Zabbix 3.2 monitoring network traffic on Debian Servers

[jamesh130]

Hi all,

I'm only started using Zabbix in last few months so excuse me if I don't use the correct terms.

I currently have Zabbix 3.2.7 server installed on a Debian server which is monitoring about 20 other Debian servers. All the Debian servers which are being monitored have Zabbix agent (3.2.7) installed.

I want to be able to monitor network traffic in/out on my 20 Debian servers as well as receive an alert if there are any collisions, errors or high bandwidth usage occurs.

What is the best practice for doing this? I've been reading articles on adding lines to the zabbix_agentd.conf, creating a template even using a template someone else has created but can't seem to find the best way of doing this.

If anyone has a link to the best way of doing this, it would be really appreciated.

Thanks in advance

[allexpetrov]

Hi,
the best practice is use Low Level Discovery (or LLD) for automated tasks. Zabbix do have network interface discovery working out-of-the-box, you just need to perform some configuration steps once.

Please see the manual for LLD: https://www.zabbix.com/documentation...evel_discovery

In short: Create Template, add Discovery rule for discovering the network interfaces and add filter to stripe out loopbacks -> create 3 item prottype like net.if.in[{#IFNAME}] , net.if.out[{#IFNAME}], net.if.total[{#IFNAME}] , add some trigger prototype and graph prototypes. And voilà , everything is working just fine.

Don't forget to link the Debian servers to that template. You can do Mass Update to ease your life.

Regards,
Alex!

[jamesh130]

Thanks allexpetrov

I think I've managed to achieve this now.

I was reading about low level discovery and saw that the network interfaces had been detected as items (Zabbix agent I'm assuming as I didn't do a discovery).

I've created a template using the net.if.in[eth0,errors], net.if.out[eth0,errors] and net.if.collisions[eth0] items.

Then as a trigger I used net.if.in[eth0,errors].last(0)}>0

so if there are any errors greater than 0 it should produce a warning.

Then bind this template to my servers. It seems to have worked. Have I got the syntax correct?

[allexpetrov]

Would you mind to share your items config with us? I can't understand where you are tying to perform the configuration

Regards,
Alex!

[jamesh130]

Hi Alex,

The item config I am using is as follows

net.if.in[eth0,dropped]
net.if.in[eth0,errors]
net.if.out[eth0,dropped]
net.if.out[eth0,errors]
net.if.collisions[eth0]

The Triggers are

eth0:net.if.in[eth0,dropped].last(0)}>0 or eth0:net.if.out[eth0,dropped].last(0)}>0

eth0:net.if.collisions[eth0].last(0)}>0

eth0:net.if.in[eth0,errors].last(0)}>0 or eth0:net.if.out[eth0,errors].last(0)}>0

Thanks,

James

[jamesh130]

Hi Alex,

Did you have a chance to look at the items and triggers I've used?

Will they work ok?

Thanks,

James

[allexpetrov]

Hi James,

I'm assuming that you are using default template which performs Low Level Discovery. You can identify the items by Discovery rule name in red before the item name.

I think that your Triggers are pretty Ok, but please be aware that your Trigger should start form { symbol.

Because you want to find out errors then yes, .last would be an option.

In any case - the best option how to find out what actually suits you the best is to check in your own system.

Regards,
Alex!

[jamesh130]

Thanks Alex