Analyze log file data

[arnozab]

Hello everybody,

I am a novice with Zabbix and I need some help to solve a problem. I have a log file (log.log) with IP addresses which describe flows like that:
srcaddr=1.1.1.1,dstaddr=1.1.1.2, bytes=561851
srcaddr=1.1.1.3,dstaddr=1.1.1.4, bytes=1541
srcaddr=1.1.1.2,dstaddr=1.1.1.1, bytes=32789
srcaddr=1.1.1.1,dstaddr=1.1.1.5, bytes=101054
srcaddr=1.1.1.1,dstaddr=1.1.1.2, bytes=7495
srcaddr=1.1.1.2,dstaddr=1.1.1.1, bytes=25603
…

The log file has new input appended at its end every minute and I can see it in Latest Data.

Using an active item (key: log[/etc/zabbix/log.log,1.1.1.1] for example) and the function count() in a calculated item, I manage to plot the number of occurrences of a precise IP @, without distinction between src and dst, and without taking into account the number of bytes.

Because one value=one item in Zabbix, I must configure manually an active item and a calculated item for each IP @. However I am going to have a lot of flows with different src and dst IP @ and I want to do it automatically.

My goal is to plot automatically a graph with the number of bytes exchanged every minute from a src IP@ to a dst IP@, for each possibility.

Do you think that it is possible to do this with Zabbix? If so, do you have any idea to solve my problem?

Thank you very much in advance.

[arnozab]

Filter log file data

Hello everybody and happy new year,

I have an issue to get some info from a log file. In the latter there are a lot of IP addresses that I am able to read in Latest data. I would like to get only one IP address (to count the number of occurrences after with a calculated item).

For example, I want to display all 1.1.1.1 of my log file in Latest Data. I tried a create a Zabbix agent (active) with the key log[/etc/zabbix/log.log,1.1.1.1]. However Zabbix takes also into account the IP addresses 1.1.1.1X with X a random number (ex: 1.1.1.10). I tried to put double quotes around 1.1.1.1 but it doesn’t work either.

I also don’t want to create a temporary log file for each IP address with a bash script because I have thousands of different IP addresses. Do you have any idea to solve my problem?

Thank you very much in advance.