More on distributed monitoring

[jsegura]

In the topic Some questions about zabbix I started a thread about distributed monitoring. But there is still some things I don't understand.

I have a deployment like this.

master --------------- Internet ------------ client1
(public-ip0)              |                  (public-ip1) (possibly dynamic)
                          |                  (192.168.1.1) ------ node1
                          |                                     (192.168.1.2)
                          |
                           ----------------- client2
                                             (public-ip2) (possibly dynamic)
                                             (192.168.1.1) ------ node2
                                                                (192.168.1.2)

In a distributed monitoring setup the child nodes push the information to the master nodes. In my deployment I have a master node in master and 2 child nodes client1 and client2. Then another two master-child relations between client1-node1 and client2-node2.

If the information of the private networks is acquired only by the masters located on these networks, what problem exists if I have duplicated ips? I mean, the two client nodes (client1-client2) would send the information to the master, isn't it? The master have not to have a direct connection to final nodes.

Another problem is that client public ips might be dynamic, but we can set up a dynamic dns server to solve this.

[peter_field]

It should be possible, but possability and reality are two different things

I also want to get DM setup very similar to this. From what I understand the servers installed at your clients premises will collect the data from the clients at that site, and report it to the master. I don't see any reason the master would need to contact a client directly. I could be wrong however, I haven't been able to do any testing because I plain cant get it to work, even on the same subnet.

I have a few concerns with this:

1. The security of the traffic that will be sent over the Internet as it will not be encrypted, and someone could learn a hell of a lot about a site from watching this data travel over the Internet. I think some people have tried or actually got this working through an encrypted SSH tunnel or similar, I would be interested in anyones experience in this?

2. I don't know that I would let anyone connect to port 10050/10051 from the Internet on any Zabbix server. You would want to make sure the ONLY communications to/from these ports is to other Zabbix servers under your control. I imagine it would be much easier to do this if you had a static IP address (really they don't cost a hell of a lot, get your clients to shell out for it) so its easier to firewall/monitor.

3. The volume of data this will generate. I don't see any way to select what data gets sent to the master, so I assume its all events and history. If you have a lot of hosts, this could add up. If your clients don't want to pay for a static IP, then they probably have download limits also. I'd monitor this very carefully.

4. And the last issue I have, is have you actually tried this? Because at the moment, with 1.4.1 I can't get this to work at all. Data gets sent around, some info shows up, but it plain doesn't work the way I understand the documentation. The configuration cannot be managed centrally, triggers can't be seen centrally, too much data gets sent over slow links... its basically useless in its present state.

[Alexei]

3. The volume of data this will generate. I don't see any way to select what data gets sent to the master, so I assume its all events and history. If you have a lot of hosts, this could add up. If your clients don't want to pay for a static IP, then they probably have download limits also. I'd monitor this very carefully.

An option to send events, history or both is already implemented in pre 1.4.2. Nodes sending only events would be a very good and cheap (performance wise) solution for very large setups.