Chapter 6 Data Collection
6.1 Data collection method
The active mode is the agent sending data to the server. The
passive mode is the server pulling data from the agent. The
active mode can reduce the pressure on the server.
6.2 Data Collection-Zabbix Agent (Passive)
Data collection process
Zabbix Server and Zabbix Agent
check whether Zabbix Agent is installed and configured, and start normally #ps
aux | grep
zabbix more /etc/zabbix/zabbix_agentd.conf | grep -v ^# | grep -v ^$
See server, serveracitice, hostname settings
#tail -n 20 /var/log/zabix/zabbix_agentd.log
#netstat -nltp|grep zabbix
test server and agent network connectivity
In the template, create monitoring items
Apply the template to findsec_linux
Result: latest data
6.3 Data Collection-Zabbix Agent (Active)
Log monitoring must be active mode to monitor
Passive mode data acquisition process : Zabbix Server establishes a connection and sends a request to obtain monitoring items to the Agent 10050 port-"Agent performs data collection operations after receiving it and returns the results to the Server-"Close the connection
Data acquisition process in active mode : Zabbix Agent actively establishes a connection and sends a request to Server 10051 port to obtain a list of monitored items (keys, etc.)-"received the data returned by the server -" according to the monitoring item settings, periodically send to Zabbix Server
Monitoring item Key: composed of key name and parameters, support
0-9a-zA-Z_-.
Multiple parameters are separated by commas
The first step: modify the Zabbix Server configuration file
vim /etc/zabbix/zabbix_server.conf
Open port 10051,
set the number of Trapers to 5 by default #Passive
mode uses Pollers
StartTrapper=10
starts the Trapper process, because it is used to receive monitoring item requests sent by the client, and the default is 5. Modified to 10
systemctl restart zabbix-server.service
Step 2: Check the configuration file of Zabbix Agent
vim /etc/zabbix/zabbix_agentd.conf
StartAgents=10
Modify the number of Agent processes, here is to observe that the process of
ps aux|grep zabbix
listener is in passive mode and
the process of active check is Active mode
Step 3: Change the 6.2 monitoring item Type to Zabbix agent(active)
When will the monitoring items in active mode be recognized by the Agent? Mainly affected by two time periods. The first is when the latest configuration is loaded into the latest cache. The second is how often the Agent will refresh the cache on the Server.
Under the Agent host:
vim /etc/zabbix/zabbix_agentd.conf
/RefreshActiveChecks
The refresh frequency of active monitoring items, the default is 120 seconds, modified to 60 seconds
重启 systemctl restart zabbix-agent.service
Latest data
How to troubleshoot errors, processes, and ideas encountered during the configuration of active mode monitoring items?
When the monitoring data cannot be obtained, under the normal preconditions mentioned above
- Find the corresponding monitoring item on the web page, check whether the Status is Enabled or Error, and a brief error message
- Server terminal view log tailf /var/log/zabbix/zabbix_server.log
- Agent terminal view log tailf /var/log/zabbix/zabbix_agentd.log
- -s zabbix_get 192.168.93.147 -k 'proc.num [zabbix_agentd,]' if it would normally captured display the corresponding values, then there will be abnormal or no display error output value
the difference
The difference between passive mode and active mode:
-
Differences in monitoring data acquisition methods
Passive mode data acquisition process : Zabbix Server establishes a connection and sends a request to obtain monitoring items to Agent 10050 port——"Agent performs data collection operations after receiving it and returns the results to the Server——"Close the connection
Data acquisition process in active mode : Zabbix Agent actively establishes a connection and sends a request to Server 10051 port to obtain a list of monitored items (keys, etc.)-"received the data returned by the server -" according to the monitoring item settings, periodically send to Zabbix Server -
The difference
in usage scenarios The passive mode is not suitable for restrictions on the flow of out and out, and restrictions on the flow of traffic. Active mode will be more suitable -
The difference between data collection and processing process
Passive mode is to process and monitor data through Poller. And you can adjust the number of processes through StartAgent.
Active mode is handled by Trapper. Only the active check process handles active mode monitoring
Advantages and disadvantages of passive mode and active mode
- In the passive mode, the server initiates a request for monitoring data. If the scale is large, tens of thousands, the pressure on the server will be greater. You can use the active mode to reduce the pressure, but the detection must be fast, so as not to get stuck and affect other monitoring data collection. And the active mode has only one Agent end to handle the monitoring of the active mode
- The advantage of the active mode is the Buffer on the Agent side. When a problem occurs on the Server side, the data in the passive mode may be disconnected. However, the active mode has a buffer in its memory, and the data in the buffer will still be sent to the server