Ad Widget

Collapse

Kubernetes pod log monitoring (trigger if >500 occurrences in 10min)

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • duanejevon
    Junior Member
    • Jun 2023
    • 2

    #1

    Kubernetes pod log monitoring (trigger if >500 occurrences in 10min)

    Hello!

    I am running Zabbix 6.4.2, and using the Kubernetes over HTTP templates to monitor a kubernetes cluster. We have a zabbix proxy and zabbix agents running in the kubernetes cluster. The cluster is hosted with a cloud provider, so we do not have direct access to the nodes.

    In particular, I am interested in being able to monitor the log output for a pod for occurrences of a certain text string, e.g: "Error 500". If the text string occurrs more than 500 times in 10m, I would like to trigger an alert.

    However, I am not sure of the best way to do this, and after doing a lot of searching I haven't found much.

    We are running elasticsearch with Kibana for log analysis in our cluster, so if Zabbix could somehow obtain the total number of occurrences through elastic search that could also work for us.

    Could anyone point me in the right direction for how to do this?

    Many thanks!
  • Horacio
    Junior Member
    • Aug 2013
    • 1

    #2
    Hello, have you been able to do this? I have the same scenario.
    I have Elastic alerts, but I would like zabbix to do this.

    Greetings.​

    Comment

    • JaniL
      Junior Member
      • Nov 2023
      • 8

      #3
      How have you done the config with the zabbix-proxy in the cluster, cant get it to work.
      Getting this error
      cannot parse proxy data from active proxy at "10.42.1.0": proxy "Zabbix proxy" not found

      Comment

      • duanejevon
        Junior Member
        • Jun 2023
        • 2

        #4
        Originally posted by Horacio
        Hello, have you been able to do this? I have the same scenario.
        I have Elastic alerts, but I would like zabbix to do this.

        Greetings.​
        Hello, no, unfortunately not, still looking for a way!

        Comment

        Working...