Syslong-ng and Zabbix

[Cenzoooo]

Hello!

I need help connecting Syslog-ng and Zabbix.
Syslog-ng is my central logging server, and all logs come to it. We monitor over 6000 devices with Zabbix, 90% of them are through SNMP, but we did not connect Zabbix and Syslog-ng yet.

I would like to configure syslog-ng to trap messages (for devices which logs can't be gathered with SNMP) to Zabbix.

I really don't have an idea how to do that, as a matter of fact i don't understand how sending trap messages to zabbix work at all.


For example:
I did a little test environment where my syslog server collects all logs from my laptop (auth,authpriv ,cron, daemon, syslog, user), and now i would like certain log messages to be sent to Zabbix.

What is the best way to do that?

Best regards and thank you in advance.

[jamesNJ]

Look at the zabbix agent items, active checks for log[] and logrt[]. It sounds like you would want to load zabbix agent on your syslog-ng server, and then have a zabbix active check monitor those logs for interesting activity.

However I haven't had much success getting log[] and logrt[] to work predictably ... I would appreciate seeing someone who has actually made that work post some working examples to follow. One issue I have is with zabbix getting permission denied on reading files. The other is the change going unsupported without much explanation as to what the real error is.