Monitor external Server Logs e.g. Bind Server

[echanobe]

Good day Zabbix Team,

I am newbie and trying to understand the logs monitoring. Is there a way to monitor the external logs example, from zabbix server, I wan to monitor the /var/log/syslog from my BIND servers. Is that possible?

Many Thanks,
BR

[tim.mooney]

https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/log_items

[echanobe]

Thanks Tim. But by doing that, it will be the local to zabbix sever and I can see the logs locally for /var/log/syslog. What I want is to monitor the logs for the foreign servers. zabbix (10.10.10.1) -------------- BIND Server (10.20.20.1)

[echanobe]

For sure it will need to ssh to the foreign server to get to the filesystem. Is this possible to monitor the external logs?

[tim.mooney]

You can monitor the log files on client systems that have the zabbix-agentd installed and running, not just the Zabbix server itself.

You do not need to enable ssh for this. The monitoring is done directly by the zabbix-agentd.

You do need to configure the log items as "Zabbix agent (active)", which means you must have set up the ServerActive parameter in your agent config file. Read up on active vs passive monitoring by the agent for more info.

[echanobe]

Thanks Tim. i will have then install the agent on my DNS server (for one server for now) and will do the test.

[echanobe]

Many Thanks Tim! This works! next step is to use the regex so not to read every message there

[tim.mooney]

You're welcome!

If you search around on these forums, possibly also in the cookbook channel, I know I saw someone share a template they're using for monitoring BIND. I don't tend to import other people's templates into my Zabbix server, but I do find that reviewing the items that others have set up can give me good ideas for what and how to monitor in my environment. There might be some useful regexes or other stuff in that template, if you can find it.