Active vs Passive checks - best option in my case ?

[frenchlion]

Hi,

We've deployed Zabbix to monitor our ~400 servers (mainly Solaris, Linux & Windows hosts, many of them are Oracle servers etc.).
we are pretty satisfied with it and will start using it for many things (not only basis OS/Middleware checks but many other app checks)

The confguration is using the zabbix appliance 3.4 for the moment (we plan to install a 4+ on RHEL7 soon) with a little tuning, as well as agents in 3.4 except for solaris using 3.2's.
The client configurations all have Timeouts defined to 30.

Atm we are only using Passive checks (as far as i know).

We are having some trouble on a regular basis with our SAN & some databases (slow hosts, queries etc.), thus generating a lot of "host unreachable" alerts on a regular basis, annoying us, Zabbix is also missing data for a lot of hosts on a regular basis (we see huge wholes for 10/15 minutes in graphs)

I was wondering if switching to Active Checks was a little better compared to Passive checks ?
If the agents themselves are forwarding the data, i guess at least we might get rid of huge timeouts and that type of host unreachable alerts ?

Also, is it a good practice in general for that amount of hosts (about 400) ?
How will the Zabbix server react ? and how should we "tune" it to receive all of this data from clients ? what happens if a client tries to send data to zabbix server but the server is not able to receive it as it does not have enough "receives" (or whatever you call them)

thank you
regards

[1berto]

The load on the server will depend of how many items are you monitoring...
Except if you have very few items i advise you to have one (or more, depending of how many items) proxy(ies)
In my experience (7000+ hosts, 100 itens in each host) the only downside in the active agent are some situations where we would like to send some commands when the problem occurs (with the active agent this is not possible).

[max.ch.88]

You could get rid of many "host unreachable" alerts if you make the timeout on agents less than on the server. Active checks is recommended for fast items only, because active checks run in one thread. If you have a lot of items with frequently update then you will receive data with a delay.

[kloczek]

I'm using only/always active checks (even on monitoring my own laptop themselves) as that way zabbix monitoring consumes (always) less resources.

[kloczek]

The load on the server will depend of how many items are you monitoring...

If server is monitoring only themselves and all other monitoring is done over proxies.
There are more factors which increases load on server:
- number of evaluations of the triggers per second
- number of preprocessing data operations per second
- number of inventory entries updated per second
- number of handled actions, events and audit operations per second

BTW: sometimes it would be good to have some detailed zabbix server metrics about those operations/s because such data would allow better precise tuning of the zabbix server.