Network usage rates: Monitoring VS applications

[simonquentel]

Hi,

in my company there is a growing concern about the network use of Zabbix.

Precisely, it is not the load but the number of created sessions that is questioned lately.

I have been advised that about 70 % of the TCP sessions created are Zabbix sessions. Again, it is not implying great load on our LAN but the high number of sessions can cause performance issues on our firewalls (for routing reasons)

I am pretty sure that the number of sessions created by zabbix corresponds to the "normal behavior" of the tool, meaning that I have around 30 items by server monitored and items are checked each 1 to 5 minutes.

Do someone else already experienced these kind of remarks from the network teams in there companies? and did you find a way to solve/ answer the questions raised?

More generally from Zabbix or any other monitoring tool, do we have any idea of the usual number of sessions acceptable? (by server, by LAN, byVLAN, by firewall)? Do we have any idea of the percentage of sessions Monitoring/Applications usually found?
Are these questions that have usual answers from the zabbix team when asked by a customer?

Thanks in advance for your replies?

Regards,

Simon

[eskytthe]

Try this post:

https://www.zabbix.com/forum/showthread.php?t=24657

BR
Erik

[simonquentel]

I already use proxies,

my concern is not about Zabbix performance but specifically on the number of sessions started by zabbix monitoring on my network and the usual values for this rate (compared to total sessions) in other companies.

Regards,

Simon

[eskytthe]

Yes I understand that.
Every passive item will make a new connection for every check from either the zabbix server or the proxy. Active items will gather checks results together - in fewer connections.
Proxies will also reduce the amount of connections, but the footprint on your network depend on your network topology and placement of proxies.

But 70% of your network traffic seems high. Do you know the actual amount of connections?

One more thing: I may have had some problems with many connections to/from some hosts, because of failed and/or unsupported items. But I cannot recall it clear now.
BR
Erik