Difference between revisions of "Zabbix configure template"

Line 97: Line 97:
  
 
===Create LOG item===
 
===Create LOG item===
 +
 +
This item will check for errors or warning in a log file.
  
 
* '''Type''' : Zabbix agent (active) => the client will report all changes to the server, client's does NOT wait for server interrogation: it's pro-active
 
* '''Type''' : Zabbix agent (active) => the client will report all changes to the server, client's does NOT wait for server interrogation: it's pro-active
Line 108: Line 110:
  
  
 +
===Create PROCESS item===
 +
 +
This item will check for a specific running process(es). It will return a numeric value == number of running processes.
 +
 +
* '''Type''' : Zabbix agent (active)
 +
* '''Key''' : proc.num[java,vehco-smartcard,,]  => check for 'java' process running with user'' 'vehco-smartcard' ''
 +
* '''Type of information''' : Numeric (unsigned)
 +
* '''Data type''' : Decimal
 +
 +
 +
[[File:Zabbix item processus monitoring.png|700px|Zabbix item processus monitoring]]
 +
 
  
  
Line 115: Line 129:
 
You can check if your item is working or not. If your configuration is OK then you should retrieve some data. If not, you have a problem!
 
You can check if your item is working or not. If your configuration is OK then you should retrieve some data. If not, you have a problem!
  
[[File:Zabbix latest data 01.png|1024px|caption|Zabbix latest data 01]]
+
[!] Note that sometimes you need to reboot the server for the zabbix_agent to use the new configuration.
 +
 
 +
[!] New data will only appears after a while ~ 5 to 10mn.  
 +
 
  
 
→ Monitoring >> Latest data >> ''Searched template / hosts''  
 
→ Monitoring >> Latest data >> ''Searched template / hosts''  
  
 +
[[File:Zabbix latest data 01.png|1024px|caption|Zabbix latest data 01]]
  
 
''Note'': the latest data will only appears after a while ~ 5 to 10mn.
 
  
  

Revision as of 11:27, 29 October 2014


Vocable

Key points:

  1. Zabbix configuration rely on templates = set of applications, items, triggers and actions.
  1. Each template has a list of applications
  1. Each application has a set of items = datasource
  1. Each item has some triggers = conditions to raise an event with a specific alert level and type
  1. Each trigger is bound to some actions = action to perform on when the trigger event is sent. A trigger can rely on many items.
  1. Each host belongs to one or more groups. Each group has some related templates they apply to their hosts


Create a new application

  • Access applications' list

Zabbix template 04 applications

→ Configuration menu >> Templates >> Searched template >> Applications


  • Create new application

Zabbix template 05 new application

→ Configuration menu >> Templates >> Searched template >> Applications >> Create application


==> Give a name to the new application and save.

==> It should appears it the applications list


Items management

An item is like a datasource in the dev. vocable.


Important notes


Each type of item has a different set of keys (functions). You can find the complete list on Zabbix documentation:


If you're using DNS configuration then the host will report using the short name. Be sure your discovery is NOT using FQDN or you'll never have any data!!! That's why IP unique criteria for hosts make more sense!


Access items

→ Configuration menu >> Templates >> Searched template >> Applications >> Application's Item


Zabbix template 06 App Items


Create / edit item

→ Configuration menu >> Templates >> Searched template >> Applications >> Application's Items >> Item >> Create Item | edit Item


Zabbix template 07 create edit Item


Test the command

Before registering the new item into Zabbix you should test the command on a running server.

  • SSH to a running server that has zabbix_agent installed
  • Try you command on that server and check the output!
## Return the number of JAVA processes for the vehco-smartcard user
sudo zabbix_agent -t proc.num[java,vehco-smartcard,,]

## ... NOTE ...
## The test doesn't work with all commands :( For example, it doesn't work with the LOG || LOGRT rules



Create LOG item

This item will check for errors or warning in a log file.

  • Type : Zabbix agent (active) => the client will report all changes to the server, client's does NOT wait for server interrogation: it's pro-active
  • Key : logrt[/var/log/vehco/smartcard-service.log,ERROR] => to handle log files rotation I'm using logrt. Only the ERROR level will be reported back.
  • Type of information : Log
  • Log time format : This value must match you own application! I'm using dd.MM.yyyy HH:mm:ss like my < logback.xml > configuration


Zabbix template 08 Item properties


Create PROCESS item

This item will check for a specific running process(es). It will return a numeric value == number of running processes.

  • Type : Zabbix agent (active)
  • Key : proc.num[java,vehco-smartcard,,] => check for 'java' process running with user 'vehco-smartcard'
  • Type of information : Numeric (unsigned)
  • Data type : Decimal


Zabbix item processus monitoring



Check that your item is working

You can check if your item is working or not. If your configuration is OK then you should retrieve some data. If not, you have a problem!

[!] Note that sometimes you need to reboot the server for the zabbix_agent to use the new configuration.

[!] New data will only appears after a while ~ 5 to 10mn.


→ Monitoring >> Latest data >> Searched template / hosts

Zabbix latest data 01



If OK you should see something like that:

Zabbix latest data 02



If you don't have anything:

  • Remember that FQDN != simple name ==> smartcard-main-00.smartcards.vehco.com != smartcard-main-00
  • Use a Zabbix Agent IP instead of name



How to create a new trigger(s)

Access triggers list (~ event condition)

You can access triggers list from an item or a template.

  • From an Item:

Zabbix template 09 Trigger access from items

→ Configuration menu >> Templates >> Searched template >> Applications >> Application's Items >> Item >> Triggers (purple arrow)


  • From a Template:

Zabbix template 09 Trigger access from template

→ Configuration menu >> Templates >> Searched template >> Triggers



... You should see something like:

Zabbix trigger 10 Trigger view


Create a new trigger

Zabbix trigger 11 new trigger

→ Configuration menu >> Templates >> Searched template >> Triggers >> Create trigger


See the excellent Zabbix documentation regarding HOW to create a trigger: https://www.zabbix.com/documentation/2.2/manual/config/triggers


For the log you should have something like:

Log 02 TRIGGER


Expression = {<Template>:<ITEM>.str(<condition>)}=1

In my case:

  • Template: Vehco-smartcards
  • Item: logrt[/var/log/vehco/smartcard-service.log,ERROR]
  • Condition: ERROR => react on "ERROR" string

{Vehco-smartcards:logrt[/var/log/vehco/smartcard-service.log,ERROR].str(ERROR)}=1


Note that the <ITEM> must the related ITEM.


Action

Access actions

Zabbix action 01

→ Configuration menu >> Actions >> Create Action


Create action

The following example will react upon log file alert and send an email.


Action

Zabbix action 02

On this 1st screen, you must:

  • Give the action a name
  • Set a custom email's body. You can use Zabbix variables
  • enabled the new action


Conditions

Zabbix action 03

No matter what conditions you choose, remember:

  • Select and or or condition BEFORE adding a new condition
  • You must select the matching trigger. That's the only minimal condition (see my example)


Operations

Zabbix action 04

Just choose the email operation. An operation is the result of the previous action and conditions.


Conclusion

That's all. You should receive your alerts by now !


Sources: