Better syslog message handling for Zabbix

[alixen]

Hi,

Alixen, hi, have in mind that version 2.0 DB schema has changed significantly. In particular there is added support for multiple interfaces, and now the "host" table does not contain a "ip". now is added the new table "interface" that contains "ip" value linked for 'hostid'
You would not want to make now a zbxlog branch with support for Zabbix 2.0?
Maybe I'll start to use zbxlog .

Since I think that Zabbix 2.0 will not be ready for production soon, it was not high in my priorities.
I will probably start a branch for Zabbix 2.0 as soon as I have Zabbix 1.9.1 installed in a test VM.

Regards,
Alixen

[alixen]

zbxlog release 0.6

Hi,

I have just released zbxlog v0.6 (http://www.alixen.org/attachments/do...bxlog-r0.6.tgz).

This release includes some enhancements:

• frontend patches for Zabbix 1.8.4
• Don't exit on temporary DB access error (new parameter: db_error_max_retries)
• Use remote IP as remote hostname when hostname undefined (no reverse DNS)
• Replace 'Zabbix agent (active)' by 'Zabbix Trapper' item type (conflict with real agent)
• added chmod +x /etc/init.d/zbxlog in installation instructions

Happy syslog monitoring !
Alixen

[tof233]

Thank you Alixen for this new release

I finally found where was the problem by using debug mode (set "my $DEBUG = 1" in all files from zbxlog/lib/Zbxlog)

The server wasn't able to do reverse DNS resolution on its own ip address.

So I added to /etc/hosts :
192.168.10.27 SVIMOCAVL007

[aic]

Is there any test using Oracle (Zbx db) instead of MySQL?
Thx

[alixen]

Hi,

Is there any test using Oracle (Zbx db) instead of MySQL?
Thx

Not by me.
We don't have any Oracle server in our environment.

However, Zbxlog uses Perl DBI to access Zabbix database.
If you can install Perl DBD::Oracle package, configure zbxlog to use it (set in etc/zbxlog.conf: db_type=Oracle) and test it, please report any error message here. I'll try to help you.

Regards,
Alixen

[JBo]

zbxlog release 0.7

Hi,

I have just released zbxlog v0.7 (http://www.alixen.org/attachments/do...bxlog-r0.7.tgz).

This release :

• adds preliminary support for upcoming Zabbix 2.0 (tested on 1.9.1)
• has been tested on Ubuntu Linux 10.04 LTS

It works with zabbix 1.9.1 (and of course with 1.8).
PHP frontend patches are not available yet for 1.9.1, message severity appears as "Unknown".

Happy syslog monitoring !
JBo

[JBo]

zbxlog release 0.8

Hi,

I have just released zbxlog v0.8 (http://www.alixen.org/attachments/do...bxlog-r0.8.tgz).
Sorry to release it so soon after r0.7 but 1.9.1 frontend patches were much easier than I thought.

This release adds:

• Zabbix 1.9.1 frontend patches
• No exit on temporary zabbix server connection error (new parameter: zabbix_error_max_retries)
• Better database error reporting messages

This release :

• is feature complete : syslog message handling has not changed since 0.5.
• is resilient to temporary zabbix server or database connection errors.
• supports current Zabbix production version (1.8) and future 2.0 release (1.9 branch).

All users of Zbxlog are urged to upgrade to this release and test it.


Happy syslog monitoring !
JBo

[Raikage]

Hi all,

Im trying to install zbxlog 0.8 in zabbix 1.8.4 using postgresql. I think the zbxlog part, I managed to correctly configure it and run since from the log I get "zbxlog.pl" started and verified via ps auxwww|grep zbxlog.

But the zabbix configuration part I am not sure if I did it correctly.
Is there a visual step by step guide with regards to creating a sample zbxlog Item, Trigger Definition, and the sample result. Will it also be possible to say graph the gathered data? I am also not sure how to check that syslogs are getting instered and processed in the zabbix database?


Here is what I did,

On the host "A Test Host", I created a sample Item (zbxlog_item.png) with the following information:
Description: Syslog
key: syslog[]

I also created a trigger (zbxlog_trigger.jpg) with the following information

name: Syslog Debug
expression: {A Test Host:syslog[].logseverity(0)}>10


I am not sure if what I did is correct, since I am not getting any Syslog information from the "latest data" menu (zbxlog_latestdata.jpg) , nothing in the Last Check, Last Value and Change Columns.

TIA

[JBo]

Hi,

You need to make your item work before trying to set a trigger.

zbxlog needs to find Zabbix host name (here "A Test Host") based on its IP address.
Does "A Test Host" have a correct IP address ?

zbxlog silently drops all syslog messages that have no corresponding host/item set up unless you create a specific "no match" host.

"no match" host and item are defined in zbxlog.conf:

# syslog messages not matched by any syslog[] item will be sent to
# nomatch_item on nomatch_host
# messages will be discarded if nomatch_host is empty
nomatch_host=sysloghost
nomatch_item=syslog_nomatch

I suggest that you create an host named sysloghost with a single Zabbix trapper item named syslotg_nomatch with type Log.

Actual content of this item may give a clue on why your setup doesn't work.

Hope this helps,
JBo

[JBo]

Hi,

I have installed a Zabbix/PostgreSQL server.
Current version of Zbxlog (0.8) cannot connect to a PosgreSQL DB.

I need to make some more tests.
I will release a new version as soon as I can fix it.

Hope this helps,
JBo

[JBo]

Hi,

Zbxlog with Postgres is now working.
No need for a new version, just make sure DBD::Pg is installed and zbxlog DB connection is correctly configured.

I will add this information in a future release.

In the meantime here what I have done (on a Debian 6.0 Squeeze):
Install perl DBI and DBD:Pg modules:

apt-get install libdbi-perl
apt-get install libdbd-pg-perl

Define Postgres connection in /usr/local/zbxlog/etc/zbxlog.conf

# Zabbix database connection parameters
db_type=Pg
db_name=zabbix
db_host=localhost
db_port=5432
db_user=zabbix
db_password=******* (get it from /etc/zabbix/zabbix_server.conf : DBpassword)

Make sure that Zbxlog is using Zabbix 1.8 DB schema:

# Zabbix server version
# Supported values:
#   zabbix_version=1.8
#   zabbix_version=2.0
zabbix_version=1.8

Check /usr/local/zbxlog/var/zbxlog.log for error messages.

Hope this helps,
JBo

[tof233]

Zbxlog init script for Centos

Hello,

I just created an init script for Centos:
I hope it would be useful for someone else
/etc/init.d/zbxlog

#!/bin/sh
# This is the init script for starting up the
# Zbxlog daemon
#
# description: Starts and stops the Zbxlog daemon.
# processname: zbxlog.pl
#
# Source function library.
. /etc/rc.d/init.d/functions

# Get config.
. /etc/sysconfig/network

# Check that networking is up.
[ "${NETWORKING}" = "no" ] && exit 0
Zbxlogdir=/usr/local/zbxlog
procname="zbxlog.pl"

start(){
        echo -n "Starting $procname service:"
        daemon "$Zbxlogdir/bin/zbxlog.pl &"
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$procname
        return $RETVAL
}

stop(){
        echo -n "Stopping $procname service:"
	killproc $procname
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && rm -f  /var/lock/subsys/$procname
        return $RETVAL
}

restart(){
        stop
        start
}

status(){
        numproc=`ps -ef | grep 'perl' | grep $procname | grep -v grep  | wc -l`
        if [ "$numproc" -gt 0 ]; then
        echo "$procname is running"
        else
        echo "$procname is stopped"
        fi
}

# See how we were called.
case "$1" in
        start)
                start
                ;;
        stop)
                stop
                ;;
        status)
                status
                ;;
        restart)
                restart
                ;;
        *)
                echo "Usage: $0 {start|stop|status|restart}"
                exit 1
esac
exit $RETVAL

[JBo]

Hi tof233,

I just created an init script for Centos:
I hope it would be useful for someone else
/etc/init.d/zbxlog

Cool !
May I add it to zbxlog SVN repository ?

Thank you,
JBo

[tof233]

Hi tof233,



Cool !
May I add it to zbxlog SVN repository ?

Thank you,
JBo

Of course, I would be happy contributing to zbxlog...
Thank you

[JBo]

Of course, I would be happy contributing to zbxlog...
Thank you

Just added to SVN repository (with due credit).

Thank you
JBo