Zabbix logs extractor best practice needed

[[email protected]]

Hello all,

we have started a zabbix monitoring project in our company, and we would like to have some advices in the way we need to get the KPI from our applications.

First of all we plan to monitor few dozen applications distributed on some 100 servers.

We have chosen to monitor the KPI in the application logs of each application / server. What is the best approach to do that?

One of our question is the best way to scan the logs. For security reason, we have chosen to use a "push pattern" to push the data on the Zabbix server, instead of pulling the data from the Zabbix server.

For example, we plan to make a kind of "tail -f " on each server on the application logs and then make a "one minute extract" in a "awk" script. The awk script would extract the KPI from the "One minute Extract" and send the "kpi extraction" by sftp/scp to the zabbix server. Is that a valide way to scan the logs, or is there some ready made pattern?

thanks and regards,

Etienne
Montreal

[eskytthe]

zabbix_sender is a good tool to push data from a host with a zabbix agent to the zabbix server. Use the input file option.
http://www.zabbix.com/documentation/.../zabbix_sender
But the zabbix agent to server communication is not encrypted.
If you need that, check this project:

http://www.zabbix.com/forum/showthread.php?t=20403

You could also just use your sftp method, and then use zabbix_sender local on the zabbix server to push the data into the zabbix database / system.

I use a central setup - with a central (syslog) server. Alle the log analyse is done on that server, and then forward the needed values (items) to the zabbix server (with zabbix_sender). It is more simple to maintenance because it is central, and I do not take performance from the local servers.
BTW - you can make encryption on syslog - may be a good secure push solution.

The zabbix agent have some log functions:
http://www.zabbix.com/documentation/...ed_by_platform
(log/logrt)
But as I see it, they are more for text matching (events) in logs, and will just push full lines of text to the zabbix server, where you then make some triggers (alarms) on the contents. I do not think this is what you are looking for.
BR
Erik