zabbix自定义监控进程与日志

zabbix自定义监控进程与日志

一. 自定义监控进程

1. 一个进程的自定义监控

1.1 打开自定义监控功能

[root@SYL3 tmp]# cd /usr/local/etc/
[root@SYL3 etc]# ls
zabbix_agentd.conf  zabbix_agentd.conf.d
[root@SYL3 etc]# cat zabbix_agentd.conf|grep UserParameter
#       Does not support UserParameters or aliases.
### Option: UnsafeUserParameters
UnsafeUserParameters=1
### Option: UserParameter
#       Format: UserParameter=<key>,<shell command>
# UserParameter=
UserParameter=check_process_httpd,/bin/bash /scripts/check_process.sh
[root@SYL3 etc]# 
[root@SYL3 etc]# pkill zabbix//修改配置文件后杀掉进程
[root@SYL3 etc]# zabbix_agentd 
[root@SYL3 etc]# 

1.2 安装httpd，写执行脚本

[root@SYL3 etc]# yum -y install httpd
[root@SYL3 ~]# systemctl start httpd
[root@SYL3 ~]# ps -ef|grep httpd
root      467831       1  0 21:49 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache    469166  467831  0 21:49 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache    469169  467831  0 21:49 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache    469170  467831  0 21:49 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
apache    469173  467831  0 21:49 ?        00:00:00 /usr/sbin/httpd -DFOREGROUND
root      469738  467015  0 21:49 pts/2    00:00:00 grep --color=auto httpd
[root@SYL3 ~]# ps -ef|grep -v grep|grep -c httpd
5
[root@SYL3 ~]# 


-ne 不等于
-eq 等于


[root@SYL3 etc]# mkdir /scripts/
[root@SYL3 etc]# vim /scripts/check_process.sh
[root@SYL3 etc]# chmod +x /scripts/check_process.sh 
[root@SYL3 etc]# cat /scripts/check_process.sh
#!/bin/bash

count=$(ps -ef|grep -v grep|grep -c httpd)//将取出来的进程id用一个变量
if [ $count -ne 5 ];then
    echo '1'//如果取出来的变量不等于5 ，则输出1
fi
[root@SYL3 etc]# 

  
[root@SYL3 ~]# systemctl stop httpd
  
[root@SYL3 etc]# bash /scripts/check_process.sh
1

1.3 验证，服务端

[root@zabbix_server ~]# zabbix_get -s 192.168.232.128 -k check_process_httpd
1
[root@zabbix_server ~]# 

1.4 配置zabbix，web端

• 添加监控项

• 

• 

• 

• 

• 触发告警

• 

• 发送邮箱

• 

2. 检查多个进程

2.1 优化脚本

count=$(ps -ef|grep -Ev "grep|$0"|grep -c $1)//grep -v grep,取反 grep|$0 不包括脚本本身，就是外边./check_process.sh httpd的httpd，加个E是正则表达式
if [ $count -eq 0 ];then//如果取出来的变量等于0，则输出1
  echo '1'   有问题输出1，没问题输出0
else
    echo '0'
fi

[root@SYL3 etc]# vim /scripts/check_process.sh
[root@SYL3 etc]# cat /scripts/check_process.sh 
#!/bin/bash

count=$(ps -ef|grep -Ev "grep|$0"|grep -c $1)
if [ $count -eq 0 ];then
    echo '1'
else
    echo '0'
fi
[root@SYL3 etc]# 

[root@SYL3 scripts]# systemctl start httpd
[root@SYL3 scripts]# ./check_process.sh httpd
[root@SYL3 scripts]# systemctl stop httpd
[root@SYL3 scripts]# ./check_process.sh httpd
1  

2.2 修改服务端agentd配置文件

[root@SYL3 etc]# cat zabbix_agentd.conf
UserParameter=check_process[*],/bin/bash /scripts/check_process.sh $1

UserParameter=check_process[*],/bin/bash /scripts/check_process.sh $1 //check_process[*] 检查进程那个*在网页配置，$1第一个参数，将配置的内容当做$1参数传给脚本

[root@SYL3 etc]# pkill zabbix
[root@SYL3 etc]# zabbix_agentd 
[root@SYL3 etc]# 

2.3 验证服务端

[root@zabbix_server ~]# zabbix_get -s 192.168.232.128 -k check_process[httpd]
1
[root@zabbix_server ~]# zabbix_get -s 192.168.232.128 -k check_process[mysql]
1
[root@zabbix_server ~]# zabbix_get -s 192.168.232.128 -k check_process[zabbix]
0
[root@zabbix_server ~]# 

2.4 配置web端

• 创建新的items

• 

• 添加触发器

• 

• 

• 查看数据

• 

• 查看邮箱

• 

3. 自定义监控mysql

3.1.1 安装MySQL

[root@SYL3 ~]# wget http://dev.mysql.com/get/mysql57-community-release-el7-10.noarch.rpm
[root@SYL3 ~]# rpm -ivh mysql57-community-release-el7-10.noarch.rpm
warning: mysql57-community-release-el7-10.noarch.rpm: Header V3 DSA/SHA1 Signature, key ID 5072e1f5: NOKEY
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:mysql57-community-release-el7-10 ################################# [100%]
[root@SYL3 ~]# yum -y install *.rpm
[root@SYL3 ~]# systemctl enable --now mysqld
[root@SYL3 ~]# systemctl status mysqld
● mysqld.service - MySQL Server
   Loaded: loaded (/usr/lib/systemd/system/mysqld.service; e>
   Active: active (running) since Sat 2022-07-09 13:52:13 CS>
     Docs: man:mysqld(8)
           http://dev.mysql.com/doc/refman/en/using-systemd.>
  Process: 829334 ExecStart=/usr/sbin/mysqld --daemonize --p>
  Process: 828944 ExecStartPre=/usr/bin/mysqld_pre_systemd (>
 Main PID: 829336 (mysqld)
    Tasks: 27 (limit: 11216)
   Memory: 297.5M
   CGroup: /system.slice/mysqld.service
           └─829336 /usr/sbin/mysqld --daemonize --pid-file=>

Jul 09 13:52:08 SYL3 systemd[1]: Starting MySQL Server...
Jul 09 13:52:13 SYL3 systemd[1]: Started MySQL Server.
[root@SYL3 ~]# 

3.1 添加监控项

• 

3.2 添加触发器

• 

• 

3.3 查看数据

• 

3.4 查看邮箱

• 

二. 自定义监控日志

1. 下载日志脚本

[root@SYL3 scripts]# wget https://github.com/chendao2015/pyscripts/blob/master/log.py
[root@SYL3 scripts]# ls
check_process.sh  log.py
[root@SYL3 scripts]# chmod +x log.py 
[root@SYL3 scripts]# ll
total 180
-rwxr-xr-x 1 root root    118 Jul  8 22:51 check_process.sh
-rwxr-xr-x 1 root root 179713 Jul  8 21:37 log.py

log.py
作用：检查日志文件中是否有指定的关键字
第一个参数为日志文件名（必须有，相对路径、绝对路径均可）
第二个参数为seek position文件的路径（可选项，若不设置则默认为/tmp/logseek文件。相对路径、绝对路径均可）
第三个参数为搜索关键字，默认为 Error

2. 给httpd日志权限，安装Python

[root@SYL3 log]# ll -d httpd/
drwx------ 2 root root 41 Jul  8 21:49 httpd/
[root@SYL3 log]# setfacl -m u:zabbix:rx httpd
[root@SYL3 log]# ll -d httpd/
drwxr-x---+ 2 root root 41 Jul  8 21:49 httpd/
[root@SYL3 log]# cd httpd/
[root@SYL3 httpd]# ll
total 4
-rw-r--r-- 1 root root    0 Jul  8 21:49 access_log
-rw-r--r-- 1 root root 2046 Jul  8 22:29 error_log
[root@SYL3 httpd]# 
[root@SYL3 httpd]# yum -y install python3
[root@SYL3 httpd]# which python3
/usr/bin/python3
[root@SYL3 httpd]# 

3. 修改服务端agentd配置文件

[root@SYL3 scripts]# cd /usr/local/etc/
[root@SYL3 etc]# vim zabbix_agentd.conf
[root@SYL3 etc]# cat zabbix_agentd.conf

UserParameter=check_process[*],/bin/bash /scripts/check_process.sh $1
UserParameter=check_logs[*],/usr/bin/python3 /scripts/log.py $1 $2 $3

[root@SYL3 etc]# pkill zabbix
[root@SYL3 etc]# zabbix_agentd 
[root@SYL3 etc]# 

4. 在客户端验证

[root@SYL3 scripts]# python3 log.py /var/log/httpd/error_log 
0
[root@SYL3 scripts]# echo 'Error' >> /var/log/httpd/error_log 
[root@SYL3 scripts]# python3 log.py /var/log/httpd/error_log 
1
[root@SYL3 scripts]# 
[root@SYL3 scripts]# python3 log.py /var/log/httpd/error_log 
0//日志实时更新的
[root@SYL3 scripts]# 

测试完之后删除，因文件/tmp/logseek属于root账号，在web端写入写不进去，所以删除
[root@SYL3 scripts]# echo 'fffgssdf' >> /var/log/httpd/error_log 
[root@SYL3 scripts]# cat /tmp/logseek 
2052[root@SYL3 scriptpython3 log.py /var/log/httpd/error_log 
1
[root@SYL3 scripts]# cat /tmp/logseek 
2080[root@SYL3 scripts]# 
  
  
[root@SYL3 scripts]# rm -f /tmp/logseek 
[root@SYL3 scripts]# 
  

5. 创建监控项

• 

6. 添加触发器

• 

• 

7. 查看数据

• 

• 

• 

三. 监控mysql日志

1. 在客户端验证，并给执行权限

[root@SYL3 scripts]# ll -d  /var/log
drwxr-xr-x. 9 root root 4096 Jul  9 14:41 /var/log
[root@SYL3 log]# setfacl -m u:zabbix:rx /var/log/mysqld.log 
[root@SYL3 scripts]# ll -d  /var/log
drwxr-xr-x+ 9 root root 4096 Jul  9 14:41 /var/log
[root@SYL3 scripts]# ll /var/log/mysqld.log 
-rw-r----- 1 mysql mysql 4583 Jul  9 14:42 /var/log/mysqld.log
[root@SYL3 scripts]# echo 'Error' >> /var/log/mysqld.log 
[root@SYL3 scripts]# python3 log.py /var/log/mysqld.log 
1
[root@SYL3 scripts]# python3 log.py /var/log/mysqld.log 
0
[root@SYL3 scripts]# python3 log.py /var/log/mysqld.log 
0
[root@SYL3 scripts]# python3 log.py /var/log/mysqld.log 
0
[root@SYL3 scripts]# 



[root@SYL3 tmp]# cat logseek 
4583[root@SYL3 tm
[root@SYL3 tmp]# echo 'Error' >> /var/log/mysqld.log
[root@SYL3 tmp]# cat logseek 
4583[root@SYL3 tmp]# echo 'fififfvbb' >> /var/log/mysqld.log
[root@SYL3 tmp]# cat logseek 
4589[root@SYL3 tmp]# rm -f logseek 
[root@SYL3 tmp]# 

2. 添加监控项

• 

3. 添加触发器

• 

• 

4. 查看数据并验证

• 

-

• 

•