Collecting syslog data by Zabbix

[pinguin123]

Hi,

does Zabbix support to collect syslog data from switches and routers? How does it work exactly, if there isn't an agent installed?

[jamesNJ]

You would probably configure your switch to send logs to a central server (perhaps even the Zabbix server) and then use the zabbix agent with an active check to monitor that log for interesting messages.

I think most modern syslog daemons can be configured to accept remote messages and create separate logs per device.

However don't ask me how to set up syslog monitoring in zabbix I'm still trying to figure out how to properly use log[] and logrt[] and completely confused by erroneous error messages and my items going unsupported.

[pinguin123]

I also tried to collect SNMP traps of switches and routers. I received an e-mail:

Trigger: SNMP Traps received from ...
Trigger status: OK
Item values: SNMP Trap (...: snmptrap["SNMPv1-MIB::any"]), *UNKNOWN*
Original event ID: 27747

But I can't see any SNMP traps in Zabbix, neither in "Latest data". A wrong configuration in the item settings?

[jamesNJ]

It is difficult to say. SNMP trapping in zabbix requires that you set up the linux snmpd to capture traps, and then have some method to transpose the output so that zabbix can monitor it. I haven't set SNMP traps up yet on my system so I cannot comment further.

[sandipc]

Tomcat monitoring

I have zabbix server installed. Wants to monitor tomcat. Have the 4 to 5 tomcat services with different port numbers on same host. Unable to found the steps to add and monitor those services successfully.

[jamesNJ]

Sandipc this thread is about snap traps. Asking a new question to the forum might be better.
For monitoring web services you can look at zabbix agent type net.tcp.port[<ip>,port], or perhaps using a web scenario to login and check your web pages.

[kloczek]

Hi,

does Zabbix support to collect syslog data from switches and routers? How does it work exactly, if there isn't an agent installed?

Nope. Zabbix it is monitoring software and/or it is not syslog server
If you want to organize central syslog log server you can use any syslog implementation (all of them have possibility to accept syslog messages over network socket).
All syslog servers have ability to store in files or other containers syslog messages or forward such traffic to another syslog server.
On system where is syslog server is storing logged messages in files zabbix agent can monitor new lines logger in those files to forward those entries to exact items which as "Type of information" must be with "Log" type.
Based on items with such types of information you can store only those values or add additional triggers if logged lines have exact patter(s).

[pinguin123]

I was finally able to solve this problem. Now my Zabbix can collect syslog data from routers and switches.

I found my solution anywhere here in this link:

https://www.zabbix.com/forum/showthread.php?t=48835&highlight=syslog