Zabbix infrastructure doubts

[alz0]

Hello everyone, in our company we are thinking of migrating a large monitoring system to Zabbix. Our system has +3k hosts and +14k services.

We come from an infrastructure where we have 2 main servers and 2 DB servers (mariadb cluster galera). With netscaler we have 2 farms (frontend and backend) and so we get HA since the tool we used did not have free HA option.

What would be the best infrastructure to set up? Would you keep this configuration or similar? I have seen that Zabbix has a proxy server, but is it really necessary if in my company we already have a good firewall and proxy?

Can someone clarify these doubts and help me to decide which would be the best way to set up the infrastructure?

Thank you in advance!

[cyber]

Proxy in zabbix terms is a collector, which gathers data from agents. It is not the "firewall and proxy" you already have.. With 3k hosts you will need several of them to unload data gathering tasks from server and leave it to calculate triggers etc.
I am not familiar with netscaler things, so I cannot say a thing about it.. you already have DB cluster, if you are happy with it, keep using it. I would add separate host(s) for frontend, so all functions are separated (front, server, db)

[alz0]

Thank you for the reply!

And what happens if the frontend server fails? Isn't a good idea to have 2 of this? Why do yo separate the frontend interface form the server? Couldnt they be in the same server? At the end, the web interface isn't so heavy, i dont see the point to sepparate it.

And the proxy/collector is like a worker? How many proxys do you think I should have? 2? I currently have in one vlan de main servers in another one the ddbb servers and in another one the worker. Is there any problem on maintaining this?

[cyber]

yes, you can always have HA frontend..
And you can have frontend and server in same, it really depends on your user count... It is the matter of taste, I guess... many users with big queries will need some more power, which is then taken from server, not from separate host... You can always start with a single server for all roles and then split it up ..
Definition of different zabbix processes you can find here https://www.zabbix.com/documentation...nual/concepts/

Proxy count is very individual ... depends how many items you collect, what type of items, how often etc... with your 3k+ hosts ... maybe 5, maybe 10, maybe 20.... doing a lot of SNMP will need more proxy power (proxy is polling all those items). Leaving a lot of things to agents, then proxy can handle a bit higher numbers, as agents in hosts gather that data by themselves and just send away to proxy, which then sends data to server...

I have 12k hosts and 18 proxies... but they are for different purposes ... some for linux, some for windows, some for network devices... plus different environments - dev/test/prod... You can add as you need..

[alz0]

Thank you so much cyber for your time and for your really complete reply!!

You have really clarified almost all my doubts.

I just have few questions about de database structure.
So, maybe having only a cluster of 2 databases is not enougth rigth? Maybe having that galera cluster isn`t the best solution? Does Zabbix offer a better performance with another bbdd infrastructure?
As well as with the collectors, can I start with a cluster of 2 and the increment the number of this 'easily'?

BIG THANKS!

[cyber]

How many replicas of your DB you want is up to you.. I am using Postgres (with pg_auto_failover) and timescaleDB plugin.. 2 data hosts + monitor host. Some of my experience with galera suck enough that I am keeping away.. But it does not have to be you experience.. you may actually know what you are doing..:P
There are many who use mysql/mariadb and are happy.. But they support also Oracle, it is as big as it gets..

Proxies do not provide native HA (yet) so if you need that, you must build it by yourself.. pacemaker/corosync cluster for example.. Or anything you have there already... If that is what you meant with proxy cluster...

For trying out things you don't need many instances of things... start with one, add later, if you like the thing and would like to use it more... It does not have to be total switchover at once...

[alz0]

Good morning.

Thank you for all your contributions. I will take them into account when setting up the infrastructure.

For now everything you have told me is useful but I do not rule out coming back here when I'm setting up the system
Thanks again!!!

[alz0]

Hi again,
Reading the documentation I am a bit confused about the difference between installing a server, a webserver and a database server.

What I can see in the following link: https://www.zabbix.com/download?zabb...debian&os_vers ion=10 is that no matter if it is a server, frontend or database you will have to download and install the repository.

If that is so, I do not understand or I do not see in the documentation the steps to follow for the configuration of each of these servers, because I understand that they will not have the same configurations. However I see that supposedly it is necessary to create a database for each one of them? Where is it specified that the Zabbix server has as DB another remote server? Do I have to install the database on the web server? I don't see the point

Can someone clarify me these concepts? I do not have them at all clear....

[cyber]

If you try to find 6.2 server install for debian 10, then you wont find it... you need at least debian11...

the link you get there's just adds repo to system(s)... after that you install each piece where you need... if you install all those mentioned there at once, you get all-in-one server... but you can install just some components on one server, others on another...
you only need to install one DB, somewhere... and point your server and GUI configs to that instance. For proxy you can go with sqlite3 and have it locally...

[alz0]

Thanks for your answer!
Yes, I plan to use Debian 11.
But, what you say about pointing the Zabbix Server and the GUI to another instance is not very well explained in the docu...

I miss to have a little more structured the docu, where it explains better the different steps for a distributed monitoring.

On the other hand, as for the proxies, for a system like the one I want to install, it is better that the proxy is active or passive, I know the difference but not which one is more efficient or in which cases to use one or the other...

*(edited)One more question (not related with infra) I have opened some topics about how to migrate from nagis and no one has answer me... What do you recommend to migrate such a big system from nagios to zabbix? I dont find any tool to easily migrate and doing a fresh install is almost impossible...

Thanks again.

[cyber]

I don't think it is a matter of Zabbix documentation to describe how to build your setup... There are different ways to do it and product documentation cannot cover each and every combination... If it is said that it can be done, it is your own knowledge how to build your DB cluster or HA frontend etc... There is not a word about how to build a proxy cluster with pacemaker/corosync.. But it is still done by people..

active vs passive proxy -
Active proxy will send its gathered data back to server by itself, passive one will be queried by server for new data.
Passive requires one way FW hole to proxy (server initiates all connections, gets data and sends updates), active needs the other way (proxy sends its data and also asks for updates)
Which one to use... Maybe your security regulations do not allow inbound connections? so you need to use passive then... But this is a little bit of work for server to initiate connections etc... with active proxy it just listens for incoming data... But I dont think it is a huge difference in perf...

What concerns nagios migration, I cannot say anything... never used the tool, do not know anything about it... I doubt there is a "nagios to zabbix migrator" somewhere..

[alz0]

Thanks for the explanation!
If there is no big differences in terms of performance I think I will use the default active mode.

It is a pity that there is no tool to facilitate the migration from nagios.

Fortunately I have seen that the nrpe checks (nagios own) can be configured. Here I have already seen that there are 2 types of agent, I hope that you can do this type of check with both. I'm going to find out which one is better to use. But can you give me your opinion about them?

[cyber]

nrpe seems to be somekind of command execution plugin for linux servers. There are options to execute stuff on hosts.. https://www.zabbix.com/documentation...remote_command
But for checks (obtaining data) theres also ssh agent and userparameters etc..

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/ssh_checks

https://www.zabbix.com/documentation/current/en/manual/config/items/userparameters