*E{xJN0ovwYzc(EpakW&{9GXP;89;g1Bm+PG2#=emS6A+BmKGrK9r8@g^hgJsG znp-c~1(lh8V58ErH{4Xi@ZBK0C{_La>AyoZ1!I zfa)V49L2e;4g>(=^~4>5gUhMDKChM#vOKT~W!GI>aSfjv>k<0=8DdA%Yl+&=rhX`z zrIc>8QG#Hw`PCm@J{l%rF4C&Wuau&U8_D4=uwv86b@q!Y_>mxEP`mzQEmXy_cVfRA z%@_&x*KeDwi5jah8$BaWM@QUF6K zPik#f0C!2MYW`K`?;wv9-5_9#-f!c2aREoY}IiqE2n;2GFSt4nQuDO zi)s+K^vh0+-fSqVtrs4C-HKi_EB|FX9o(7#b(9R2DrKYJ^My$Q17)sd3scDK_+%k&sWMrS)ZV8ZB0SON<+^CPm=mPu-*f4)qo z89#6&iRt-bMz4$uw3u0CX6pjm>kGUJ`mje>Pq~BlHhZ6HdDN%!w>?J7^MSAuVYnc0 zg|D6=b0nM5`r*2|@dARWB%Z50o{7(@-u!a5xO4rowfu2<^{}^yb3yvv z9?H|;eU-F)hJ0CxPE%1g@=&K0eMux_{Q4ja!jBS@F!)Q+k>$D3ZJC)KV*=B+qq{1M z&?!RHMR1*I1a_}WDOZ)ukIKr0~hHy z(MVeLqh)8s3lqP5MlMJ{9+d}r%mZQ$(#Jygr_P%JkA|(V_K1s27(`y^`q$-AI6vi@ZDSv%=j(wYJO2E+Z^=k`W+PGt z08hZ<;#QKt>pIu~_Q7OZ9-=%0k?$R8Cqd-ZMimd9;t1&nQ-c#un+ww`mGTqWOBp*^Ain2c$963-{Jq77Cz=gt@SR3~{lt2gih^YYoY3{S3u@Hp1JTA(PUo?u1sfI>6Hbd{hE9nBcy)}LT+e7C1P_AKNY*M%o zfm5U&ySY{9&}wu!_jktwD)CKzfE&`5)b5e%}kdW!|kllZ;8pB zKc4q(O>6*Ok5=&jgcKL&2p?`^?5ybu@!uZ`yL`@3-?RXS>-!cR@61o?D3u!rCn#?o z6okKv7!X-o!mG8hS~{`ljTT%8t=!VOTv8V7ZxUS7HXgpAJiWb2^{zcjw@&Vn{J8L0 ze0?L!V>e=lT5NJ?O#r0P&mIzwbNgAJtNfU85nABf6iRro5p;DI=*)|l=eH;-Uz8s< z?Rzn%jJpHKSF20!7i`W+lyngq%n3BanQmy`hCn!G?%uaxLwMn*o$jT`O%y7rz@L&j zs3p8l0HQ8B0l!Yj!8vexkME|Zo%9xr^74?*8Di{p!rKjvrKP<4voqr9>2S9QEuDIE z@mI0S*}Oc8Fa&5ei_z2Nr#ots65``2d&FQSPOAa)IkPuPIUDU^KqHsD>PDftF_Ata z)7*<%s;L3k1#k+Q7#84XHu{r7I%SevB)jAyZ~=7kEf%*Dr@>rb@u*29_J=7Jbz4iS z_%n)WYIa+_ofz7rJPRF`A9S7TQhB4d$@A2Mh!;*4hDD{1>YRGVw&y9z5Ck&HkHMzI zC^7+xd#76op1+qa_|MEPw_jc(*1ly@&vl-DD%~mq#U)!TH(4Lnz1GSuP|VDZqk~iG zdDdk1;H18yG##yR5i6X($v*A_k-2DuX3837$ZSv=GV|oSX5XkW79RNM&4l-#A3OUa zsCt0qbBN;xgR>fu%@>ElawB#vi^kNexYhy2>(WULJhSEp^k_`5_5&CpM$9rxTT9{t z@$vdiRgoDd`inFx)FG8LCq3-eFE-2`X_8H_?7kT)scN3IIqjuo&Ao46^9LMRqhL+s zj)nU`3g+$FsmF_?`ojsXI}O)949!!@^i-k*Sa&HxnRTfKBqvnEO$l}8gWQ|kMVWvp z>A@Udmo3XgCFPa}MbOcOjHX;Ae~LuQm=?AXQl1*AQ<|%A@UB%pZHK<{2laV#)#RbV zb0)KWX#r+gHG1bDAX4!@XHy%-)Q@@3jL?%!)_#Q4HAkA4nEnw%HEV&W8d<`d9aWHNEPy9pLa1p0`s-m&9F_rwEad+^Zt z%1{tcbH~DhDBP45^VaMsF9JVMZfh>W7>!@n_+a!Hc$yYpdIz;#j4x7ZJn}QV_Qss`^Z|H5?rHo=!(ywFt zqWq}hv^^MF)4J*`m@c5MtqcLlPkl4ONYL8g@vYj!Abvb`_|5LO-ISATV0vae>;<-~ zmL{k1T*hAs6YAqPL4I^T zU^1~p9zP(r`(Rf4dZE!88hy17k-mP3^HPF_sX^2r=nrg2k*04N^2a z>MK5`>+%J-(CvjtmR(yDfa@BCkAgLa+MREbG9X%vrW`d%&fO2}2F=B7E|lR%WI=M2jMV`-aSz^st#Hv595I7h|ZVogNRnojE8yP{I`IvWsdwZ_TROr&ks79+uw=Aw_w9q;Atl9u1iB)Rf9X?d4Ac zCAo2%{YqOxwa&Og415htx52r2e^0yUe0koW+t)tmVi`3z0=))gD!EcfR(_Om{Je>p zz3A%txJ%l(Ufr7b0Ofgae6@dDCDbBNeviF5xf8fnHg2b}uqKXUm^cCMoP=|r1jjZG zF9`qnfTb8cb7%ZJVw*;K2>g1OyaW z>$U`J--M>UU%H5Zy|o^tb75FTrg;Y_bXiGv(>#+PCoKq{$o2~d|8N!bN0jF7^X4-$ zfm@ECOnVfpw&rMmXk}kF^UXOX+Z!0I-Lctk7U8YJ@z=^_s3+Ng2 z)aUj|q~FCzsL^kI$pAZ$L_PcmIxUlCo~@Hc1vZHuICiW6=ahSLBK2j5i(7^G94_KK zfrD2GMev4$_yBgRtUkul*zrE1A6Z)8ys|DMbNvgN_p&5h8%%QVtk-7`nm`h{L%ODb zd!uMyKySY$>60qFP!_xdk1;$tM|YM_r8uz<-9a{tsSUDStnmII%~*7Wiyt%FzKk=7 zM=nE7Xr+?`0LP^SEI$$N(F`702!E?qjEekjz}#bp>`5?8+H=l3W;UrGS7IF}B2NXA zk7eH5Iu3M6P5R(pC-N1$yy zr$=l5m#!!>W()3kyWakn+;q<7QMmrp(88bVq*0fMfLM`Ham(n1k*Rd9&em?2mTm`< zs8PA^^70C%S>*2NGR#GKGg`BKoZFG47x!zX^7aRg-Y(J*Y|UYjVS%1Y*|D`rx7G)a z!mg!qkuNzz`ufT;6TTNesYvgk{WYdX@v;vczvRsVt#N_>Rhbll$W7vC?pgQq3Mp{g z?7#!K{F_lA2>o6AZ6{E6CO@qh(J)*pYts}~8geJdVNz=`treP8BTABeMqZzkBN}{d zhgBv$Wfijop}xWjuTEj2bKq%0|J3dVl8qPW%V{Hj1uHOU8okLn#emh} z5_?238N`gS)?3e#B6z!Qb=8`*bErk=^IU-5HVyW%Qjhpbhv0dQ*|LZvWN9&fig{=a z&x@{xL3m!`>Y(d97-n}HF9=&8WLzVu%&+X(HqUIk#F>cf@#swq5hF?zyZl4_Wj!G* z0Nfd{lwTX~tZp!Q#OJ>_D=ZWKsGE1)8gF@tY3YHL1_*)<{*b4W54ye2fw@IE+&I8o zJm-M@+`vIY6RVcBO3E+2Qz~nVqIzy}_YTqMj9;tCzKiiYsYrI>Is_xJ;OEjqvo)iG zc?rKt%FdY53GnYW>wlH}-R$$rZelw&upN$GA>4G+X~=XRLDo^;ds+<08W(&QvAjJe z&X?=}X!7qhp&c}CXSd*F8Q^aVo?bg6w_xgV3D}j4REnGvjCl`BABLh6w7F@}3c4EO zCri2R@NE4>^Rr<7IxKUzB|BV1dRNsvs-=LUwCgY=UGAG+*5!hHa>&?~wm#v(Q3-$A zqgf?S%HwoY=3`C#ot$l4wZ!QZ=Zyh(LGe1|U4Yc5gQ#IffMe22v9{o%(Obe#f z+4Is(*^%2PL`L-s+7$V;{EL&)voTPz@7v}8>Wr_H<`-c?y3T7iPq1VRWpAx#j3jTZ zb8c5DFfffsypob{n_9<^Y`EC`#Sb2S@|&s-bu>=lCiMeWMILNkFp5x#= zYz*rmL@sCGxs65*_ZTf12y$C~#cm?p0gq$L1MOd&7ntFiQRd%~jz}}47 zC}bMkJ&ARvmf~4rT*5BUdqIh6{hg*3csp*iZdbSdR=nf+Gv8x^on!?%?~2XaPDHl} zAYs%9;$UAM>-=W;)9HE!#^s4A3>RioLqtqL{Ycc8=sPuqlkL) zJaJWKe-A}N9XF?5U$LJA!URR=3=0MU_^xWJeW}OCx~U}r@9JV&Xt*#6SDFle^!uGk zDmE;p!?C(gFZFWMj;^uQ^UC3so-7fLFyr$XhHxaHFt50=nh%f5FK&<0_?=w`H8V%8kwNjCMH#UTFafIvSGzFTYK|w+G8a^4xK1mTqna=p${W zZpPI#(Q7|mIRtO?z?81tMtn8udZ@#-FHZ9{H~4ZeJn%3cV6yY$&6%{9reI({%&kaE z0|GhiesM#=i<6m#%oozi>Le?enOO#|1rI#@ExK{&WR**ns#`^%6Hhvq9!9clt!b3y zT^v~MB57-V-+I{0_oWdv?|uCM&>5#TMq$u%{MI+c9CT27R4_BTL9EmC`L(Ew!fB0) zW_flo>{qrr96E#=+bmJSJhKSQ+QMxvW?W1*hxMMo5v_bX2wVWsonZ)bE)y4$x}EWU zpUEZXaP%|-0;T7waJl_9rZS-zjgTd;lI&~TjVn`Oq;A|?CtVWULLf7MlMD3zx`D;* zQqq!P{mUNe9OgmKR(soz4GP-iU+Z!%{IaR>`qj<&j&^game~qrnZ5vEhnB%dA~1-; zfUx85#@Hl~{{G~QGw>$Fha&_o(1F}+=}r{l?mvlsuVRhb=8u$NjggZ!9M;@GzTw2O zcPIpv4ySYHPZ3;fe<8O1b3KghuOYU7uY>(v2Kz&b{@1Y6|E3Q1 z*LVLD!)bqJ!x)&^{y=*^l`wo(hR-=Q2IfBmEe2LI_D@DN3)5%D>7NKTrcY+||D6tI zU}|q;?e-_f$=t}m@ju|OuqD|Qd{<muE_-y`}WZ-ZzHaCR_V+|kLVhXsp44>OBVVn$_?u-#v7|nr}Cp_mB72r`7XWB>%OK`>x+1n4?njS;XQrL;)@{u2uDNKtSnX zSsw0PAmmKUSugPy6<^_LJtIs z37G^9LBX5oQ-Os-(!Q zx~uCuU{YBaTqeFkp@_(3wyxhtV=)9-4n_i+k6Ufl><{ z$thiMn>KURTj&#~nSlOU3reXcuZ+_)p4jqK3DP^Zv>w<#sJNlO=ZkZ8+^N^sm&xf(SjQpXEUHakqT`EJ<^z{M}YtA#%Dpb~87Q#K3xfp{Pv+8{FH zct@+h9?6b5`~4Z|pVCb@Mr+8WMo(4o?48N;s*#Ir~sGo_rO7cuaM!indDy|+>%p{?lB zzac7B;-^T`!$EtA#=yr)GKhycRu=+HGszAr{R*-d8f&-}3jPHMH zS5bsGs1I^Ebz&drb6pux^5k$Op%%`YO|Be69h^3%_98p~J{cHdkRwwlOSROQ1$PUu zN35pCX927J5)163rMBz$BaU~GGjo&+t;bw3%LGg1Yjp6-mPdiPXF@4Ng+@H&vF2p` zz1(WNP@+*Ae?x9CY`kd$>M|f9vH%j4dz*zoDTAV8l5mE1ZUS84`-%o(T38z&Je_3y z!d1)y$0XEfQ3ESw!RimiALv#K6F#`Vzwl8a(k2%Cl6Pz5;_!^*A!SrIe1gZk$T zA@Kq>M4BZ?#a$(A{ld$HX+@c-(iCM(MVCj^@Vy@Jg#oY)+OqFg`VRmco)0wz5v0vF z@`s47dt7&+5n{i%_Kt*4#rgI78IUBF0Mj?`HB(*MK!no)+eywrd7uv8!E$DLpdlRS z)~gk%)4gKr3&KeaN5v+;aOWouj%t-4i2GwYqSEz0=aAl^s*?G=`8JJtL8-p<;O5Jq z_BE@y9)R>xn)Ff`NK)gwWHtU-7!s8o@CNg3z^`M6-+6QvZBmvpWme(W zQq!W3SdZX*Fnd5^Eq*oh9&{{$jEo_s)%&nQNUUFHyXn_{<*Qp%=&IMT$Pc8GZkG=P z%Y%-a#zp0woB})rb{Kl>_|d_qzpOyr z1VOdOLA9f9eBNOoS9v-cZO#1%{*=k^@ChCTQin|y8$_5ulW}~F6ML#Q6N+QTqQ4Cz z)H2lV!B<%lv^v3S>sDEW>nlVSp95>JxDyszzuP1zHXNle@{ATsbEie#_1o|Fwy`wu zIu}wI?XJcPUjamXVRDReuY!Aq?out%da2#2?bg*h#}r)@lwA_J(y+L9Yv+|_Vt}V2 z5v!k+Q}ZyK3(a;KGpRTQEI8$EXcSgg(%Okfmz)cg8}DXbWY>eR8t)|6J6iQL5Xc?s zdf3kv8}Ihn71Of8_ea617;iMbzBEy+p$E{Qe|`Ve^bTOLI^n*p5OM%Pa2HP?uM6bc zkU25YTIoFt!Etgj!n&KgkR@yy~0kx%X~ zQ1yNV&AOKc18pO0Z9`|f3(G92d@LvgJvwMg(ZJJ{VxN!b(C9ix45#E?d*}}>ZWer$ z0?&a*&j#RBOoRQxakJO~Fj_js{3OYg9D`Lcw2Bp3+84j+WNeY|q*ex#?t<8#jKn z{gHm00Vg$w29gqg@|J&Tz|8%?)UK#uV)^egyE!a01ztR z-+~U#c7@#-HMsnVtFX#q9s2mi;G<4u5J{M#fL< z*vpOjBJ0%uuSxyDYML<#Ku3h>}SB>Cv}vb=^w2Y|9r#K+R@g=#_~Vt zcK)5wm?S1jfS$Ce3k(ThV*SU?r`GS!&Ld(JYRdMrFgYLBV6|fBG3h?xR-~6_dAh?5NIpAZ==`mSN@J3*X8kXO;v#M} zfKaFkG-M@vqL_hq#+IXiU+y9G`ZJ}Ga$Db;rE{kPXtamrOtz-1ZrHryvmZ)WL{z`69^mQz2@@1V3mE7^xOnf}9Tp=^aQQ|5)%D8{OfdwvUqeU; z&rGc%EqXR|r&epdLDT}3^E-k2;MC%<8iCivTPT=KmctIX5sdrl@L9gMix1#KIr+1f zDeyznc-F^OgUqd*DYiH~$P$c^YK{Sr_qt{uuSY>yANRj!WB8g^otR2qmlN9s$= z;aUc*GFy&5@Zes2z6!J(lsRt)YUYC}#O3QRiFcy(a#>&d)**azS~ zYqng({W5M7J~wVu0kPmkX&1QPbSM5|o+zyY*{i8b5;)VG;F{xeqdEoB5nKuH{*FN- z5f_J;2E0SF^G5xF>W?sy8RniKRKfAvBqoDOsP8h<{@wUBNIQU^!-t%C7})Oaj+yK2s zZrKVN6^&{bia=vDW6o?xAXxvTf(w3xmdeDEBrZbv8n;5_cM7N6ZN=-^43uP;m&jAZ zUyYh+fqDJCSoazuO7TU2K+RoJKPA+PWA;_6RVnk^!yIf;*{q^v4qcA2ctUHv2L1&M z!f}x;_jHlpmdp}k83zr#2n*DiRwHoLnA+|VXww{cuWx=Phk0_W6cPIT^(J^f&?uC%*|DRG!MNKGY=6>& z!D|S2j}s6p=+egBl^TA5xGlp^cTm?OBMRTPR^VBI*BFm1LHKSlNHWM_KHr=(RF^6c z6s#a~h_zHOBGu>vusHqk9rpRr&Jx?c+NM=-EOu(2VM=a6BQ6s=aT)!VsEL%0eT4Wm z;xXs>Ywq3bam=I8Y{XgO&rz$G^EUrkM~_U_-aa$h`vSccNLB-$?v7>`U@)Hzu<>mu z)Elj>C9ViD8~R;(`SqzqX3G?5M|@k77M=h>rV3ECN7)G}K*6C_R^lQm*>L_fE_`S? z{cY6M8b4bVWwb4NANE8CjGlD*N?#zF*FkBNi?Sjdb|2rVLbLQD4A1ORz4%f0+_c+s zMvYk})~l))&C))A(A&zX-} zDx=XuX+sGCAhFePbnb;^ygrb5<;y;hU6?I(IeFRK7?dnR(csQy<}4f^7_7Tr)8&yu zfXs2?cb7iy(G9vuyPc6et66IF>*N!uSBv@k; z0!_6<5*C_@ncKtlZ82wx37eYz*n`7`R4d(AKy+|Q0JiU9dcU;94f4TF_DvL2HI>Aw zdOIk@QRIEt`p{h<4Ed8p~?7usdK#|Vhf=G&B&xin>e{@r`k<fvDQy2`~Gr^OnFOQWRRdp0Pbf8CL&CQELuHe0s zrzxf>R|Y>8glWxZgmw60AgFOjf^%PCnLUdX132dU+apRbUEHg6HvQWrPD`SH%obVA zB}>dTJ>jT=0F8ZIPid&~UHanas&(s&-Hdbn?Kxyfg<+6R+ zl^nva2sj#3vYxogF4WBgD3+;nnO$*qH@N#ts6c_iY|Ly#>e$Gi*jN7VkihLo;hF$h zA1J&kE8F65leIjq)&afjyfZM4Z%6|M!j~!Pk3@>00{n$+#JkXh44M*>?Q+=2a+#R+ zF>Ua|ik~~A0!qS&dTHfWU9OqpsMD}@x=V2kS8^Rt%;cLxk=;T@U(^FWgK}p#R_dL= z7e}qsgd)rXv07mEA^nl7Lres)RxUss)yRCoDznMrxn{jYTgw!7R6umaxge}FL9Y|X z2&z}wQzwe~r&)_H73QeAc^Qr&7 zU(gm&S3w^M1r_E<^@dny$xa61@t)oxR9XYw{-&i3fkbr+ENC&!f~dL4Cs(~nIZjIr4`+#f92p(j|=PN_-J(V+X(va^C7GHaH7eO6!zoS2q1;87a z97pr(C^%Vs>mo({sZ24I2a#a{53&XP!;np!s(t#^C-{0UI&96by7W`tpmh+Pd4wKQ zvq5wvfoxZV4uPj`mj`$QSQLgaZlICdtQFNkHwuby-ig``d>o2|jhHtHZo#?yrE%Lr z+FYu$F~=>o8{k~SVNo~bQ_nk0h-z$hfHNY=1fZ(ZOA@-o3pNQ1p>g>uWinw!LIPN! zasTbj(|(JWe}(!wgaxV%1x&lg6JEXKGrd`P4ZuqprD#kn&jrvEvyx6fWV#!)$2HxK z$}ivojOecDdsD100)J^#D{};>tw}Gyn6rTsX|MXui;;fWX|}!~{nfGOBQ4^1bsP9+ z1?IrZ6V|*NVxeY^ZK>(67Q7omXS^FmrNGN5)aP$PyGkRfwyM_gFF6oh=>bN}C<_IE z2Z6v<7t#Woz;gTVi%4Brv`Ig#3WC@rLo3VUwa#q$(0tCrkxN%=KbHdFFCA?lU+qkm5WW%-bTc0o zvSv_K`jiopXo8tKePMq3byMg9UgdZu+!V^ao_5qT)E;q|A`XaEu?VdX6` zypBJyjaPNG@Rk=c^OoQHTY2F&pfWeOc!~P?*T;cuPp-Or%*WyV`5j<#X6na`hcuf_ zLmi5RU1{ywzo)%=UYVq7l*fSYb)S@2JQAk+n`OP2!uyjUvCZ^QWr+FR(oMS{AbR0apbI2?v$83QGUbx`oI9~N5`T%D#k5(>S_DqJjE zm8}hGPs&9aÈ(g(2N+$G%=DE>l9$j!V<2w|w;b_(9%p@9hz&r(D%+}Ak?l6k=m?Ta$?;*Y=$tv58`&XFoKV`r>W zCwNmAk5pQG@gG8rabbV*u4Q=$6loPFzkivX@vF zk+4%Br?;6BUjh&{ALPL5u%EF=$sv8PDY?@kV%I0>%6?b)8p4iwE7hMRIhJ(SU2pTI zLj|Vfu&MUC7Jn>wXrkbm!BnE`m#lf%HWvpulVoNAdGOrs8H$z|fC8b5&}~=>sZ_Yo za%&O}wqk5oBxQYBzY4aQKOu>s_@fUxQ_FG*{h;3$UkacZruuxXZ&b4WSi8DhgcxrA z^}R+Q3sQE1El=4+h8m5?E|Ex4RH$s!F)p-9sWh`TM0(O1(m|}+E4eoAjPb>6zEN5Jy{n z^LrGP!zO){k|Q23t;XBQD_8a`%I)(CguGQsw>Kbd?ouZP!c)8o|6v~BZa~+ivc|J| zXwL=2>T0ZZ_pqPABXeO1=fH(M*9;zS---@(t50yj1ff^9?v|>eBVp@K4!Jr~%s5VF zo89P3i(yL5IC?XyaB^T$(NTiTT)OYy=2k+9rzJGWLqUnZ>mRetZ;)9lqiU0EKYTdg zK?#6~lc6;ocOgU^x9D%@uhc9OZPmTuxTO)6Bktq%ZA^ngzBKQ??P%)tse~sjJ^mW? zb7hF{(M1H7tb>&dArbf}ph*~vygXPk)i{NVHpZbaMg(PH^BLi{zGks+#z#+5xAT)R zZxDcexJ7jc9QScET}g-XhGuHjQ3n86bd@C;yA(!({>9OfBGj)89+(~)tLXlI8@r>F1_RahL*a9BsDQnbO zI-!T~BC+Ogu+fL8f)S0FY%B2m`frN(Le6K`kxEcpqoAF1ZCURS_f`v=f9wBVYyQuz z5N!V+R*27Nj{hx}{Re8<|ETr*->^V1d@?RSgNEon6L?tYK2t+JD@gi3RsjGj4Lcjl zryb%`!uyO@Vq;*TXZydE%l9S$Xx>7kB zHp!bO&~26o;yQ%MmFxS{nYYYX_?e&N!2!^_zO6eV$Vhn@4J#Nsw zAOae4Q?q?f<^lmfpl~mVn>q`w!VI}kR~CboFJ`P3K3ASx{(QzmurXUdXyt{@gXrR17Cl8#p5cpb-Z92#^s^D{h}!^uK6(tKhi0 zW=&HTT1=KKW@cuvn9*Vei-wiSWcp2DUW+>fhJP2PHEQO2bS-qZ+*mqW zNj{u-#MrEKdBqq?V6=9>gm%`r*mak(9k^J4ue#&fKMg=lp%KnP){nv;!m zm-4}Pnc-rlWiS}9GqvSNG_K5T7D7AcHVo6@b15%s|207^^;!fShLg^q(!*qu8?ODW2_v$; z%%EA;&ki$zheb${LNRPZ;np2O=4;cXBe~vkdo8M^jx{3X$C40n?HAHbic1V(2BA=) zN(71N84P*2H#=M&M4nq{?;8q<&4vr|$SV-0UScH;wQK?5&A4ny3L{907Jvll2t97L zdoL!xnhS2L(V|fcalAQ0mGaIGjSH5V&iXtxf{!NuP7#^e>^0bCYnPAt?;N9-Qcobi zn}EJHhz4J6u60t+_gJGH1`gtU(9rbqPTySb=t1YRY&hS3VLyMLDHL%eA^$ow2_`e< z-##jD81Z#}KAhYb$;c(NLx2w&`y@hRLKJTEMH}s)c)jGIh4!!SDNGvp{z<9v=Q8!z zb#NZ`n8^sQxC7mI?cbtWNsy#)OE}}0t;SE=`x^^4pj(&NWg;Uuw~Tgx2kgs zea~%kJtV#f`rE8p!jIzurbw#Ys?iR@C}!-ZN(QnC{e!O(BcNFiQ9U(P*hXbijR_aavccX|h00zVty+1L zD2pNd`4fK#**Jx06{!)i#%vO9+~(01zA(($8q@W|Pe8dY3Ha&_e@x;*E(+47>!U`x z0?te{bJCuKCU~MsMNI9_nhG6fwSPvY)j^ctsiez%$W5Vzo;|ao(W{^dYbp86lT(@R z9I$ocW)ipiE{|hmyu~N5fXR zbfEcdD_zjyCVx8U^(|bGWt_tyPGJyDW+yzl=%AkrIvk`I+p6a0vn*FFc`HnkwQ`q$ zBv+oNu`mV+sl@wOuPeo%Ci;E)YCfm{bf*uUJd`m3^@8rr&VV%|Hj9)3cut1OLEUg? z%&>;!G_cE8I!rYd40(QZq<|+`qS|jeNj$C83$>4X)6cE2%MvvFt6K0UOze*!R>`^c z{Ay&{6m~%}asBk#={tQgf-B4~8=YIPi+*Xj6)olQ3`k#L`ox=0%B0SX;bd8E-8hNL zBqk^#3*dKWuQ~}O^Na$RB%59)Qd#G?!Ba^C5rFtyAw5bi3q{Hjw^>)qZ-?seJ6iMh znh6%wv5iek83QA`6Db2@JbT#0c~UkxkCXAISSFcD1y@^|Fds*?gVZzHhx#hL zXQ5-E`e}K2(DAc=7L=afwT27f3vQAtGg79*vs$#l$@VJc z$^ov&Miou{V>hv_F;Q|f#BwGFDUb#Yq2C_r%gY2xAgCIh_6D)u6*3j*eWAFC9a8%Z z0g+$W=Q+&n2kX|*3@}EnZg`nbo-(A}WZGPlYw`k3MWjr32Y%4w2b;z!(8ua1YK4Y%HYp$2;EgKohGYY9EFCWd99Vi)J-aamKTl2KhMUY(6-6s0Q+?Fe}SR1jHi=A`EDWf>lYJZ*~oAwb2 z-vP)2=Z(8*jQ!TkTWCRq(bIsRJz9V&78_U-6i-$)X@V*qi^ZXzW$K)Ye0+FCY>cHw zCP^xs4k7+n&?Cy$ATv&oN;Vu-d(FDjAWXoQKq`Mr8OSQW4kiVr5-sJvIXoL_VT*vf zz0QplcTO9B;_r)+G;tk+GnPTFr)ALRgVON@EK2DO}R zeOS2#4vY49c16PwAMvw2&C}_y4P^m~9|!Q`1p+N3dT4=TYlgR<&QG8u zbE&H44!6t}wxWx!=bFHGH>-mKu?6dE$gA|ce%HHgjLA|~i7400^{CKoOvB_PO2~dM z&+U51cXuXlmpqG&%^HC_lEMNI>%N*g6Uq4jsBaU{b(ztzg;`gvo!#kzso64s8Ery-l%L7 zUQtO@|2L}mA}-k!#WUoz8>L|~_T78L3e&O$d@)cMReKCAK|RXw{A5b5Ki7R*R({jR zo4r#n6N5#UxTY1kc}oKHFfR9gkVy8i$y4QD!juklF_$HE2jzh%JZdONnZlc?^zuDT z8rI|@D0wy1j~3vi4Dz|mnU4=X=vxWsKpLfa0DSJAJ;)a7lZ)InqsIAoTL4#$F-VNV zA&TQ0q-7n}%Y19#R(xP^Mi}p-PT;-nRn0s7zGDiB6tHk*!O*amp>!zG;v)Brn<|d^ zefDI-uAhN@qAhu!Nt8JPKWUdg*DsOxi>v%Oy&KOEDf~G=ztFfh4S<8ohRTCvdJy7y2b?$=3}(eSv)pu_#M6oii@8 zkskVu_Wj*aF|tK3zmEMsz=wm-Q~tn~BJzI-$JgK9Y+uHXhkl-2`Wi$!9Ii+FTR7f` z#D2Xw^}*rkgdYCMIZK)gKr&K#&r%*Q^;g2^Jz;UVI0!=ZoUI=G8geD(D^-}Dwk119 z;%H`-ykrmI#8Nl!%=twNYqI%UZ8*GbkEJ|Q#4Lkk9!3+9(CQlq&DxhxLH#Zh^Kvg~1lL3_8BH_R z`icTxfNPZ8H9oMSf_9FrJliiH+as2x+bnj`IE5`78Ea2t7M@G8)klJ;KeU^iL8AY@ z5ds%fVHTc86017`xQK*Ps~rrEdf!gx3 z1wpV}@I8=)H#XH%ENb+#tv?JWBO6@?Nsm5JzW$g&^SB6NMhmNMe*-S;YlQj147anR3>@E%wpr8qSZOiW(j3b#=#!KD4 z!xsVc;!2?#q-cNZ7rN1qxIKeC?G_|1#9FuM8_3${zm-A+FwK5YU%;AY;D@=w*q+-x z%Bvo=b(g|*Lq(aRndRnx)0+in2N3j0Sb4o4e@l+z6Ki-b%PSP=RH$5JCfr@syq`6IN&ci?l5o)E)xvZki(7zukofa?5`!+eokIyNEjiR$f1#(%f zMP8!QS!3_Bhq0?7t|y1L7-U{udxv)6^OHu&>K9(5)()==%?z0}1u_{fJ?e)^FAH)% z2Q}&Mo-~`02%-`J<~}Y}2l=W(rl?sho5U z$t}rMkE=rhJ;$Rdps2tmH_bMT2n^yzzWr8H0bk^NZ(p`~m3!8bF1@~oQYuo*R`XZv z5mE-E@}P}JnBg=tCbBM>2KtuacGye`)UkTNpSG?|kC%7l2r_=b#YvNhNJ*M0yPK5m zU@bgC;6O3?I|Qx3jL2VYG$QB{Drx;j%FvQ?4bFx&bT3pbeZl#ZCy6if$|912_t{%g z-=7!`iN0zHgGC%R?PX9QXwaZW8L- z-QEz}^)qlA27058f($$M`^!3h*T-hn$6819oy*I^WOcHkEq=P{ENl@`!Q&LryO6Qs zW$+-@cE+dvAi6q~H*kU4^-6L!srMMN-4?H-)16^UPGS~eEa`d~v6$&gIPtDb7Y%yJ z3)HmT@^yLVYX8yhL46RddxKD1Psm_w^VG>Lpx-|7%JLj3(T=#KR}-LDBmbzpr*OF* z{*mY~<#pezqke+p`{>LZs?sUeIP&G#O6(7j(t6&$rE1+f8SiKolbB7(M}lekX3{kr zhdR{m)5UbH)zlSB(iny|8P1WO1vop$F~GfTb4hY7Vp}DRBnf>(AM#q@c?W$@KVj!K z+hcaBzO`tpjH{I%Q%=YuN^VW81qsE<%*`ll<$sRBM&IoiEUaO!FWKxBxQS<5^x(4n z5UD6A1o<TtpS*p`uoEW@lcfW(dSL&xUtFRNp~2JL;=ds&VJ{V z4x5se)+AzbnL4M7Db2g*=^K&OzW`kU)(LB@ z6E-buu0v+EkfMjFEAGNcdpJ-wT3K&p2WsWs_&2GZ%BW8;o+C{$_J=`ty7G1>2!qeO}`b zE}7)IJByv=o;E(nrokE(c#+5sD9oAxyc1sf@pUjyjpg20*UEU%ntyj(b_ytJyy=dA zEGX>`W!(8+g68r!Ys8h$cR3A6NVz2!`TKDf31-91J21>ik3*@N?mtg znN3btyKGM!wj7(NHTI+Rz0lsTuEOe4Bs&NuzKVGJ8mwXQ#=dmq#L3Prf!Tiea)G%H zXk@lUSpVFytp4mx?~>h7lxJqx@YY@1^5o|^RHWPn`uZCN9i~G_*?QLftyPwLAbfg6 z;W1JCY63qJWNfs<2~?zK0F`c z!A+MCc5*}9hBZZKX-kc{8w(KC$IW=ee(t|Xhj=igzpOTkWW}xDnT^%$*zY_fQH7YD zoZ7d&XtmaSoIERDq4A7@Sf^xZufj+@zaGwR?DK_C9#VU{0xkt+uQZv2iF`Zuo~!Uv z<*gEU+CDU|_&bEFyG7tM;HbTtbef&-l7d#!PTIq#eX}3!VD)+7alc-|mv|f9SqG2H z|44AJkCqwq=vUF+m536jIu4}NwPN0xxVV;jm{($KhldM0gN9nBv2bN0x_)^uQOy7! z{SoF=7(NR@4@fPHTy{O5+jRY<#wd3P)1}$(w;EE~=oM(}wk)gRuf@Ac?shB`!63T@ zu!g!`=ALywem^}ArR^upseX{?-i+Ps`b;JmZ6*R3LQYWmt~5fQ=)Vv)0OIQGHq-@- z!&PtqZK9_tJC&$y-ubFXGEB)7XZ}bIEoVtlgu@^osPb)tJHI`ZzbgU}1z@%=_Cat# zSJ$SqKq;gC+btHMaEnm%=bll$WhH18nhIr(8JjO?<3w|)P*1D^Z-f*= z@Apk$Q!Xr4%AvqYnxFr0{--#FEtQ#GxO(LPbMtZh%Vk3X=|F^-b?0uW$nR?;BA~FY zMEhC#{lbA?`?Zby%GP!h+l2r6nIYEK31$I2ZPL$2LHA;R|E;N~M>&%RqSqkc&_`-@#>@HXM zw~Zran-+kCtH5-x_k(a%b9-9*C7k5*$ZiR;tCdXV%JA86l>SA+K^v%K6L-Hmm>$Dj z2!d&kf@x39gUN@IbStRhE}g2r)p-;o-LoisYy9cv$FKK>xSG#|PH$4W49H!OPYFs} zjZubChIF)aQ}(b}JB?mfWn2b&fyUfusAf*pTMVn8YCWmBV&BfHd_%6il`i^5#yuI@ zl^Asw=j>Wo`RASbm~>-ZDJ&aR2yDQRaAG z=g{!DASPa5sKG`w4*sg=7XXG6UJ;Yn>)7GTwIglLooty$iG%*_Qf{?Dbf`wipIB7J zkUAm9(+fA047=O3_RHEiZMKkJ8g{DXe;iQ1sGEEqP?vPD@jCsM{>uBfDEchjtOSlL zeGZtpuUqI|n=bK=`W$Wcr&*`kpPNO2ZsnmkafEJKgyycnNDcy%g^hkF>Vzq*gRYEJ zF=+AEP{`ZfGm0p(WX%7Zk3%KF^^}M}T;M?*zgjwA#}~&jQ79CBzSfz>O<_Cd^Mi8> z^3BMbmfmZw#vr1(;-k5;atjIsuoH586b=C&3FIOtR}wM%fp5-N=jaKge*_w8r1D{k8kE37CU<5#?tcER0pwG4@)v|L z20_0?>SB}0qQ*Xhhr~n`q*>XpKbk^X&d3ND#PiTGIaXdE0|Rh+TH_!W)X4u-MfmT` z(Kj64*z35M)t~WNxFaC;WX7fF*CT8c2k#0&Y-j@zI%ApK$X|ngD(XbQIwfC-$~BZb zvG-kBTddFx8?~R(J=Ha}X23~9r&@5Uv+v7FwBf^jKYD(zPpIui^V!D`L`%-@Tx{%c zV$}(iNaql8+dsTs{P;a}h+%N9{ZFsW~MmQ8HRQo%o>XjBN5&88Lr_NmnlptV+~$% zHqNdHLB8a>CPr6jeyN#kjZ4nMUT*sYC~}2Be6P^93fEWm%D`8 zaa$3jAa|&rXDT*Yg&Aju^i1@)oY<)TUg!aDVZw*IbcKwQt9jIiQpn~*N^8*`H5u** zOhOw!G4oXVG1V#_ku>^7n08vQ5Pt3r`0j1U)*y8UseRp2>l~$YAns>YVn%6d`bk3q z1S@GE2tsiuH1zr%`Y>8!25koNLvblJImZUxEXo2=A>PVqZyOX=7l@2BiDaEbb5ys3 zcGp34?R9kRDjqoCX5qQZ@8>(atxzbh`I~bQ=p#Lw-JOyhR+~F!+<~}Gy4l+bbMD0~ zTj)W=^8~E0lYeyfH8zXtGP`TOG#D=e9JFtxk^553Fc5<8ykCdNzUe|@QXIO{f@-fJ zIBFd)k=Tm!vCSVG?X??!bBEgC`ADp@QWj~?^0j~x$VlC&2)yJ$-K{uP%7k<|eLx9r z*-R?;VPOlJyDQnrUO#J%Rk6Mxez|4^Va1w-q8@asx9!omEiL^Jh0MRVlMk!`kg-HP zmM&=FNa24T57?S)-$$r=@Us1k)Ed!0RW|6vy0kMkxE3gtOzxDP@b-R$g>4~IUSC?;y>?Qo zviv=Jqf^_mL@bsiVLOayvsYxb;`s47=6QqnEhg-;i(5*gtS~ETS-{gd#0S`1yj&8a z#pgT#Bj-P2?f-AvD4hR7Vg65=n*XYe!uG$}M#0Va!U)E~#+am#@dXR0aYaRXAiP4x z4#tJ5#U&r^v$R;ECnm0a|A-+<6N{0Vyen6U0UhpjZR2;2QywtD<-v-?`S65%;xF>% zJgiU{+Mn1y_hBwGG;0aIdVF$sk4{vt3SbqhO14Kx=hv`>^M(z{j+dsUY~lU;VEc4@ zbxPQ7)A8#csR{CruZ2Jlc2OUyE!>CK>;BaacsM@r{C*V-Um>#qsBFJVS|Ev$f}}x| zonKD~xE(l=1a==n9*mnbmjrC_zeA6ZT-xdd4l$t~J;X3xNw@yEj)c1PxT{r^TiNs)ar+`#^3*ovXKV&c7}mP^g*q{f3oR<7BtpZetS_ zW{JN=VZFEdDdX9q>un2bJ zo}~x3k5B!zz8=8f5`LDEQ>{NfhB1uFrm+1{&+rgDF_m~gA@1JVZ6$}=e5H*|OoTP+ z_RKQPclKjo-_dWCXyzbkZt`j}e7vUZ6#gzQ5EB%ry_3GhQ%NiW z0VcMalZowte-yR*i2R1kRd|RWzeifYCmXsqLw4a0PXJ^9;nEJnBCgu~jk5jGLcL$f zldm(1|GwJbT05pvNWEBY(-V?@j@zq4MQXq>t*Bu`ywC7Ae?kx!jFs_pr1}_)r<4^r zKlbz2OZo(;6)%qq;im@hvHQTs8m%G=BgOS?tdHK)HUMAO)1gI*gbJA==o;Kv;w&I0 z-m-v55)dhJ7b=!n5|Qlen2M!9AzmBgvPuZNVDXV;=d+lds#r5Q7KRSK<8xG07f&&B z@0!LLeb&<4v*_)Tb=tT*#J}>4ywsBpe015;*+C2{wjG7GfeAWm~yTugbU zGqKUig9qFzv9OsM5i#l+eHgPIE7+{z{MAq{OJKve3I$T#l#3YUl3L|-PC9${@xUmO zzlU_WmNc1+mUW-nPy~PlIV6Y9hA1 zVGoo)s_AD1e&+OK`yn1Z#ag~_sk)W1q))neLi(u2D6XucK2NZILV7YON|A7#&@QM! zVW?Tn>x3=iCb2_NVFN19u9jrPMu;VA!x$=^gb%jDObyNaVk_-JDyO*b(`Ij4&73nq73{VZj-GkE(D=)ZI)Ewe~bimR06Yo`cl1DuPf z6Qd}~g%d~*5YSU7XWn8TX7G~LMmC1ZO1Zp|Uz-LCV)zNr3ozeZ*aIjvXZ;a$bo4je z1L`fHrx@&x<8$HoX5eAWId1h5)O7pjEcpw!6Msx+3Ut0Y4gku|d>t3Jwm9oHQ17#R1VMR*zr_&)dvDqx7J%jE1@<(5W zXGQ$2-Zz);ZVS#DwL?EF^pn4#3>pibEytvy___ROP}N74_PQDyePu2oIS%e50vn zWzJ1VaDXE3lrU5l7UD!q!~@K8dLIH5^%z-=7mqWj5ph^y?416wh$Chg{W@2Tm4&Qg z_H|p-ao;mOh9X#qMLUh5=Cm%q`kf{3=KN6i?|Tq^Fgbg_RN(er9G5)`r0#9JSs=yV z*zYi?+60SPl9}Xie%U*zOWiU>t)Q|&t{#_4b5uxikG<6rcMoJlX+S2*4t+?~H;MzK z6xm;(RYuX7Pzgt}8_qKO=07mU9CtD{zxlfv2WWCzcho-}ooGZ%KP58NAxQ@%w>l^5 z1fScnuLxi%BBhZy!D9-4-{|(l7LBhaS}2nJ6{$HVA2`0lw^&UAgVb8Q=)x(Tx&s^I z-niaduV9zlf#A$@m<7y0g#2$LqSA|!;fzu(z~ ze79viY-m7~Jh&F`J?8tqmygSYA*qh#=$JudA`bu2&!6NY=wS_)M8Dt?aet zBtq?pR>Y?C4@u34v<$xm1~i*Lot0P)3H|Z@+)YpQdztFf|_^x;T?relcVS zZyougi^XX{05CY4pEA{qR?48m%!Ic}>$g{8=E1Kzk%*fFVjAj5ZBeL{j%NYN}t@+&sqEZ4iqKK{>)yI8RsPWgsfTM)sSFOQB(LEt*S8eXZnku z>93$Ruc*!9K)_mkF8}-V8y=L3ks4La!@>ET9c*R@-QleF+{exXIhSZ#fJDM=&kRVn zp%C*~tK!zh*81$u6z|@iBi#+kZ$%(VMnQC1rgyxjCl(n$ajiO!o3gc5Dh2)AR8dp- z2sWfOv^8+PT{coUSdAfcGu+kVC4bjbH6)>7UV+7d1{d@5DT(bxFtsD}P#O;&JP*TG zs%0>##Uc*fEvRE!(6-G-0k~yH)uhZAvlCa*Xz!5Yv4}x`8VYZfO67BY(moppF_cxX z43(bA28%;YDLx-KN(1z8<`62j#qixVE~}aSTR&^rD82Cg?Wjs8(9RbwDoTl1!lB=H zeC5e!xa&XYKX4UNBf(5QI?nu9RDLk`CuQ)=nVZBAJ5Kr0>%Jumh$-a$R-#~GjQc?2 z|9$d9mG(s?qx6cP0e%gET6q3+3O!T{++exV4}M z{DbB4GW6|OKYu}Hi{tq{@SlKpFnDW)tn!G4cywMDX~0%(Mi5`%c$t_1*B!j_T_iP6 zFDD|Bw|BI~4|Vg`*+1704~Bb#eBdr5Xi(1UGL&xgx8iorCVY=Nf$!_7Hs85U46I+U z=Np1!{qE&S4ITrK?rMITpTC)3zm{zyaZY(6a12q>Ps zwVsHdpCUEY^vMYV{3|8{lExIC@{`B(_EEy+7BI?c7U>(%Xhe~7i?kkQM9oD-T%?u& z<2+VDuAcQL((B|2ap}6vGg-tTq-54y_BO(q@L)gX z5+E~z%*JS}+Z?P4nl)W=DY>e+9VVkm!#ZU}HD`|_J41;~^@)a8$hmPZgKAW^f(Mgm zF`G@&a0#r*Nm$tfH^J>qIXzN2>^Z##d%gzAVELk()^&WUKBknJRNt@uhG?r^B+5y% zE;pewl#RHvcOtlo0duW^69#?dD44uF9l&nBlEEtb=X`B(AwgL4SnM_kYdGLu^O&Wy z! zI)&nbTyV=;?r&9Xv}08xg5^?ystex$lOsxo=V%xPr8DeEMFuBE3Q2*uBl-zHVV)_5 zm_Hd_U&vA0=`zlV=_a@Q_Kg8yEzXietZ|fV?Rav+O4fX^z}7Ri9d^gU!YZEUlrvqD z6u-IkLp-vfzXxp?(;q#2I}!Sm-m}CjX}^<-prM3d!YE^wPmGfUSp{2?CC@FEQ<|Zt z%k=wNGi9lvFz0+%Y1i}}$#8A!78sclQu~sNK_4VWX=cD-SorPB4BLT88gu2Yf*jTw zp$oH!!6`~xD0apn6YaJtnH-1&rP^7odOWyZ zYPD);|FJLZ!<*}G=UeOUK27B1T$dffHlw@$a41Px-Gpf@J=<#XC*Ila-nN<2DrxA(G=_8ViPWpl`{YKJ-FvKuSi3oc z7GVrl)1e9lC-PmYE8_J?j-_t;uFmm%FshTs#FC)YA1sDoxYf8d>mj{Ei;r8bRjm2S z)-BASd^ab;&jB!Hltv&IJIbYbFe=)}V@3!vA0I$S$?pzGRu4_*+S_sK3CL#|b0*K< zTX%EGU_#8OjrN#UDL7Tq$y_*=uhD2y?6+vzIIKYEt!Rs_y%I_x8?hPm&ZJbPe&_CU zDj#63C|DcD!>use9g=1J+CvbhuL(@y?HG6c<$0`2-zW105l|`h zAcs>JLc{$~TCf-8!+reWx|N2xhx2^x#7F*=_&3*qX}f>rCFO|qOvVK=0Jk?5$?b-~ znJ&;>jbMbT)b?f71I6rc369>&!`}9Xa_nx?uRg1+m9r!;e=q?Hyx7K@e9gP6YwS%J zd5G&3bt6EZ2u^lTUlEd{BIsPT>K+07KqyE|2@0KWl7Lts(Jd?(|B@lq)3%)1JFP=$ zqDXk`i+u(=?fw^Gc9`QS}^-!hSZR3iU=V`gna`yWaZdah3h#s5Re{U_)DzHbK* z(Erzg{o@|P$ihy?z{<|b!uS~sE8RaXGM{mM0zf`Z5jmJYKV|t`GBGhQ{Eu<{uban6 z{O`zN{%bW%Oy#EAC2|}iKg4FR$ErPV_3ev@tH+;sCBFZT zhRlw znkP(kEND$C0}LB&G%)w(YV*-&!Jp4zVVU%9@rPxqQiHUw{Tas3RliOc_B${=1aI8y zJ7-(F9cqHwlFk*VMDThqk4fQjriiX0m{}j&U3Cds0$vVY`MaLEA8sFxud28w_m6ef z*DWA>H6mR&DRI<7ROjvKp;Tq_sDD3&KlD+1xQZZ(0aqMYtVw-~c!A8Gt(j1}UinxJ z#(~TULXnc}?L<}hX;`=2>)lP;%%hvrQ=Bp$5FdP<@4w~d%8+6F8jthqsmx#4H$6Z0 zT{cl=4h8tH*TFIE=rS*QHr9y~uSGfb{hL7Zk%{aX!pZM&>J2?bQlXi}tLoGR$t;YB>=OsL%F>t(KP{QkOqelLz{fgM9#|2u~3x6H3G%xNeOTh6eL;$AsC8x&e@DRTy0P?)7-W5gmrnwK8Nd#{U68Id8#E= zf~wM36$aD|V$*P((Isvk39Zw|O7`F;!GT=%%GR^Eq=_{OwxWeMYtduv5+(^EZ5|uO z0(-gBpxc=ZgE+Vk#pH1W!ts#DC(ZBG6F@i;He_DEKTc3N3)zLV=&R+0$X${slBdv1 zxGgG^oLxTN_AwUf$IZc5m*=BML`eFRYegA;SkH~pyZijYSyCvJ$6yH0YU2w)cB zOlxXK+)6a5K(nbJIG7@B!3-OrBrMh5rLNjL@F9XK#)RoI5!+R?PY$MIrIDfZ2is2} z5g++FPvq~L{--*K_PVwEG8ek{NQ^>|LR%o^=LgZYDnSYT<+HgHCg22hN_bpX+f?jK zhgcH@-4#hsDcxw7o6K5vcq~Duhrkd0nZf`y!NuYN`!eyrIkUC9ru7ROct3UhGw{%X4i8Xs0tf4QC@~|FB!{!n%;I%B6Up@ll6OK)N9D#lPNV7{$`csa9bQ1{P~I&<@GXa{ z{|p483ZVsL883LYWtr=MBPc$vpW;B}3SXCQ#ursrzk*H)&?(XWooQ%>j(GJJ~0r=(wD2(f{l4a7N!*KWqLERqC6KRZj zhq!2*^`f}Z^fcl0U{XLTC@KRpx%5S$B6Bv|RXNYzCRWgcEM<7y&|`IiLy!Bd+A)P1-vjLIA-*0x2~!mu|}(SCsVJ z?8t{Hap*;Y%n})iRyzcDT-7(~Rk0ypGUh1cdV}hOBdh|H= z>MPD|MSN|C<++kWOE`J$CW8hn9|U|Y_pcxEawKN$nPPqIxdu!nXt%OZ;`bLn2yk+$ z7#P0r36gKgn*$Mg%QnS<0S4h;mnhatO#zKYBAb0uvOih#8+c_yI*d!Jc=3R9 zl=GY_aYZCcaiLNRNnWaM;i=!^PLgIG{*np7(IqIz_6s2YDsrrnN=3623K{GQxuc)= z&&#Kn-!V_f;OiPN74t(6#97K)bH&|Z&&W0y7$xt2A9gc8kXrJIw_~E42JX1&*@~3X zXP?Y~p(O&Dd<&z?vFP;xs9Heuvp)xkw;DA6QJa|D@6x0b^%%J4Qex;`#8u?*_j;Dd zeNVvj(heq!%DOj_8>af3ce=ji6JC>;fkB&He|=$nVpMB$Q>x`A*5|b7-vvZ1do;gL z@$o8-a##+dG^HielDg$%e&%I zZe_JbmBVhGFm0A#z0CetS`;{|m2zSXjVo`4X)o$F_oDoJn~TZG$LjX=&Z4;9iis3h zVMzg;s{EDP-Zn(l>|=!0_Hi7tEl;&xg*a^&2v#6?ex)vG!>YZsncZv^;76;i zhj2VfY^z0~c!Zq3Y8v=&%t+)uTemTJqwT5=~R-%%h;x6AF<5x~m9-K?$K zKo38=Tsf@ug9RH(Y9J!6_|gXEu5)H)%MF_)KjwY6`9ws z351_2-32U^Nri*rP1iRP^X;ExHcMr_j%JspY3jmH$FtoH?6;P6rIhsMrfC}kr1isJ zR3O6MGlLV>jeAAG<&5H~$Z!Z7vncSeDEi91k;Z+Pj?%;YwJLlpjQM&p(#C;W_MQ;f}q+OZ}I4pzxYxlEIAUrt^f>A8Cr26XVTiCKA+#WS}7>`5_2b=PH=j(UuI?v zA(6_^H1xDE*>^gE(~pvQf8=XzdYKJvkI%QG`wN?0$YSUl^DnV@_lzdMbijI5M&2;d zsFC5ML;IKSkwt>*2Xwd>5IIExgv=F3zFa>6PGZdL#HICDCCx0&Eu0oNqIXG2$WZq8WT^EIx~UK3Zig8cJ`~laCUnu zG>Vp^IQT zBcDBi2K!)w+eQ3$x#OcL>AN7U+EXx zVV`FVGbFPcr8yZuyMs^kzL7b;e|z!saQ|n4sddvlcvhoYSk}XtXC&hygFMQKWFM!} zW>!gVaZ|!5iN*vVrYi07^yY_T>4IhRJ$jOH$m}5FYVvMe0aYPHG#k13^zxk_!eP?l zz~9zM{gBw3lb$8+E5-?mcRP59_AB>SX6FSd+x%W^t!T?XyXY9B|2vL(27QXK?!@Y11M=76IR_0+De;0r>`CWM~_!j*nP)B%<>E1SEM>x zDZKdogOu$!_1ouwmj-Gv(TPI8RGSuaI`ve^!?&lF_dw(ycz-FR9}Q{EtCzXmF+eU6 z+D04vTYvF3u3925q&iUE+M*6vt4hNBzUIapo5d>{2Q^E~Q6$Kqg+C-ZQvh>ylDMNM z(LnHb)h~CydthcwwN&e9b@G_PJ=dy4q&-{VvWahYI=9UU+82?Ec%_AV}9c{YFQa*uNV%|C7JQ|FNKoll>n% zkpHDgAlCoQNuc45f2=c@IR3Mu>XXAcl+d|Uwe`nau!bI_$B%FX0}L-JJP``3FUY_- ziQZD5c&mN;LXjnkYC^~U?lf(+?Bjb z`eNDd$GMe6>$U=xuVcL2r=W_~1xi+Xf!Zh-xA~DYqWJS>NYEwt^)zamPQFDX#+X&b0**-3D3Xg#9NA zq3v#Yyw6Sky~jDkb;t!oh2hHdLXlg~pXUKO`%ZvxD-v-M(biTI`JSwNTA&*~3mmSQ zkg=I&RCI=F%wHF_IVaB>JA4vx>!QW`GwvLD54C+6|jE~`VQxofWO;AmtIdXmY03|cTIri~qRrjhC{od0m5Ro}|{dP8GMj*ADI0B=0X?a{VOQNrhUEEwu2D^^Jy_zJFWo zZ7d%;}P+t{2Bkdo0^2 z(DjWKYgfHVXl0F(Z@l}$gTLw@tMXtGiuy*3^I=ipMi)j1mtO+e{x90zDLm5dUH6ST zww-j?v8|46+qRvG)3NQ2ZQGrWZ5tI^z0%)*&b{`Wb05rweNfj`Csj3S)bqY$jJuxS zeS-^oVsEqC5ie?f@^P**fsr{fYR;CxX!FU;Ae8XLF4SuKMWV$~Zu5lmDWzx$zC{Y$ zTB%|H*Sd7ErdOOygAWBI@#!}zaFPj{;^*8?*esQ(8(569u%hA`bLuf_h1Hh=> ziVzlBV>D=9*H|{zjnAajiYJ*3FbyAJ{j~lzz&Hj=dOXa2K41 zBl>Nx%C}4m(3TkdwrJ8m6lvBfTOCWo8=`&^bqO1bGu=SD(!VYA=rutK^t_fN9&JeD z^^b;MRLGkYo<=WeONxj@5Bb=e68JdD>=A-IySxKt8wzocQ1x6%4a5B4oP90P-#L}D z)n|IG(siq$^{xWW%@{pKY;~c!dDnUmU2Vkc<@99({^87u&u6{u8y^HU{*5!!t?PK_ z7cds-sP7P>Ja004W+`l^;VIXfhqF3y=4}5n-n~CxJ^XC0G0k$mzhxThlo|uS&-M6* zH4b}qEaeKFDcM-w{l31Z5WTXCHVCqXwvAqLmkj1bZPM^c5P2ffFo^F=Zh7=r#0LPc zTNdO|NZJejemZ6tCM#qw+d2_QoxoHD#wUB?kS5MD{!11HkyJ3 z3PlIiiPxLGqz$%4S882M;gW@xMxPTloP9|{gpscJE;D*MbwyyVHT(Wanb9*^{;IKx z`b}*@e||7dRkJh){qq}tz;BBmvw-djV~jE6`wcC+Fm#t1y3!)}MNLdjDnq*?Fsej? zg$~Jm_!GJ)U!6nB6Rl)OG40T$MI)ALrMd9Ev@02#Lvt@yNz zxr;=)3Nnu!?*j*4WORrcN`}CYO#vaf9?yK1nuFEpJ4mVn`-HBfN=dnU1>hSaTogj~ zh+2Z)a8Sl9ekT5_fCW8w@#;~LTGAYC34u9WFlSsry8(6^Ho?4GjF+F-M_ncstrthP z@2ah>=gK$`xOc;km6IOn=OuR0ocU!zvi0*!U~Fn!h2+J<7Pk?oWtB%s6#79(x`@*` zXzVQigfk|`B{nP@i`HA-3rNVg?DR+4tUEld8~4mAuxARhml4QIj&QU!aNhi*_0mw6 z;%H0g+*FOSxQX`MvErA$o?T%#6_~8&jgy5Qq4OJ9*94RGV(B<7zjPnE`9zqBS7UhL zvPd4)<@&PI9z!!l8$ZeY(SqvH2>jX}`ituuulV?NTMAz!JCYuU8epM^yVjt%ODES6 zST}&QcID`xaYiQI7dV}eS!ejwS4Tg_L!=D@2SJ7=TXD3I6|Frh%3$>XBMwm@3*KBU z1m>au(h0h`n=TXIYgr`L$aTW(EF*f1`Kv9dLefWE@Q^j_S|{8G5CY&aI?hB$VBki1 zA9+0pF=1@(sY8Az2e7S9r&^<#J=8x>`^6{bFExcsDU&&n;EWGWl=k*>)0LH&T*;6$ zi-H2cpRd4^gHcfaeMC|BM-}rVihQY|PLVfMQKFmz&U$ktC}E_bGDitU#4Hts>zcU6 z3)DAig5FXW5O-COzeCKQ?fYjn#AEIJOM_U)f@Ad^00u>E$ibFscAYj=wr0zqdfziUHhaH0}=^!(ts=P}BEyMOj-=di2S z@cN^yZ-7hjp7UC$0xy@ms8}pLz>1^hftIs2+44u8S3Oj+pmdpM@XopAeDyi_%r09J zqKZz zRDe%!@H5VQZs$n6l1zM}s1>i1Rw`c%;Ozkk@N@{s%j4aW^!64vZD`Di*l)k0us2*w z>V1}6CVjgtoBNExDdWZb?P&5*|oT;y;9NFlynG6U+B(v%Q^0663ydq858Wi(BW2dW^<(uU~qm{Yc-&P_2jwB+gLl_ zX8kH#Z3BhSopcZ+^@0X4=luB0rJL&>JH3M(&*6qVcqS~c>#jVklp}d3sy}7t&HNkj z#HH%`ML}fgZbno3bcH=nBTWvymSstf0PEIig(;AozEfifOV164-WR2)ilNWvs36_1 zt;f%vYX;04AbcLcr9{exCKbFb#_;87y9i{&*(})0P_5K(vCtce!8FPUeR0C)g?6{^ z)+@A1sgP`8)os1@p{C%t2;}n>4(?3f?I5JLrltSw>iXgOcf(9jx=lhqrhtki-`w?p zf6@Wl8ULvu<}ss#s`6rA)QFeI*2?K3F-QVR`(&Q&N_3q*{2v9*6Q#8Aic|}_6!&47 zHnbne)0F%(;VR26@wX#-Y{gZM&+g0ATn}D&-4I+YfN(^yo)RBVofmshzp9_#h5JU1 zJ$hHXXBMZgco$tv_EsBlv)Xi08$9Zt6}Y^Q1Jr5Ek(B=gIxRw=;Mm{tFD=oSN0S2N z6Gv`5xXy~5+%9*F4=UNnVtu^4p;7#izJfXM>dM8a&JwVc zyivq*Dv`}YWzTH(#2Ebm!4`(--RJ@5g3#V#6#3Vl8}DE9kWJnz`s*{z1A+3M#&**~ zJ%B?!AoVw@P1cr5fOlIuIY1(<&X#A*r3Njm{EPc4-5KA*S+<+6)W-~gs~4~5YQaJN zH;L+G%bVfZN%Cd5Ea0YloZL`cVMw}@MK9DD2>u=S&lr-YC|EPocK2FDb1<}iZvKO5 zlvq5_=Qv>=y!*+2s@Q@6q`(zqT@~+Fw806U78Lw}q5oQIfQC8XFO7$YO5ZJrb6*W+ zU-;>iOgx8Y|7%KMX9M|9N$T+YP7#w4FIq~NTb|~^Y}w01QBCG=c?T;Q*_b!p97uUn zjkE{sCA!<>94ji%AdCi$?)?YS=}6e|-IH9MUZ{dg7q($8-82ynlx>1yQS7qBQA zzoef?$Yzr;cM_FZDodwcyRroec)s`Y3}oF(-9@vQPU!=@hoCya!?xsamEp2fbYf7V z>~qoeo^t3au6wO^2XW*)eDL+x8*(Ig#5l2;4di1dg3qAOB<1>Ej~zFpwnrBkyWgP( zjDQY$>fG~fy^_&EV^DBM-4iTU$)K(GT})+@y~z$q)hjehF%x%R4AT@Qo!b&J2qNq1 zlt*w=GrjW4Y>O5I5#b!iUSw483^EG%*s(Dv zkFsa1-*faP@6Zt~WhbXBcR29ax`J)&Hxu6Bfr=zE=8%*FQcydrcMfg@Q4Iv6^&=LV z6G=|})%W28D%VN33oT#wm+tsBeq|Lq?6uCy<9-GFVV?1v_yq>uB2ITC4WlHt8|`|r z;&%ZvxN9b67Sv?M#tnYxg~Y{0yG)v&K(w@;Mt#h=k#o3Hf~1U%SSWF=pH0QEW#iL? zLT-1mfG_hUS$FC5$##v*;AN{*y#fDqU6VQ2I-o*aa_S1V4!-93 zcGiiyzkIW6kjk=ow1?eYp_kysl7-~#oh)jw+%w@^(p-{Ksr({v_0=Jt-g`iFPP-FR z4Y|S50F3|ljdHmD7mRWQK5?-B{g5PP#?(FoFbV(*$A9eyA^i-|d{uwKCypp>@fRe* zl&sY>Kr>pHkU0u1vdHtFrZ2%Op>Bb<+~V%OiSl9mL?A`{B}wzih!^ctl-T3jLZN0tfVkPD;S#{T%YUfYR8WAu9i_Jo<^Ti}#`G{LUXR0-lY zIm>vRLEvu@C7J7q8%bPCE8C=x4aqVTzLiYH$;=LOk})o(e{YG63NWAj65-B!yc?92 z&v-TE_+GU0$YKKEkn*PbOc9DXhb{|I2U!d)`FMB$$&x$=q&FXQ?8q=Ag03^>qoX?e zynbB$MWt@;k$Un>w)lzsdlh{dwt++ED5~6IEVs>C0xCN^ z)_B9m$pRHZ1)f%hst4C57*i=~!*$Nt&&qV7mPpGvxsl;%T1=jP3Kjyaj1GPC*0v!F zS^!bh3QV(<%!%*_;syjs>kb4)>)l_=X4j$!4g2Z5K*ta|+=m72K~M{*u7M4Gu^=o1 zjE}?e0MI=I!T`t&u-Z-c)7H(MImEc5+GAs_;&e?{T$Uy_fRptHY^FDHlz|=@cz?BbiU94%R#y6yUDp9ft~GRNY!~Y#H5?KVhksXznruE;L#@ zB{(JAi0!kOos*C!kL09u%UPjlx0;#tz+SU6mqE2~YPkscg~J;B^SOXU>V6X&-W#vJ ze3M_hVb=3FpZzEJ1sO1FgU?dcCR%Zr^#avPtza?tnT11j)c5Uz#2{^!uSif1aHRd4 zK)b0A^*}Lqe*Sf3PZXl&`?1|r{RtP>7O}|%!`g;&N7&`P6s|lxwThBk{nFYb&&lJy z_l)Qc(Fw~~{G@%`=AJNPtqz?eJMqHtk~q(m zAq&n6^FpT(bxB^*BIexCDKj!*-y+@IO4%(?T*+A`)a3_=*^y70txcpyY=)hKAFYe^ z8y6{4vKb0ma}M86bJX=}=aM&vhxpxZT}g68+=S#s%zu=dr5_yOCi9`t0P0{S9!r@> zENmMs7t%t1;)1&h7G>-#nB42~G+`Cj$qa;8#wZ(U^>{}jTG5q$E!K-6IbHp2NSXr< z2`n_-vmUB`B9Cpq~%hgn&-a=61a(` z6pZa;zvHQx!-SE!?j+3c1GxIX8E^Sc!S>bk77>4q#X8Aoj}Yy7 z&uvbLGL7g!RZrGrqd7%UF-R`qV~x=`lZXZ??%vP=p&iUP&TSfU3D~c7`X&`sf4n`Q zY8cnIEX9N##IifPjCWf~-XP671gVz9N^DH@DL9S^^t{D$imYs)VvgJ`jv|{R#5bH- zdmxfkTHSTF99d3yF0T3DuUk@d0cgW*3yyHU;LdezH0LPWpOwf_Y!Hj5`Ex(~F-N@1kzi%}F(Iiw zVs0Gec?Ju??Y4r>@C8kXxEN;@-Lu_Kw4&_e>^78s%Ic|6OrFZ)#bn{5T+P)lovZDF@j#%bD0{-)x;l1+W6)kpqd?a{3;pFnqiS9pf~pT8N)CH>t44#6fzh-x<2Xgw*AOGJ2jZtaIMI=s}x~MPlkT z6Wl=fL2<=Xw{w;sHZ@se;7fGACN4`fHqca5`WIpMwm-pgzxD)#x{oG7Pj}nyw%P)t zAd0jF&1}QT8-Tx79x3Y8;AZs;cHvieu{7excoBj+19pe6B(o> zj%WHTZM{X({vbwi0GRl?p0}=8Qt{XX{QMj$My{YD?vTrZ{|Oyht&%zSrMJo&c)OiJ zxmB!FI=v~7RT;(>!X9_9yh=T zP)q%NA?-x+cPhMsT^Jv z=_um?hygwxKsc{A)#(r{>5GN;=elecoPn5=eCLWrBaZ_>@3j0leJR!E6<4ui@_mLP z(GBomcZmWA$8Hm;>VCgD1H50U4s~{>EuUYhpx$Mfzx zy;Vx&;;~oV=_{y(&BI3M+N_8Q23s-(rdG}YoKBlb4D`bm_mZq?WG=4gXXi0K8&F6o z$j?cCJ?F_Gu4i+iE^?(t&4EelYTMXGV8PrJw zjxDC65I9&b%5UA9v039O;c7`bR@tM#r<{}2f^#VsmoBM6?Lcdcsv!K5wLBdetjUp? z{M8pLdgjMR%YO>`?nMDxp>J?mP%k)ku%0LDlS{Q@I@`k%E`Psg6&xqLz*|Jb(zZf~K}r z>5E+Errw9p&AoyAq}JZE_lWB1hy0 zd28U0=1q)AusoI|`v^T;af!nsHmS-&0mq}1$vMJ19o@#xBaGZ!`AH5t2kB`)rCq4Vu!)c|wGwlkfg5z@97P;gmyH&cj%h?>YHf)1JX<`=h>^(8ueb}2`A@2jZ z7}e6dD$c;6=5-hgq60E*SJ{FB41VJssE=FL_Y+!c0>=1b8({bxC;Qz-M2{Fg>%c9} z2@G4P%-v7*G#%|4umb7ES(E;S6q%{3@gQ`^jqvyAk4f!N37fwcv=S_j1XBn>VXF}& zGd>+{qvEolhNoo&+?FdN$cR^wj4p-85$I(R^$GWS-i*=37OsG>73fXB{yI=(IG5D|YTyoskTn;6*ixPn+3|C}yDeX@Y|@>Gd9?uNbsy6f zjYH;g=bQaZ(7l7KSA(Ujo#j?xvq}mC(?s7R*%YmykPI=D)au4JhO!d^AS;_VuRBVM z58hT4=E371aNqXG>VG?K|6ey$VP^dQHdOhC_i!fGW@h|{lObki{6uj6f8t>N^%?&g z91JTf3q30%CmR>%|C@thWnrRcWMpIE`cLUA|H~ZAKi~Pk&%tmo(lc^$vaxayv#_wy zvvRQh9TyYl=Mb4cqme9+9Tab??a$jo=?oy0phW&3A_vk0+Py@pP9KKZz^-lgBwhuEW6iNq&flPZNPK zC`w)cTA;LOp3=BQQLFdU$-oX#7!lI7ClQ6Bieq znEwJyyBZ{Wyn5K%IlJusv*W(?=X+HrAJNBssIwhsYKpUO@fO;gbY~+~Zus_3GhN^Tr(DtAO{oYi60A?rNd6v)7wcrzPuoxp8!i(gSZ3 z8k6(*fm07Eq_4~p$mA#!G*F(~Vjm($ZDHD%e(zvm992d`*a9ci@ zr#J}TfgrnRtmq4i)RaOxEku5aa9AQdq*JZ(hQD`lvSJyg1yh_nA{y+S>fJoxv1C^s z$`ov_AHJ12CrXxHSNnWgifAF)130A|yR_*}rzS^t+woLXUF^l7Cem**9z@A^`{`r7 zTi6+V7WN$0)OnZ&LwMj27gQIcPFQ(lw#5PsLXlgk%-=yn6PZepfY7jL55utF%#!kXY+Z}q5 z_|*VWwh5BGTW~C%{DJt*u?l9VWcOc08&As7X2lI6f!e=0BZ=LkB1diMpHAr8vpcs4 zL+Vn#$SLQSGZtxEkd{}+zC=SRPZ1n{`?=7pp&$l&A9>$g&gXzC0K+Nge}0npCpSTRJph$(X4Yq3Nujnz8ELV92Xc`dN!eRB!-ikJu9 ze9t%}kW&5?`J$4>%EBi~3E7sF9@R%#Bg?sTN5l2)2Z|Xuz|MOvmZEC*XQpHanTRpt zp=CE|*8?*rRZ{ZJM7sm93FVu_(kXw&m7NV_OCwot>bVNaIWv_6D`H}_Zvr}4;vG?q zVGj4hZ7fqx>taW=kz0k~0@okoH^wNlQR#aM1mVHSiU4uZhINFJ0K*SPqJG7Y->yZT zF1k)D4Vd!!fM-j!^arSecff(A9%jEA#0C1|A|VX;uc&gNL8eg02qJ2{$Pq1G)> zv*M&_DB3deGaQqD=O7ZuIb-5Z>9`MtSB*dl328JFhS zM#11tt)>Hmy~{=<(0jd|-)nlDCULMz-y(;aUr@PR1+;SJW5@z|QH;-hoxg_%W`RrP zHkBY16k}_M8gh$FT*ReCKvNyx%R{NT<{rikNx3yp==(ltlt57T2XjnWx5O}` zb%8RA9+0EOsIfKz;_70f{YJQ3M*=1q+@3X97ON=b!YNIbG`LMZ;|;okO>pL?2So8K zNxSc3i{BzszyIL$CA^_yt7a&~AmWp2qKCiUEITePz0DEpT$+KUV)}aJo*WX2Kak|w z6nKa?j7pjKW6xYQ89GN>%^1@1@RR7Cun;*KOZEHW!vBLeFdSk@=&cgMa zeHF&KN%JF0QI~*+S@bki=>^2ryNr!n$C$@v8R;V?rK}vAe>jwI#Hw0y->OkQO~!vhx&jpp9IS*KYx zs#vyQg+dMq(bxD_(J95O<{4C|2+oC}z79SB=fD!(X9A>@BNL(A+f^O76cnP+PU%r|2^tsAYrj*l-AFUz#*j zEKFT2T6}6^hwS9SbHRTdT!bn9!et8>?Tzh*zAgI}VQlrs3gAn)=-#~OsHTKIRjTW$!%{kk z=KXB(cK;Rn&(q0B*xXcD%^&IbhfgCh z1_5o4>!r6_s?WqNgq7$MLn<&9y;R_Gf@FF#FF3z#<{?w~`c7@S*03xE1JgFT`I zWTsQ%4bZ*l+pSXCrMQndG}KCaEDP1}(xP?YHTPdVpF7*iFF7~o+;;?0WV(fu#)Jk+ zZ!At=@>H*0s`2(5x%<9o7Uv`iFKcf}|4E@$@x6@T&>F*M(~CT=G}@&*H|CuHZA_6` z>xv@6!mW9KUq1o>T!$-~7wyLRi$kA=Aw$I3;1pG~a&BljLgDOuh1Z*`)DuXtpbNBc zxV{pe8ZdMo+>%?Sb3Q(=-9XBxiY_;O1!3XmvSFFSmbl*4D&}k>lFrfhLy2Oju}%8} z7@mU5A%U@sv&sUmi8yWXTWh@l^VHu5zL0XX=~)_z5N|mttfzCtm9BjzYbS ztzF#Z;PyS7aM+i6O|S@q)19U_3*Tdz6UY>KTUry8?P$62gv6awd?1iVS;B>lrIvMAN(FzCTkx z6^J2wlhzCvv|oaw+0L#7i!s7{?6B(bhs^!`(0>Y#P+2f-fUG9&%7fu(Gc(lHX!o}i zfx%6E*|qH05VdTdHCTnVxR_i5I{6+tj2nsh%-f>waEthGstR#I2FB5#zQ}S`=Ipni z2L!xZzb`PP2W_>cbRMZv`041!c3mVl`m$a>0q{<);9V0$f8LF_0%GlXkr7d4X?lPAj? z{eo02X|?um1C1>?`szgbNVcv?j=;Mkda;PXTAXNO5=VBWw7t1{?lsSv4nVM+4?-W4pI5H-DfWz_%EGz*Sfd{Q~MUZ;1QwYERKnotk+F#8ZKql>Vgx|U+3ub*tJMvWNuQRULiLuI;S8l{ca zeNtrMA;H#3k$f(LzMUNoh93==k1jT;KtL*-Jx|~uzX(v(*qx7ai}D~Ypy_BVNWD&W z zYEJ|Kod@Gk86Jp|I=wu%pq$j*80hCGIMh@TGN#_QJ9~>-L8h|PWyaU&*5%;z{9ov`!lQu^-l2YU+ar*%aJ(HAnj)V^h6A) zT|?aG1myEeX%1cUedc7x-s=i19vPQ>AXHfbym$G>z8KtS$De%gZz zgW+7seSnVCNTUQ$HwsX+`}PN< z;0=5|80&9!gx(gSG|)i8 zU-QVgFbZAD-WK}eAXiBX0IrK^IW0Jiz5+c{rq&30bo^oi?%4fSBA0|o(697(aATZ+ z1PIN!`8n|`4_*?%VnK3R7g5-5#$)P;p|GU^gqM3IkE{f5C#obrE(@z z-7J+9HPBJJ{Sfl^U==+-c`|(1;Glk|8Ijtj8N-0f$h@^@m4G@>!3j3W`^TgiEFA6OAao<=;b^c;ARveh_A=Y zb*Os2*O4K8X!{gVZ*?M?=;`zq}2m6w$IR5 z)&Y6tK=dS)bODm-v#G$BEHa*Xh6wu`YWtX5`1h1MOVuKIS?bgPUB$By9rTFpoCMStJ>zoBRTwa?*Vq-O>&F>-wR5pghcetPDxu`)9gf5uDGb8sU8W=f5W#y1Tp6JA5jH=1!*0jyCl6PUZ}Ml|%+(S0^V^I~N8+ zR~HL9A_sFi3nN21V|zO@dJ7j@oBymBUWq1!A(=pr8%6Tz&+hWUn0abNhnJfe+O*k1$A-S@%E-}$aRIET>KlTuA1~F24&&^K^R$dNgAXUqPC5WthZ-!|NQ`D^ zq$kIZ^WQ-@9=NaMEF>ECy9B%Vf8OqD=G5f_uWx(&`1zE@t<{0CpV4CTWp@GH z?Rf*wuZeRaUpd4i1{s1sqs8zXO2VPLHVH~u?AS|97K^-7(YAjp;U!e8yA5O;+(k)M z%@ZaUsL|@rNCAlQ;NYRQ$3|f>D{&3R(qW!AR|)*1*{xdo8Iz=;mK<9q{Y91e86=|w zj99LM)n(Giyk3Tj=5s0C^N5je*F|O#VrP*H3w(MDSZQk#iVf|i;PZ3^LF%;*ATP=H_xA>8KTK;V7`ufck7yNI)kHi4rx(wJZI z$TctnfD%IuNrP$K%|?R2?^G8FQpRgUa~S$e4kJuk^uaI%GW`||t@5W?g=_6U1_!l6 zgl`u{{-U#^*9-Fh%#Hr}nJ-XUxKe}g!y!~!>$T*cv{H@(O z{Onm_?9%5~Jv~3J-cKq7d;za5TfVOx^<79)B>-NBYR;oV7ahRQ*drLm6#l!7v=RMC zsNUSw$ER@*T>&(TldY1suR0w*w)xgztKmH-86Rm(E05_pbvRSl52@7$&2!FfLu`k=1@l=x7}*qp@nyl?1tzqhX>JkzfwjOLc^6>cd46J^uWh*i6M@-30t zU5A=OG+x_JiN5t2hiVrn} zac12*HZsZ_@+}0&I)6E7(FUAd9TO3PTWTd`PL9_hok$e{Aj%>pi@1Z&HDC$rj*rKk zpziD4#fB6Y`BU#(3cCwIN7(PyqN_Psb1v(mH-BJFl8OKJrYf|)PM?n5@F%5{W0#`c zWRUp!oN$u*oMFF5(~0l7_#Vn0zv&_iZp%681pNK(J|=A9cYeo&AmQm#K#TV0_icO( zerKbA5o5v)0HR8iB@Nv>V%d{a+5{s`ngVX6t1(U8$XuyRz6-is%Lfe8T2)ig$m`ZP>Q3P4SUIt3m<0Fz(95No#eA6RsA+H_z6Q^H z@ucA0hq9ci<~CsWceGz(wOEaL2C;ab+ru-;og~LApv((4T;aw|^ZUW(lg^R!T{j5N z1{U24^;CvwW-A6!t>h$r)R+vqc;h}}Q*^jyHv_*uKLH>D$*<~{QNymAnERkxvT2f1 zn^}iyiS)YPg|0J<$|$6d+XR;cOimcbguqwYkZ~dK3yC}SCK%ms5BR83ezwyX^2b&e zHUa{h00h2}rswo%xG*ju$J~X>Rx$U35WFiS%67(s)(c?82RA*D zJqRa$)~f{_B_y7ao(-_GR9JgnbBdhj20Jwav>?mF9WNOL2@V7eZZM;8YwTE(t z{JA~dyF_>{TCMqAwqR^gQnQH}Y2$Q(_~eprAj^iFv%w)>7+>g z3ZON$9Mln0H;p^Glvl$3y@~%wcn!D1UhRa~iXJ1WdD*OIuYiT+P12r)Oex1n;9-a7 zkP+=QpiEOGUWEhWEBbki)NQ|JeG_W^N!5enuw(4Xx~1#=xjoaj>DaO5O(m=;7$L+f zIeepcjn6OgQ9aS1pXbLED=b3ku{I=A1jNCSo^)J=4*dq0sVkq`8j`(+Wf+iOdaEP$ z)RhaS=RImd3OriG#dMXa;~C=>{!k}aprdrn4O$&P1%AgGSCF`0YgCaRW>#Z%qegBo zEOr~I={qkS{&kent(Hq+;C9gbhI^1#T-3UT$h}AcuBqfY9hQi#uu zYH+If<@n~8U|d6c`!AvILmlzkK&EEcUCY@+#EI1nCIN@rHVvty@c^CWZ&SRUMt0VG z&a|1^%wpFtJ6@>Ms?VViB#0H6mPjO=ol*IrWuW%WO7o`UijUMf9H}Bn&`~A#ZUtm$ zVmK(NZ%N7~aE>r=pHqw;2}b0A0a)tL=~|n+L{S}Y{{(+euXi;gP`s!4i}x3m-UP7hOFIV6KR8Hx2{XHheJz|h30b*;yX8sv4zhvF#hcmQ zBIv;CfxfHH`!J!mO;*Nj$MWX%?4Qt2^oqV1{_bE=eerPONK3y&Pra%pB{;XQKc_jM za=IlMpx^F1 z8ITkQCqS=?2Oys9SAvHAbB&K+Bs=#O7z}BUdvkp1~H2RNxBm&aOcb8StihiznnY5 zUQ-a7Fu%4BkdNQs(VE*hWg8w)>h{#98zkZdQ1+}v#=4xUQIxWBY5epE^mgaQ=TZ4KH3uF&R{AEN`}90nv%*z{1%HmGS7JKO0r> zy}>JByPVQ^OQRfLMjhqh?pkIY2GOvGgd92%>=~+LO-TQ+!2=O>x!PI42pme3<$Yo5 z=M_6lt$3(bp8GI!>ugpo2|LC%&DMPNM-PVy=(E*3o7fC2HCFmNt)Y;_&o9j;(shU@ z>|OJCVKBd#0;pOm{I(V-sK zsOf`Ya@Kt{I9`Bdm5e)d|#V^N9HMauSyL5}U9swGrOyI~aRLm#XCI9GVE*uOu4uvs%>&O~L!2)}b zqA$8x51uuGkj;iE`>YeG zIxW)$u-L$n?y8>M#>tCFw$^Zh;mvT z?&0Et`miY3L&1BZ-ys*&&gYQ$g@&%>EaeTyslGnN@`W$H;b^dAL3;z2wk!m5^QK+) zSX5-#Tu8F=|tNajo`a>y8#^B-xhr58o7|tcW|DlXSUArlH zQer4KXw4fK$;GBInvBl03?8WnJW9e59XsIZ04 z3?J#hTb_9qkCpM@mdUeMmTU%wMun*Lncg6Bm65*cIEU#tA~_75TvI};H*)oz3~vmC`Gmm?EX zlPc4)T94Tr;|WnSpPpNdm^37P`IIcVYzAR{H{)Ke+Hzyha60etXS9H2thCQs#VnIk zh~kTTF!6_Ea)Kl^Ff;G)T#ND0mP7&Nk`pK=DsqS?CUiVW?XuN$3tBTHwg{&HT&Nl; zAfnyxUYQ@-Nf$VUUX!X|j+Ke6R6?3Zyk@%M{5LpOcMbhhcI4;ShWog`R;${?Qc>5? zP#WY%p&$8S-C8%}wXM<8kQXJM+uH7r4we`u+nS1&Eq<+>(jVnq6n9sluwBweTHLrz zsE+vouKCv8b4cQg&L4gS@1)QGe1jx|isQ^IGpb%BgI45lm2e!m6i7(fnT7KcjI2_P zK{gMt{f*s_w}#0MAd_iBC(vt9V(pa}g>aURutiwDIAJ*+&kQedbJqR*6xx_ZK(L+R z{j~!@HUwj4EC%qwL!C~xx$Pt@a3hO-HV@MsP;O)}1T#dsTr-|Uzidi=Cd<)Gu=3jl zvQ8d%+{)y1)%yIlOx80tpo%N=8Rpu(&dIP6ym-X)v^duv4QeypaCBB@Hxc6PGx@c# zwC*$z430QYZ8dZIeRWn7X*>HKB*v>|_oZ|*FJPuuXjWvfE1F>aEidelDI{D9FxfNQW5$8p~N$2kD z&%gJS_VSeVT5~B#6P#`PT-98De^evN8H1y|d4J|NeK{KiP2J<=-0}@I=AZWCAcCaK z#(%nfp+aOggv@E;ll?O=xv|;`KFsAl*0N<4X4LF3+204`PyvMM8g8MQDdy;ONp6W^ zuK!6l;4|0ZB)ub0>;P<-csA_k-zNwot$R5iKh+Noz>$Y}|A`7g71zf|HQJbH(EaA= zmGrQqSWG%EIKRPslfTe5%iCdhyP_%M$l8H;reQ~4EWuA(e9q@%!!(44H&wLu7Bh_t z0(uF?y8YxPzXwPosf#W(@85s41tZKdOW;u&;r|YWO0`72J8dkI?LzbSzaMbcUhF(j zyBUo3zfvG5?mxfjza5)xV<52{naFe4;RA7f_sD?%b`>QYR+(=~>;WSaS?|~NNGS~- zg;#%m-D&cuwPoCCk@9$E{Qj&Po6G>H&7V4KE?$c;3=_9Jld8n{Ogl#B;Nw!jyLACr zkeenF5T23Iw^5bN$MZ`uD=}-_UuzKcvB0L+1LJYrt2Zr(2h}G~-3|Zz&PITq`ZgcZ zTw}r!9_y82y|TM3gpPw*z<9RS9k*n|`w=UcRJ%jBx)_5)2~WGwWwf{N_bnSRW9vz8 znPOA%rL4i2%eR)^?(Kij_Ri6fwT-rK$F^*Y}-ycNykn)$<6zI z-`RI-+_Uf5Xa7;7))-awRE?^&YOQBJbIzaYNNQi(#r#;Jj-oV%N?Y;#t8CTiI@|~OG0j4efX&j_a z0_=0WLLVEV&+mt|Edh|XK(oBd>`0>=@x{5OC9S%x z-~lyWJp8mKoS1P3YJihEdwJ6r+s@IQ>{OZGdk;UtOC`B@{t${_=(&sGt2eH~JmUBS zb9zt)n)+KS1Y%4RGWmkbnVWuTgnvm`g#R!w%9)y28vgHeJP~_4m#>#Nf7u!TDx~_4 z?NR?C4>J7~Y*hY-JoulD3ixlt4*wqezbFrWwQ18ca&fXSF%z` zzB;wJzRJD{**U(pI2gGY|BvKB3sX0H6GIonzwLxJriM;-4F9iMNat*9VQOp0K=P0K ze{-WfScORrRBdvXWO5V^vHf%KVSmVV9 zCwTQ-l1I5VR7%3*lD)qJ|00MZ>_V8{cYJ-hz9bA`IkoGQyned(bf1-PGe~Y6@dxgP zAc%$U`W7#ZQr^s1-t01>e+B=^{l_W%sxv<%Y2MQvR8ble60n^042pZOqYvQj;tq%( z$@AmMt|;16{j_eb_gX%kfd~`LX9Y(Mx`I*@=Hcjvj{u&W!QP9>36jT5$<2m`1(%>x zBq%Wq)dnh;wJLUnh}8nhm=nhlp8pA)}eZ;Lz3EwY{M zuA0ta`;eFN0$h3EynEJxrIR{zBueky6;Hi#^jD(2uyaNNNirNkN>HudR+BM5;Nl)` z>}L32*@fFAk*#$^8O_>J?S#hO+A=}~wjmzEl1sI{+MLG*>GZ(iA8yRC|JqhPnZ^c` z&8R)-RZBygp2m?}Ss@a-acK?afro|Vi+;P$msn%;0U*K;V3{K+Qr4lDBlQ)VL%bL$ z1|EZ`uA6Z}8wW|(+~Y^U2z5rgy>gEq4H(c9fV*G*xa3^5IJh+wX(#yVWLo}$&Qj;4 z<;L~i=&W!&c_fHhE`x4f_nk0hb5)0fW1;^d+>MO`Hfuu%QbjktN;ur@SN;iy2exT& z`G~oh13>@lL;u9X2c7(v!OCVHAN($?!w_U|%)v{pzo@e8j4F ziDr5z%#9qH&+~afFbM>i_uEjN)C$2F)E(GfBoi|{gfSczk(3Xw!J@`$M z=T>GdaTNxxQ0Pt5_Y5j*Rden5;4O+6TBfeqbKj8ciwL}Ivb9d!AAXC-TmWh#mQ9O; z9PW$rx3BJgC*J2e@X|A+CeT~@ExJor1rt}5-OKzc-WX^s-UtaS-aNvlJd6>vXq$%!e!m+Gcs@H zRhzCdsG_|TY{L|za%F8%H4iw5Y7g;~8#{91E&Bst7DPO2P0bc&K{F5O_*Ee&siC5c!yp>3$HoNgD$%cZFnp9cP2Z3`&m*gAJ(xAi!4 z?$vKNjM#a6#O@LIR^@8l_Cs-JL(=Z{#&<_K-KZ{|Hz@_iVjl``A5E-#YpNKnDs&Yz z(_gKe&WUC(V1*eqDTAU&CX!`wN`NcS>M*Q!FVd)dU_)Bu2Tx#jJH?_qkr!FM{@`D^ zHA9LTa}-N%iR`|g*Z?%y_^@atYRL_WtUA?1E^SD-;#xA-n;0HOM=_$$^+j$wq>Viw zUSXmfDbLV|%(@aEMTlWoU$kYsbtLw%XBpSJ)vK?N6olDOQUy`h>N06>5#4i>Eq$Oo zuHLJZhJo3$qeZqG)JkI9TDksqyEm+0`1J3E4pBduZXKo=NI=({zudGY0)drYk}rkPoAhk73eF@0+yqcE`188v54O=S%qnvN=4(eNL-&Tyw+M=B?+!(a1yIU@G59a?40v z`m`>yK^(WgXl0Usx3zA<5rt^R;+HvF8uN4^o&VIL0D!NGoo5O#LZGE-Tp?GLPjWOy zHA$aufwWeHWcR~=Dc?l@N$w4o;ra-wX5~Z~pu9s`*z5B&px^t)93z2yYk#T+3AKRd zH0Vyt)8UnTh)UaivPQ3$WpA0sqjhb)X(wy9Pqo`yS;^!h&_=#|+wHV#fv!2>MHY;g9hJ}z%ojejk z+kPz z0DxANVrKk9?~cYx4VZF9m{wNYa;VUVPOqb1X6s@7SrZG?tRyn$Q6DA)knc%~IgtAPhTN;bWU7<4sLUBfch`3RGQyk^Q-VV!C_JsnYEcF| zBxu7kbHu8HORX{x-^g}L*B>-rg7|u&4%qRzJL+AFhUTlT!lyY}x`OYHL8R=IHBmOE z{#@XEJ-aH~0rb8-q#fLE>@9tw;sUb#JpXKsM_oM! zUcdKA8ak&=85I8-X)>4j>yVKPgKsR@L~y`yzlv_KNSR?PF`v56VqX`Q)PkOdnVrAX zz3-*0`K$&Z@Q43hTZ5S3*gx@6=Ero{i#EPm5570%ejXJ?^8=LXRR@?P4R6sHj~Frv z5d*>+O}qEEM2_ZK&QyDimEEc^0IOEa_zfJrL@cRbpeEoHLhb&Tz`4gK-?2jy#K81g zhQC=smztFA*IJ=e8fiJW{qS#NRJn%x$^o_Y2%#kvf!j;Zt6tH(w1uWP$JnlLvfktN zP`>6}^XW#=Zm4A&6a`XK$2L_i$gmodVZ#`mT2=b9u3V z{I;D=gMQWbASfHpg*e9&zzb-)8L+7yP|Z6@MyS;vyZax7pF}KE%0Daum(^oXv?J0- zf-V=B6flC}h5EiGMYN|B^0W_sASs9mg6D-EF9Mj^gH0Ez@Z2?vzcU#vfP@(Nks7I& zc&xxM=u&UX4YF7bl_#WMh^(pJ6l*aBqVO-gcr<8CMGk2*Tvegt04~5zHTZhxsU2Yn zs6$}Q*?Pj){b7=E_2`G-QiP3*rmbu@HK?N7C?KRbujXD|NI45~dSY*-iGn;!;`_QM zM>=r&gmLOnfBe0-aGX~+e(fz2R!p5^l|#j4;z>@uE)CC(&|MU0ZE6kayj;56=GSA| zH&#QdyR}%M$1s4zn8wNxfSaxLvXQtZH=)cWckKyME5wEIbG|RExtDPbGWH_y5^*g8 zsTA{OP+UU#BFn`cVh|jP<8o11mwZS3oH&6<`y*4jH9=74S^eMFX6qxNP69t|H@jJe z3sw0U@DMx4(yAnPiy0YyKs_`<`+TEzpo1{UkuN(61n9d8PH{BpGMsmI7BWa5X|D}j zYDJB#Ss_V&T+)}J#p!9s737JnuQygX4|Y*fq`4G|kHBow`nL>wF}Z!G);*L z{IJ#UAwXm6u}j`wYDm(uh=NC#(Q^%cu(8@NG%T6;vHQ)YZquQ|*p0UoIU9rW5eY(z z@@#Q~4X}TPUh8&GU7r%K9B!pki8Hz{IDU*-kFe?887C-a7AJ{HKWO$6o5Q8_hP@)~ zA+3F{wIQ<3Z40{|n`p&`=tfUTXOfyD*FXok)smSz+CFnAeyIfh=T`N+;f0`;;~px&Q+ zc|g}*(3~lR;%SlrNijc3ho%bLyO zSEd@1cDMEE%u;AG;T0IMQ3B`v-pe7@LnHiZA7d14X;E<-W_cf$H;#z41dGkr_fc$4k0M`Hap9(DvQw8<|Yp#tek!~i-K zb9^JPdZTr$bk&Y^#xnXe1;)QIrsEj0YUse07qFV2Jxu}V*+o()eYz9t2S|ExiAzZQ z214-kru37V)p@~f2Nu&XkP*4XW4WbX0J<_*R#+fqZ8c7hJf!HHydP>yezaoj88PqmPXdYm(z{1K+p8iXGlp>=T^>bij2eE3$IRf*u;dd2JL= zG+p7(WE&aBuRakXfIYhYVTbyf?EgFe(0|(w#q^)YJpXb({ResD|FA848xfcZz{lQ5!4WYVZW#t33bA_#QKtCWGnVGo>HQMx}*-#|(}npsfHFN#OW z*iGUnBLIc`%7K~_S2XbgKtdru4;}UJOGl(=oGhDsNpE>9cT`dXPgx z3*yj-TBnFuvrPf=1mpp7pR$g84XVX#V3|PCO7N=?80J550Rn(by)TgI%R=vh6sW1v z14l*Ti3OTuCt|c~D3U)V{mYRTa7}gi4EvFNUCKme;Nv)S zvrC66MNGg}*757SFnezYMf=a>hkB<8=IEEZ3w!Pn$M++L2KS)%+Uu_FO~3dDt>saw zln-f9;;Fna5YV zmn5TYj6t4qD+j(w=#VABJHpi#MF?>(g0Y|f(pOPSng(PqUR}?aGZ)65k`~6b^%4@$ zzHrH{5jYWYt)|$cTgh)|?W=r{=k)6jcZtXw2UuC`zl>`Sl3`;UOb*6$Qem2LB?}I^ z-dAPf1w?kk!uVD7nPXLxM1$pa@80U{ zKf62^`XpM5mCi%nwTOTng$;9(w1E9`vN{3hzi?NEvyZKQRQS8$dPrcy`>c%3JejDO zvJ%q%S??&`*#o9T`P4R!`Mu$Z>;C%J4Ktu$ae4)w%^=eoeI)T6RocRnKhAi7$ShTo zfK;4XdvdXKM-cD8gD}pKH{Kf&eqY>Z;es}{lj@1aslhw^;IdFx;7U-F05>0&5kN^$ z6?P3UUYo&uW@5VDs-Kj>&Hom?2G)25#{Jq7*Xq=$H=PR0uD_5R{ewBDUQY=5pkdoZ zv(F1h*3_jtH8^l|)!r(0PiM8 zW&ewwbA}V{0`0_*pF+FZ7Dm7l2;cyH>1{_H6pM~%k~X0Gv4?;`$ajWXx=9|Ug<38!QsYd?p1Cph0rYPw}9$9&apX%0%t4z15ZX1^89QD-Yiz&^e$*=mcy>U`D?+xQ-)i$qV)GfIyYK{gb1Sl0L&W)dp zvy7$tic$(QzKkBX0p=%5gMiD@xsQ4@0<`LDmW_@#ryc*`FV54Wm2yXFpm4hs(Ig>T z4s(# z`sPN8uAqXdpoj-86HSfccGNs@Ur#UXHDww zcEPc~ag!7srb2`5|jjd0D7yD_xSr1g_;RDQq@o%z*awW@g~C-T&Gr5cJNNWgoq5$rhu zAOP|Ry}8bZpeW-!YmBHK@jjwb2%fVd`1c1EF-`+phYqbbkOZ-??P>}%nK;pun6a=& zN`7s_JA^Zq0vo8hn1CEN_Ong)>{G7(KFrY6CV5c-@4L%^b9VxC0Tk|QoYNhlRTWXb zA-7*6B^C=MHL(29Z-m_hCoRK%wkJ%knR$%#0;T*pxs0C;jrN5EBPj1(=C}Y^7rwoT z=|96aWrJbqPgB;vybrGuW}BROW}#e`3KC%6hnWEK^A@35ruHrcRz1(NA*cdy-T2EX1%~@tZaUzs2MP4cF&WzIg^>!MH?9BNyVf^z$i{ST-lT6cCp_JK(Nd+LTT*` zM@ti_3)eCKvH^svBc%Ic2qI#qCklr}pOBXNr{6TWPU3uznC2oN9$<7;A2tf4jr)+&MhdDOf(n zPm|9H%hHTTOev|qPj*X)a&Z7$?ie?{O}1$ph|%lrdkvt8zc@=yU~3l3Bmiv~8A_!V zDY74)BDAz1uF8=|d$B&C5z&?_N-CteJ1_)im9l z3@u+I)oEh{eD<{Ka2q@f!^T2OB<+UySwxSR_$cLTeR>_+k+pClHJX4Hn`qvPknSCr zk@`vfSOo48QQkdgN7DKgamN`9ZbbFwq!~*Qt2=;7Acx2wlX&nMpL^*Pwm8b= z*Yjz{zJ?F?7nJpwG}WTcnZ^lf4A-Zvwh9Ij04K+i?Jsn@+c0rac=+vL1UK6tzYc&1 zIPW~H01M2~6yZMS$W1i|802H(ljk=9^BEtdR0YKWnBL>dqN|da(7FVO6pQ{iI&QhT zdG63K=qdx?SX=XykN`y=pssKFg#9O?KCu;f0FWR%vq?Eji@$1sn7?X(RuA6PTaI}n zQba}ISp)UfZXeC8xIRi*RAr$rYD6?&)8~&HblQ>^xU!R~YPoOc7_fS)ISy&XMXAlZ z4s-^Si<9iY1>JBb*$H9aakD+c&spG{s8)OkMg#620nw_3f&W+nXG%k|{O>P;GyN61 z`HxHB|LK(QKg+`q{fCL;zkL=zf7&GO*OZWh{oewV{%V?OZ}maG@$NCN_iT~k?mh>J0vzmdLIer;R>2ym1!LWm`f=Ht zClBCzKM{R;D-TJVhX6q2C)XqD)-M8I{@MY2`o10m1$VtYedgdh=9`v3&fs+IXuv>U zaR_&^{zjlc5o@w!hV5~wM=$uP%K-a%UgwZ`kt?27WH};=AzA<;=h3Sxc~LB=whOpi zCg8RLgbb4FG1LQ4`($te=hehOcKMoLr`}K~kyQQ6PK%mTB(biGfa~3_0Gz&etydq< zX`e6phi7ji3j#Y*Py|;~o!&I{87)Xn;2|h2E<<*Do*w;thUbxsPoEv$pJ8lpeK0iL zVF}=wEvedDYg1IKVcy-2M+3`fja;@>9Nrr}#2j@t)9V1A^$rLubGyoub=O~5Ujf0ELxh$vpDG(fvIv*cp`>0Wwf;n1R=3XB+<<+6UK(~HQ)+lPK z%ekq%(e*7l>wjbME>w7Iq6Gk1N|=aWJ_=zOGtbLw1V$FA;^l^|`ydRdKb z$J4to<(KSJ`zAPcZw130W1jZDJ=RIUp5dMZ_Bqo+re{uW$<<5VW!`l=FHP14_R8e1 z)~mVBe1}1Qeld_&TZLNeUYP|h3@04xm&RdeJTibNK=K<)fi3d0es;PW2lMnHgqPjL z!n;K9A49~{6n~CkT*ngYT#tz8Z&5W*9>5Nw4Rjr?nD_G%w`L)7%oCCc7sNOSa(;9%tY#w z>fxCO7=u9$>BSFix9M6Hn_9-wXzG-uZq&_ud7PIe@%RGtzV05$^u>DX;rQ`KPC|f< zKiFQEzbrW)Yf>Dh;oIg3jYexW!uc{!Bz!r#=A2J&#QAU%9IeK$oX39vetTD{$4Gca z0o^?l`qW=)sKp+}L$JD^BbBF9#!8|AJ46(L;@wsY&nq@%iP6FhP3S%(Lf*`VF)kkk>c1LwkR;Nl|#z~QdI_UrmW{G z;KdFU?Tq@eY{GsvH2HJhxbrKDJln1n+W=VCs)uYX++&Gx8p!rT;a2OXbz~1DE{>}CWk?+W; zmJHDN7$T>i6lcd4P+9nF#->)mDGUv&GfC1qJ(ATB$Sbm}pHZwLO|0LycagJ_m~g!T ze_D$SeUTYFKDb^|Tq*(w!Y9y-S8k)Qlj)lt1QHK|kUAktB%D&K2v-m+3n+5@z)Z|{-E)V5T zHV-K;X)dd*^Npeq&cBa$fXVqAvINVnKT^d_b2Eowh}S)=nbNn|qD{+et;?)Eaers# z2f+MS=dMP3zO5e|pR*IT4;Pn9Pq`T1WMDNrF2wm}{SG*XGCiKosaeq9UU$@%D{_6G zgV!_0JX%`SrYj`=st&jQg{hP94*c44LpPdinB0&9gePu(LopZHL^50Yg1eXT+e@1a zCsQ$YDIoh0iJ1UT6NL#5!1G`IEf)X*?7Xw!iqxhxJnq8s>}6y7h593DVbSM;cant2 zuHg;Lj(O_VMg(8v1+*@+qn{uOg${q7QC2Bh^%+~h^P=3gH^nX#3v`onnK7d)RGW~w zCa=lRzQKXWTljBgrg9uY!vQza3(ru*E`00=R=8bu?u&CmvOg({7uzZ;(^&wr{(0~a z*3MPG08xA&+w6#4EpYWaK^ei}`$|16-XZ;!da8vP?ke+IqRz&$z}fi~*dVqWJElw03btEdzIvoNT(Z9#AFIhJoWzR=ViHM^AeqlQ;t{HRw5`Ti<)Aby-Sn zk=m-))Qdm&wogEEACxR+G(t0E$RsdgxlLj}JlTjMA_&mS*|c3pai*>LO4v`hwXv2YnRSh}RuzTmCXAEj=53U7HjAn}6l*Aaf9yPsg25VGcY< zv&z_?U)SiL9%F?qMiF*gv*1A`o#I3+BqFW0(Dqkmh&SB%*;x1au&SIju`HU3QsIO27;$ z2t!Jlg-nSpRtk4&`DT5qtG!9s3}kWK5=O6qT5%9EeW5R`zNA|452D$1oaYcyF>n;W z3nW#22W1n%xp@waJ1{aaa6XtRk@nU^w5=bMtrCE2d5Pj+%%1v5%5KNP!Y6%6qhNX^ z4U8P6uPqZ?a1drK#@_hBQIB;|Ojiei&dE`$b;}agXMSok4-7Px?4d?A9H3>nSxl7; zdg_)Y19Mqi1|mMGzxfBga9mZ$geQkyxzSpK~;A1E=A95MgQuww^k z7|$iooKJ@9nq(k#uc4>h)ph&dsez@(69K$yU_kF%=lMs@m0&+SvquOU!t#oVO=9m?Y9whn!; z5AAxN|K3)KWmy$VUVAT%bjnAfkn9L335Qm^{>Lvu0~XY-%$Sacyb@|`kcFcTE&i1= zq1m!!9RA9gthgoU9=b8@rdwd`HPeXeo9?oV{glBHH~%%obyQbp(+cNWXKemReu}GQ zZ~CXQjn%h^Ql1^Nu}>w~T3fK48`Sb382v+@CC2fW33~IpFnV3d* zNBgsgfV zouzRWFO1!WlD|AsZ;svO+R4;Car^C0nf7~dwLp1`_o@j}@IDlt%WN5@D4?QG_7)p-M0Rxw3PBUzEl3j0O zBYYmdE`AXT19lGa=aE-^s(5j8aYKYtELncP#buA9L5BpRaPMzU{_8k3+?+tW3NHLP!$@U>`?fojwq8L>8gR%V@G za9@rgz`OXM+sa_%-v$`K=@A0 zdF6LA*RQgZ8S(8E;}BMPBrU_MR3KGlqc7rG*NiQGZqALB1JoPtB0Y_)^y9!HMTLH!N?C)0u*b^NF`>67R^fU?ChBd4Hqj`8-vdH zX-@8v-T0cUj0}>_-dg%=vFw=Aqz#+iwt;Iq$FMyg%`g7hI-`(?q;2OA-p^AQ(kW4n zKP@Po4gj3ZZlhIKff0Kl&zSp**B&nE5e|tV9fjWpti*`cF>pePO!%eaqfUifz@M zB+5E~He0Te^6K-Oq)=%k&uE9E`O@lGWOn$K9Ifwu;j~dQ-FctzC?rx?rGB*fp%4J(V?U*Qw3uT74xa%(m=Hs=3-Ej0{U zhDJt~9(2NAgiHn|W;zwquU;BUJ99c_#(zBWZ!#y$%>U$dv9mM&>y@+%9ql@tRwTcb zx>@IdS=?T}=y3S_gtq&?cwK4kVNVd#)v@XmVUiy}`d0|^%;(MZ$G^~2rUULIU}6DZOKJ&} zWDC;Lc5%J@_#ckXM~Jztddw5;u8)v}pbNV(3w!XKp}qP5{w_|CgONM{53iwwjQYcj zq?yU@Ma-eDmd)^k&LGuMq7`h=5&;rjMoU|XR_F}HQ@erUS(-}I?GbMV2;o-fjd;D1 z7N{*okbEPW5{asMv~vury*Pj(g9&HwA0Nh_T?u$=4yC>wtu7J~AsjZX@ned)I8IpZ z7t!HglnR;e2XCbrufa*MF5mh5_Jzw47I=<+GG0n#(%6X`&!eFrl7G8Ie6p7pP{PiB+7eY3zG6C@uZPwV?oOHL>9B^6=RR2RveKi}ph9W6`cwr38e> z$O7VKxnHrC2We{3aeAJpnY!g60>UNK#3q%*!nL<#TS`WIF_q!4N9{yujw{pQU$6^3 zV$|P*!yL5 zyZR$5J9s^QcmUl&(-TB~&L}y0;A|;a)d^OI7oBc(hY+rKMLjWsmyfBqovxRJ=kSwo zwp9ebVcH~X{NlJP%)LdB9-T$;W8fSu=eWyJ6PM-q<6ZY!>=pbwP+WUA{EYVDWS=NJ z8lThq4nh$G7~_6&@tNm-@}-4azHNJyJ7!;jFre?pRDjLjX=EM~jIWUKE6=gMSz;Ce zbhx3DUH9p3@0+>^A42Tft`pwm-%UPl+Xfmn)k6#TCW}+Fj)ACDqRkmCPD~4fvvxBf#3M0vs%BjO&&$T(kd7B$@A8UUNYC zLu2WE5S$qXV?@v4q((jUaP&(DeLwXVIi2pfcF< zkOiWgA4;xu`M;A0(iX8`pkk7XqjSz?L?v6m_IsS(9)cCF{d9ab(ZM2(lYk+ybyz3d z{L*-hFk11FwO`(0S85SsW*<6j-|MxW-SB9V@u2pTTZG%+f`e9YPbdNOR*wh`t+ID_8vlwQ{AZWmO0xxl8n>m{zuAGimoaChCI zlcZ=wj1{z=^xlc&Lc@v*qk4i}Rbd-Ehnln>vabtERhA$17-C-UkK8z+$#$>-_;r9c zK0{lhob-+T#X*l6?>ksO1RpzmzKOs%JoXXKf<8*IkSvrY!_>k=;yUh>WLbabjEjOt zh(1pEu{i_zc?{twsK#0~MON}N7Il=!Xq1ym)vdkv+|>fFnW?8N_R#zECM^3JxTt-@ zkb0BYAVlrKhgq^ot}5>?WHtM#_7*_@Z&H^g!nDa<;l<{J0(L1Mgzqh`ZWY z#A`oD4MklJR7Gd?d`8(nh6TH!!5-` zR9HC;_C*Lij21xx!4@rNl#g^I@vB(aY|*HvA#ID%kP#W20D|DkLIKVEp7sKNn?<{{ zX~$yP2=X-Lxk2J+DDca;zDt>nuhpO+l~-&WrL87=rU|`!oMnHtt|RRvvY>hFOizU6 zV(L~0ZP}$~WYF@KM{0@1PCNK|v)$#yZpI%R~COgD#NZwy}u0`qwtEMV$t+j&O zRmCW}$#C#QOTK-q{N0L%$_cr>-1=gdKa(Tp*EW!YON344c$tNV?HOXtux~m~elHfH z;AX&AGm*MLJwAua)Q;t`#0nYC{qGYTC?W4nZLvz0KE6PEQ&%Cl`szGD9iQE9&fB-3 z)xAP(OO1%13PH5#*ho?;ciH!Lxl~Pkp@vVfO{P9}Q@y!^8QpHI$?EcrI-MO&BvZG_ zEI&1gq#8qMy7CY|DSNz_Pfv{ThgW-y>6x6maFobfE-0W$ho#cyf6;m-yNQFM=ge9B zSS6nCtfJCs{{U(rzXCP^7$fv=cAl9||2?60h@%zB2J@}@dMH;#(TW+?pt5;?<7ujZE&j07{u zt?ffori`ssaBn$psh^Op#6+}Apr(ct+IEVq;-wQ<=FC-?Haxyf&1Ec_k-oo9!cMo% zVplH^l00~$SVZ*X*89(lwyk~#@n`i1ECR4*=&Xy2TqkJSr*z+z>8A#dXHK}B8AVRJ zT{a!%N+-EOC}lzb+0_TX+@?yUP@Y_OCOeO*)?=6K1xFBucI+D7^Ykt^&@R%FPpCFr zQ96`i8!~&`!R6HJ{4pKV-gm5Qq+5$L=?W3hEelaSBs!P;rSa3^5RaY|4=OuVWUkg< z*Jb_ilb%qry!2*Msi<=NTMTE3!tMj`%Qpo}z34D14TOIIV!gO5494k?)yHNarZN(G zNLG}RE-4$X-LRy8c}i}{Of=sXS(Bp|n5MvN37VSQlBEBG^A!P+>k54<6K17_L)WNtdi@Ns*V)!Y4&iCUOAl*sH3 zmZ*K*k&ku)@Uq8v9q~G9_t3MZ1M}g+xM54z!J+&H;*c(rGPM}{vKBaejGtuB@n(ng za|AbAkYh=HP0Lu)oo?aQaN0)r(@><^2GLcF)f4Mnq=}0`ca4K^45=^syV;C?=GGS= zXffwqgBHrx^Oi5DRH^Md$rd9aT0AIIpVA%8Ig9B9pp0&v%5b}Rh(|6^V-W2a?%0qQ3;4V}fm!iqq&P!xX4oXs8z1y_GVE?;Q z>cHYRgEsSds-n~&DKb68S7c{p7a|ugXcQDJyG{Qy&#u-8bMb;*6RszzU-&1f%z4+7 ze8fv<04Ge2JM{|ITqNcg^I)AK*wa{K7<<;-gaTgoLsq+aO|&`1>2s4%9nv*e?t~`c zfEUuWNeqWRV_h4EHXeH`h_l0WS_6QBg__xOhdhXYAe!QwTbayij#|`yQQa2+7yDoQv5PGSj z&o>aug=dFkmTS1olF!I!{XY+X-mc<$Kb*S$xOv>@6UFuF`mNnKd{Jpn?Qy#hDK+ae z0rvyIU|5jdLiECA0#N?nX)Yq6Wf^8?3DaPP7{u%3m%uv^99I+%ozknU)MJ$>J|I(w zF^E(Si4UQ9iaS%&J&H!fLT@+!;n-9eSJh_PI3lls`JTNb%!bi!TMMe!;}KdWPI_#g?HD=q+{>;j6~pkVUCHl9fq) zsNIcq1U1fbZ!v+WD*6@_x#8y3jx=~WL-QMYzZ1U=TqH>!b`@{Po#h4qq_k;?18Sf4 zBi$9Z4Ck92a5Xmb7o`yjv?&ncJnLRjIc~g8j z(;(I9(U1D(bz)k*czK5aEdnU~%Q79Vr>5raW>4Bij;r^?pOzs~E$MF2^Xir&7hD=( z5`x~MZ%XLo`=j|4Ns^)f?slIs1Fw#}KAm2t!9Hd%wb4<9a7}qnbD5UD?o;6EwXo91%DEgSVHvPe<&GI_tCxeE zY*HH;h%SXlCcZZnbhk4S8`5Y=)-Kqe9}rY{0$k9hb|%g)PNs%wR@@-afUi04|Lu$h z^M9Vv_?J!!=D!WK|1*Z!zsLSBiUAyK^lX5yNk1bOA^VpzmYJ1%8uINYtFJY4rZ5xt7d;z|Zf^^y&Cp^cCR6_bD81N^XgOBqO0g z>6B|>-V5SwhNmiCq?Qd*T7dXplz<9W#+iq}$gT|yw{@fr@Ci`LtTS?#ur@3lYbrXc zzKmI`QuGf0WDQf?W4LlB#3a1xjnH>Z?UW< z!@B}erRp@_y0&5xdV>Qf6^+eMemja%U5a3g{Uq2YqkIWJw8+wSBGe+706u~3(pGE` z!kUop47J0Aww7KBvC9CmRi>*D+ASa6o>}b2E07mO7mmdvt-cyX)1Aj9L*KT5KvIf@ z`|EuHRgf`^df5G53Kq%h-UUzL5esHnNQdQElIm|qV2`ghh)QIE#Q7w#-wFrJ60J`} zi!cH2^)hf0t+};I6NCd6>5ApuMxT3kms2}E@0WQ3-4aKy*KKbz+S6#aWk|?JTqnrA zWiRfw*FjIo{WJd$Yi|`4N!O)~;_mM5?(XjH*0{Sh&_LntE`__hYXc39ySuwX0a6B?iiB2bmt5**^cg8uH^G7&n9VMy9f!hE4Iz>FmDF^PL{>P^=# zk3tO!5hW_ZWNn6DJ~-8&LRiwQD(}yb8Ae_d!MyQ8_M=|vy$7jZN%L_D9?tk1sXpwu zm-Q@6nu&Pgg^)t%@MftzoUR(LsHfH!gzoNv1!Pd6nOSRg<)OUQ*)vrPBWXquWsF)e z!#q~PD+?M|05Cp6STXtbLi!6T*y-CyuVmv&PR#z(ySoS|E^fEx;eK(BjLz-jO z^SMWjOf1-~^7z_z^=QfbD!J&_D^16c7l#oyTeAAZ0lbcL+%Ega8yhp420KyZ>rMt} z)MKmbrs+OE?cJZk1FJX}7r6wKDHc>7J8y19ZZ2Br!<9W>e22Y@st3CLs0S!;Q^kCk z3BMckO*$Us)bFp0X_`lIcS$5mDP=rZe(Oyfs>v5osZw*oMb`_{O`tO)JL4qmK!=5A z*tKPW1LPHw^SZ}AX~d4f(+O7gYzb=-(pVdO`K_LtInC;)0Jg$r$Z_wUp*e?B_tNt4 zck>nLMsRF9AI0*#ReMYx zB1UYd`~7HXjgrT;VcASIr*8Q1aWkr?nm}FUs=Y|UIsaxNn$Dn9(WR+?2RzgCm=2sO zV4Gj*tI(&`g*TcC4Wb9ZS}e%<30oiM4v<4~wH_f(3zW!DJr-sxQzn0VTTr6olGY#? z7B7^TH|Z&`?v&YeHyV$bww^nMwW78AmKsVdf0ey7EZ@nLwZ!YT%5rgHwU1Jqi%c3kg1&_D`$O=c*J6?yDx7( z7bxg>W8h9x#==M+(VBC85-xqbm|JIA1MD3LoyO02l{yB&ikmAHIDXqpeKSk8ro2-56UxQj ziP@y@WUgYhS;z92H9KN8z1o7}_3cD7FJ{T%_qDDYxKgxd1UP+0LS*Db1BZc$;Nrq; zE~Bbh4%s(-jkOSS_~R~B6VrVPr$~s4g<#Z}$S8735lhNuUD#;GjaM4`kj*P(JIce}+ z{K=?NN8VvJI$=DyBC}7f1Q$C*ft?8^^F-RAmXd1AdKeP*a3vvnqqqTX7UkGt3bF&% zh_(4$u5-C#QDdH2MKlw(3lL=6KF=|Y7;!3tYBGB(jYd)(J4#(_K9rGF#`ep>kU3`{ zKyo|gZQGyXgiBOGxL^ZE!y%n`{T3IRU1Fk0<~_55dIXJ0zo>YE=SR!kkhWIHrU1*SP7g?xQ)DMq zpI7*8p0IfIwRDzJWdE;+TVhk1A6C9mkd(RXm<6sj=hbDIb^mT&xsP@yVTgFt7>-W` zm%>#GuqyPE+0!ukT@X6OFRA~1W(=-OcQs@tIOk41aL2mr0tkKLg>%XG%|U5aznxuI zMZC&?#d4N2@^Kt)bkHa6SH)(t8_`~t5y|yNLF-X6;fp@Fx~Gzic(QfP&D4nfeTEoj zV+X9?6wEOcAKxfCG)J3UHsm79uGuQpxYS0nliOdGyT3^HR`wtKK0&ibqs<%@H>(+v1 z?tpKbROi^cHKT_^VAHlsSAp3kOu$Z<%~cB^N9*7rxSh#B_DoT#i07*!44d29sUyDA}k& z(#8dhV!WVxh`2y4S@!pWIht$B_hMc-hHlklSqWaQ12XQ0Y0N^>Dfv2CN3=Q{!6r0k zI8U>>7fr~kVzA}AtR#JRnv;*s8Hc-zKXZIqxnFi$tRFy*fkHr_WIxu`t@72A>RX1! zfK1D;>v+`dr35iW51oe9y`t%w*Qq&2J00k(gryH%-+kUd7Bx?kML!DV+Pd;W**uos z_kpLm;KfITmS{VspBwU1)v6Xz?ziB_-GgHd##102vHoH~&0_S*n?vXsJZ%}xE0NM& zFinv|rl4QWgnt1?;ZI+@{mVY+aB2rdm&mI2Z=Nkkk?FQa=p5+x0LTUIzdY}^BW2tE zo63FHTkpvHf1Xa45s|HU{1t@vjmNB~7ktmUZi_>~g=TOr(8sYg9-uc?KKr}i zCyH{%96xbSwxUF+89PyW?by}f0U>gNw500Fa=#Z5la2s-rhBnIYGh*#q}UyHW)NRB z95;^Ip!li5^8wD&)-%d>r%mVu$>&^SJ*LCqO~APOEJK|BI3)FcV*V&xYA0*m9HU^t z#^@9IkmJg~*Op_$+t6@DlSBdDsP)5^S}8YTVoDG`d?>kkn{qVifIxIFSQv%*;+)SV zk2=L-Dih$B;3>LeGF(F85H`_VL8S&f=Y-y^5nW5)IiuvKD}F~5CKa`|80oQx{E@V4 zx8B@G&=GgO4HbiY99F`1MAQ#~h+xG3N!Nv8RZh#xkuG4z?OWaL`10EZNhTjN=$({u~S{n8mR;po<2=4RofhKz)0 z09z~{2%8K-*{$`Roz+*UB3)4d;x}WwUK)2$h6~v_ZvYdd)UN$FEcKPy4@g};R%Lv$ zHat0;4O&tbqQ30m3~#}TZ^kp5L!TY_hHx>k=pF@^f_`c++x^>E+43$8COKj>9>nYT zQnP^lYK}TZ6Nagrl!Tkky{&BjR?vNcCZ&L`=u5_Ipxx@9X#wQSmJ7_fef?|k0k)_= zri9Mrg!#WgE7`Ki!WX$pbYK3!IB(OsjI9%9(loW(qm@Fuk7d5Q>Ufgn$Q`QmyX zQ|B=?RRj|}Dd1)#e_1L4nxjL*v|>3;&)tO0ju<2T&VqA z)sUe9Qstmt50n6(?D_$A6_GmuM>_kf#Apa!&=~z*l%0zTVx#S=1a9o9KnlWpBpIgP zis33yHiPF-(CEyupu5VZr?n9!wy7r+X=h*-=jUh0%Rt=Q^gT<0d72d6w)LZ^q6bpL zs@Q%-Y?@uO^zF^Qi(On2-H~E2rbXF=ha3?fFDM!9C8}c_B&6v{+5C%~0JZehk7!Og z?R=#p%&@+_ofyz0I zy`zU!_ez8KEAYP3`Jhj~YHUC3JZ-D=~}|9<}ZTdI(%4@vAc zAFBO6phm7gdlGv|s5`59ni1gcHjg#n0jw_qd0~{xZ}joT>9V@#a@G(n04Z+dY5x3D z21E%_Ef?UUE&i&hHK|?`+RlH4uaI6941gPTJvV_`SkU-o@j`*~phI>Hkz&Ci1^$Hu6t1?jOuwln_xFQsVR-V=x#17u&xJ z%?MZH$lGoWzp)A%XFY*39Ff)|Qiz!H=uoo+3CQ%Y`)4B7PyGd_ZS=-iy%1NE&qDNs z?y<$BCDQ!W`McIq8RN6p>?SWYM&~>xO?mKmFddvyDs;{ly}z&j@sI?8Rmr6&4@fbm zXStbdlExy{0RYKIk&q=V_kP_!yqO*ZAbma!!^QunRRQV$QIr#he{BiS< zi2C~Q20*TxnO)I*g%`&?S20D@TyiaFPmaOe2i%p#LrX;lT#fL?K4qbC#-*rdz%DDS zmc{2GZ~uKicM|@1#dm+ZeY~kdPPx;TD=E?ViE@f61mN_A3;0N^P8i&qQq?!Tgln4D`cUx|l#?3TS=)^L>U6xfZeO(-V!3CIOL~$jGb1$Mi8P48NP1g zG?%_sAsB|6)VSP+TWDttN};d?;fprCbj0h#G{t_O-+;S-qHj}CRkVOqI49dzGcl} zAw^jV>DtJEs^o>!R%Cmv}6uGjoJcM-8G~kOrl9T7ba&ZdEHt zNkai-(&5Jv8!9Z<`p--^13^%|>bZ3>Qw*R^zIH1~GH0~Zztux>aG3q0gbp=EWb-2=F2*vpQ?CKO zM6_H^JH*_Kp`4e11xEv>iK8vMKi^pd=NFZ!6%s~QJvj?Sd zPUk6t8Rn&_56u|?9&7x;dxI@KFCfoV!%lhpaWSfkd`U{+9H^BZ>>nWyvT#S;0Y)Q8 z^pf9RtDJZ8KLL4~8t?#%BxV{(u0#oKx~44c*$1D7*+>*8f!X@k1NWlJHoagGUrCpH zGpjO)aDk#Z(>yL12KX5AlIBu-lv$qUbSb9?PvS7L=A`v7u}l0_wFadrVaO*{G*nb+IIk?Yljp&2exzs;Bt6 zLu8X~vx*eN2T>UH^oIeA3i%VUSc5Em&saq;&0K{)++@H4Mum*5$UXE6q4bYC0#!q( z^53jYFuIvr+ARP~cC@ao2WPB`PG+2}=i}W&vQc2}W_%(^LX->;i$L8MUlz1##Op~H z2>sI zudAUd(8XRHTinU;L`#Pa{D;Nbx;GOLyHUu#D5N8l@EH($6HoqbiNAqzrfeTmNb9GX zpDl|0_EU{Gs!7V-;fBH>^RK`#{co^#jgTsst%b5@(BKBoc4o|nXO?IM}(|Zw8~)bxe>Qk4ezLY1y0c^@+jc` zRq9%CU-H$fSe(~W)Mc(A7&x>QxC-Jx9E({bsy~0}+zJreC!yC}H*pZ<4F1Sq`^AFH z$vckAM_e*NL`XGz;l{qGXb+7m1C?NB!``S8l?Y4>VecuGy^&^De|R?dmXmKs*89KX zQlm24To4fN@&6$VUqm@VXjs4Onfa_Rh{<^poJu1QXN44Z$RYd4>djzf%7c_BBy`%~SGLFkkbO zvf+1)2;c9rKTngT*0Z0lwsm%P8S2x~r#m1ORHZz&qnF2}`x?8w9sc|+0;)gn<~GIW z+M}Hr;O!|tRME_5CTkOTnB+7bc{58bi(diuqF!jkQ*OJObYxqw;|o@N@tS9!T}uV* zl#L?LsistExc&1eJ9U}9Jsj4G2>s9n7&9%Z%BUW3vHB~hwr)aSx9VaT;FD#lD>0$T zb7ieAPSpcxm51Pd*UQYCT?&yX3gt^*%w3VzDAq@6iYID{%X_zCm^Zr*;pmS)m1Y3q zNiTvEh!ytLPnlUJRfxF|e}eZSjt-+B(JXa_A9Ux$@S(8M{6_tCZ@xFg?#dj&V1I}N z&vG16FTarp=CO+9E89ioveUYf;NS0E6_s{bVVe}$NTp`;rCp*z(m>J2s}dz;=JjN2`eq=0%YJtT|t0SdjrWFLJ>F#8xnL1#hvcxP)VWT(GgMM5t-0A&!_m5#e zrUXWT>&ruzq&jkWUDiMxwaU6F7PsL)Xia=)g34j5c(bc6vl+4cpl4lM zJLL&NUZFsz%5dq-U|Y3{cUNBHOX)Htf_z(Nj?u}M`TEz(Dl9>!n1-Tt3bV_H?iDQQTe{h0 zD$He!WDP2M-RlrWt>l!$i|)IK#)}FI-I8zh6iTt_a-X!wY}kfz*dsQMyVyA z_WSrVLn~vRZnwO7iDS#uJe~8&Ov|QeEE%d}p&!YNQgNpk<<1}bj#?GiBzZ6)V3N;w zDfRD01$B?X&)jb7=8*@0@bQ#O!_dtNx63efR;tY2IZK?6Vy$?H!9 zSB8ceceu|@mT)@(r0|Wg`Oq+n^&?ugI2xl#&KNRE)dA-={=AIuQ`BcUw~>;!zHQ)n z2n~X|YkgtLDHH=ZrB7|JmmlDjaF6H-w`xRt%1HksIixh)qu|u;k=?BCbO(*-jQ4?ZV@k1&)M>^F#ZhK@JyNW*FX2PkeG) zSss{l*GdKt9W@cjJp$>l-w?_pr+O02)ZG|lb7}&zWT}j=j-N>wHwCc^-yWR_ELAYu z6d&84e5ax~llrd#1e@DZ-EKFm&@U%Zo!fY>PB^A$NF&qs<@Bv!X&KP#@t#r#b*ly1 zmHzY*9%~sN4nzCk5}lFQTYq;vrZRYk6GvWU_Ze`Hx_@&Hz#Uv79;5%kD|}TC7qe^O zSG*>qACeABGM9RE73&rx99}9#JO8uEa5;a?IOTwH&952{ICIITFxOMGi1rzN!M=%; z%`P*{84-?xD~!?d1@Jq0^$+tl{<;CpYN@HP;|^aQQ0~~ua%j_>If3Vh=$4zIp^7lq zYxgtDIRX{kv%@`vQ@(SIF+E4T`oRW=9YR0ZvX!HHpgm0UN}o(~*Be6yQJ}?)uF+u>L#j!9J~vtnSE-7_UFs~dCu+oac+Kx zqq=zLLG^A!b`Pu*QBw~d3P3Dqm!OQZbTCW)h}McoId{BefuE|DWBsKA{Kwyw4LZ=t z92lBE0LmTHQe^l8`1oZ`8zPi$x%+?}8qwfzK6+{uB?e@VDh^~VepATfR@r-FL`pq< ze#4>LYb?>Tv@2&EtphBkHvP>Zr(y@mE zT2Lah*WpN^UYGu09^*O*;xzajaB&ae*>GVVz_4h{?GZ(g^3Bj3_%T>tIyxbU*(1L1 zed*o|0e+Yjb_RD&1@t4T%5#;8kD(4uVSJO%Y=jxKe_ z{TRe@qksdU088t)7JD{N!|O^aZpP_dy^!x~SG%U?0vHS`yXn*BWUZw)45(Q?(RCU& z0CcUq1b#bVb=BQ~SQuV(lR zpk>{ZOyv#_AVJzbAU|DfEq_IZxwNQ=7Q=g-$4o9z)1oQxZ5G>0K^_M-Ow?vy4^9Va zWoD13R4zNvi*Tz%r^+ADJzR|ozSVrW1S<9Pw?MeNPcLe+U zzGzMai0Ge)2899zz2>6TC9}BFDzu%&2Q;b}#f9IbE)|<{2~c;pd5+!{;m@{90F)xb z18P|HOWsc(io3hvDMb+l;XG5mhwr@1P#E&eHFk@io(e42ct3@cx4)tF!I?!iPsl)F zg#558Heo->r}0yt2n)F{Wqb8~0h#Z*%rkD3U>lUgNdT3lGxIze4QS8py=_m=ilyFN zun&&~E9xGl>FuG(gVs86psy65l?-_5F_|h*@^_-l_SEiylE%*5*QNYRFZN7iOU{?1qb@z6* zAYoRpakTr2OaCX6oP&quD|Cp99l*&;!p_CR#LN2if#k~p@e2nR%U32jJ0}+tCo2~R z`@ct$|IhpoZ5-X)P3-Oek$L?G&x_I0^okI z&id~pJHl~Cind#!Z>+~4M~%-^^)o+jz;8$+gE=eh}P~!&4IwYc4gcBuaNd%%3na4PE6NVqk}Y@fqR#v$%zDgN`6Xt_BgDoJwUJ z7~>EQ9taPvpc~-s1eT7F65^FUSHuE$3{Bn~6E6bIMhF1&7cl1D`i*4IGcVM_xT$K4 zi@((tFsea>@0|H1wad50nie-0W}b97!$g8E*`Eu(nFw;3*7xFrnCu4XpMfEdgUS?l z2ZtZBbThPg_=7p5b@q3aP~EV2vNPG9vQ|el&zCUGcvisUq(e9zdqWTRIymZg7KwB& zKyEN`f&$XLm#1K&EN=z6UDkSm!W=?Te}w zBSpiXrhS_@`;V@l{-9XBBX0;c0+!tXoan}4V#(p%VejGdd9UT877kB8xsOs-X`L(j z{lKzMhM!is=gv=<-O7GPE<(lrLW%w-0-9NQ4$Bl<;>lc|0wj~V2oO$evEnffWVI6m zS%8w4TXbCR9wT%-pK`aT4(!&n$%p5ZU0$hz*YuLaP{*Haqj zcqjw1X*`E>_fo-ef6{J7CQNLU!yWmsrU0b(u%)saI1^IOuC|+$OQV8bh8(raNH_<6 zwBoS-$laKw;SS;#yJBMeTY*%X2*7})X3Gy(s>K;d7x+ob%Ro|}fMkfEgmV77kivVL z;k_csHBp_~^@F;Rrp)5yZ9$TbOqG>3n{`xvZ+~P_ALk^nv$O~XN z(3Ij)(_DR_JC&_9JkF4=Y1*gU;$Y10V{a~6scS;l60LID-~cVi^-KC^R8}vNmcOHtz~R>iDVT2Ca;Z5)4@tRlvTZVhqrd z0Bn2B(akfw5uRYJ+7`_(mQ1Fe(t_m7V_&WfYm{q*RyEwI4?7OUs@yD0?TDtRZ90l# zyl{15y&}~%a$(?JY`Qvf_1{@R%87wDUIZ8f{zYxq96KSD8X@Hn~!{i=|so7F5ZAmE#c7ff@bbVK3 zSB)KVuH*-Ly9v#!LAU%RYJt%h!sLF{OrTO(kQs`s&UPTI-@+A5Js>6)D)INfW*hF) z>cX$tX5N{R_lt~FCnEdZeWH-JnNepvQ@U@pV*g=~BWOGmCXqhYAw(1JrY=Ucvh;G9 z7|8}Av1jfW#cQ1B7iHsA{Kex{-L~&jd|q#jOXVy#Ng=szNa!$eL}2|;vOHdF-AL=e z%Svf^jo6!hklQ&xjZ(t7WyWSL`DPe|CwhBkuOTTgS5> zxNM6tP6|<*xCj|qbi$D(TgTtd66TVvR}=$NaE?T$I`j+BN|Q#r!Oqe@--F-&ls3|} zKqP22{1c|;t5#AB+Ro%@^cgHVm$i_k4VC9v{d)niYX|rYGq) zzk#;8FxF26C!AkG9!wBoZXRN5T-FK{$X_og$P_9vXso}OJt=se!SEcDF=t{bw1q~6@c(BQF zHLwNX>WZKsmsHMX$Tn6=^C@06Ajh+q5Mlt$OqW72k`42$2B3v;b94o<&gUDHR3$PO zdkN!HCXx6q#==yL^&qh_8ඨT%t$)o6M8A~T=g8j`ojurdNg6EDqhJj90uOPLI z;59_lz`$)^b(msnmWo6Ga%21B=JJc&bFU28TR@Mdw`wdL{BtOBMS5Gi&m+pt`l+4p zdUahU{P+Fg&1qyeez5CrzRTyx&3afgJD#z)f;tHC+o0O~o1O>`xO4-aydje_RuRF7uLY@ezD5!%OR719!67{0 zG!Eo^rJRCX-P^w3VylHc=#o4yrfwJDw!&4-k-j^$a%GI=C z6(#IOPDRS0_#AoAMZ<9*SIR z7g}m?