Zabbix LLD 設置過濾條件，不自動監控某些item

一、需求描述

 

     默認狀況下Zabbix 自帶模板 "Template OS Linux" 中網絡接口LLD自動發現除還回接口外的全部接口，當這並不必定是咱們想要的結果。

 

     好比我有一臺運行kvm的服務器，服務器上有四個物理接口 eth0-eth3 , 三個網橋接口 br0-br2 , 還有不少個虛機的網卡接口 vnetxx ，以下所示：

 

 1 [root@host00 ~]# ifconfig |grep HW
 2 br0       Link encap:Ethernet  HWaddr EC:F4:BB:D6:37:69
 3 br1       Link encap:Ethernet  HWaddr EC:F4:BB:D6:37:6A
 4 br2       Link encap:Ethernet  HWaddr EC:F4:BB:D6:37:6B
 5 eth0      Link encap:Ethernet  HWaddr EC:F4:BB:D6:37:68
 6 eth1      Link encap:Ethernet  HWaddr EC:F4:BB:D6:37:69
 7 eth2      Link encap:Ethernet  HWaddr EC:F4:BB:D6:37:6A
 8 eth3      Link encap:Ethernet  HWaddr EC:F4:BB:D6:37:6B
 9 vnet0     Link encap:Ethernet  HWaddr FE:54:00:00:00:15
10 vnet1     Link encap:Ethernet  HWaddr FE:54:00:00:00:17
11 vnet2     Link encap:Ethernet  HWaddr FE:54:01:00:00:15
12 vnet3     Link encap:Ethernet  HWaddr FE:54:01:00:00:17
13 vnet4     Link encap:Ethernet  HWaddr FE:54:00:00:00:2F
14 vnet5     Link encap:Ethernet  HWaddr FE:54:01:00:00:2D
15 vnet6     Link encap:Ethernet  HWaddr FE:54:00:00:00:30
16 vnet7     Link encap:Ethernet  HWaddr FE:54:01:00:00:2E
17 vnet8     Link encap:Ethernet  HWaddr FE:54:00:00:00:1A
18 vnet9     Link encap:Ethernet  HWaddr FE:54:01:00:00:1A
19 vnet10    Link encap:Ethernet  HWaddr FE:54:00:00:00:16
20 vnet11    Link encap:Ethernet  HWaddr FE:54:01:00:00:16
21 vnet12    Link encap:Ethernet  HWaddr FE:54:00:00:00:11
22 vnet13    Link encap:Ethernet  HWaddr FE:54:01:00:00:11
23 vnet14    Link encap:Ethernet  HWaddr FE:54:00:A1:61:A1
24 vnet15    Link encap:Ethernet  HWaddr FE:54:00:A2:61:A1
25 vnet16    Link encap:Ethernet  HWaddr FE:54:00:A3:61:A1
26 vnet20    Link encap:Ethernet  HWaddr FE:54:00:00:00:2B
27 vnet21    Link encap:Ethernet  HWaddr FE:54:01:00:00:2A
28 vnet24    Link encap:Ethernet  HWaddr FE:54:00:00:00:2C
29 vnet25    Link encap:Ethernet  HWaddr FE:54:01:00:00:2B

 

     這裏咱們只想監控服務器上的四個物理接口，對於網橋接口和虛機網卡接口不關心，因爲虛機的建立刪除比較頻繁，致使該服務器在Zabbix中有不少 Item 是 Not supported 的狀態，若是等待這些不支持的監控項自動刪除大概須要等待一個月的時間。

 

 

     另外在zabbix-server的日誌中也會有記錄大量的錯誤日誌：

 

 1  24102:20160701:145019.036 item "10.12.29.100:net.if.in[vnet24]" became supported
 2  24101:20160701:145020.037 item "10.12.29.100:net.if.in[vnet25]" became supported
 3  24102:20160701:145101.129 item "10.12.29.100:net.if.out[vnet24]" became supported
 4  24100:20160701:145102.130 item "10.12.29.100:net.if.out[vnet25]" became supported
 5  24101:20160701:155859.871 item "10.12.29.100:net.if.in[vnet6]" became not supported: Cannot find information for this network interface in /proc/net/dev.
 6  24100:20160701:155909.880 item "10.12.29.100:net.if.in[vnet17]" became not supported: Cannot find information for this network interface in /proc/net/dev.
 7  24100:20160701:155941.908 item "10.12.29.100:net.if.out[vnet6]" became not supported: Cannot find information for this network interface in /proc/net/dev.
 8  24102:20160701:155951.916 item "10.12.29.100:net.if.out[vnet17]" became not supported: Cannot find information for this network interface in /proc/net/dev.
 9  24102:20160701:160343.187 item "10.12.29.100:net.if.out[vnet7]" became not supported: Cannot find information for this network interface in /proc/net/dev.
10  24101:20160701:160358.201 item "10.12.29.100:net.if.out[vnet22]" became not supported: Cannot find information for this network interface in /proc/net/dev.
11  24102:20160701:160359.201 item "10.12.29.100:net.if.out[vnet23]" became not supported: Cannot find information for this network interface in /proc/net/dev.
12  24100:20160701:160400.202 item "10.12.29.100:net.if.in[vnet7]" became not supported: Cannot find information for this network interface in /proc/net/dev.
13  24101:20160701:160417.217 item "10.12.29.100:net.if.in[vnet22]" became not supported: Cannot find information for this network interface in /proc/net/dev.
14  24100:20160701:160418.219 item "10.12.29.100:net.if.in[vnet23]" became not supported: Cannot find information for this network interface in /proc/net/dev.
15  24102:20160701:160420.220 item "10.12.29.100:net.if.in[vnet19]" became not supported: Cannot find information for this network interface in /proc/net/dev.
16  24101:20160701:160424.224 item "10.12.29.100:net.if.out[vnet19]" became not supported: Cannot find information for this network interface in /proc/net/dev.
17  24101:20160701:161339.730 item "10.12.29.100:net.if.out[vnet4]" became not supported: Cannot find information for this network interface in /proc/net/dev.
18  24100:20160701:161340.730 item "10.12.29.100:net.if.out[vnet5]" became not supported: Cannot find information for this network interface in /proc/net/dev.
19  24100:20160701:161358.750 item "10.12.29.100:net.if.in[vnet4]" became not supported: Cannot find information for this network interface in /proc/net/dev.
20  24100:20160701:161358.750 item "10.12.29.100:net.if.in[vnet5]" became not supported: Cannot find information for this network interface in /proc/net/dev.
21  24100:20160701:161408.760 item "10.12.29.100:net.if.in[vnet16]" became not supported: Cannot find information for this network interface in /proc/net/dev.
22  24102:20160701:161410.761 item "10.12.29.100:net.if.in[vnet18]" became not supported: Cannot find information for this network interface in /proc/net/dev.
23  24102:20160701:161413.764 item "10.12.29.100:net.if.in[vnet14]" became not supported: Cannot find information for this network interface in /proc/net/dev.
24  24101:20160701:161414.765 item "10.12.29.100:net.if.in[vnet15]" became not supported: Cannot find information for this network interface in /proc/net/dev.
25  24101:20160701:161450.795 item "10.12.29.100:net.if.out[vnet16]" became not supported: Cannot find information for this network interface in /proc/net/dev.
26  24100:20160701:161452.798 item "10.12.29.100:net.if.out[vnet18]" became not supported: Cannot find information for this network interface in /proc/net/dev.
27  24103:20160701:161455.800 item "10.12.29.100:net.if.out[vnet14]" became not supported: Cannot find information for this network interface in /proc/net/dev.
28  24100:20160701:161456.801 item "10.12.29.100:net.if.out[vnet15]" became not supported: Cannot find information for this network interface in /proc/net/dev.
29  24103:20160701:161958.077 item "10.12.29.100:net.if.in[vnet4]" became supported
30  24101:20160701:161959.075 item "10.12.29.100:net.if.in[vnet5]" became supported
31  24102:20160701:162040.114 item "10.12.29.100:net.if.out[vnet4]" became supported
32  24101:20160701:162041.116 item "10.12.29.100:net.if.out[vnet5]" became supported

 

---

二、原理分析

 

     首先查看「Template OS Linux 」中關於網絡接口的自動發現規則，

 

 

     下圖中三個框分別是：

          Linux服務器網絡接口自動發現 使用的key

          Linux服務器網絡接口自動發現 時間間隔

          Linux服務器網絡接口自動發現 的對象丟失後爲其保留的時長

          

 

     使用正則表達式過濾 zabbix_get -s 10.12.29.100 -k net.if.discovery 的結果，並將符合條件的結果賦值給 {#IFNAME} ，而後就能夠監控接口 {#IFNAME} 的流量信息了，以及爲接口 {#IFNAME} 的流量信息生成 Graph

 

 

 

 

     接下來查看正則表達式 「@Network interfaces for discovery」 的內容，「Network interfaces for discovery」只是一組正則表達式的名字而已，其內容去下圖中的位置查看

 

 

     查看已有的兩條規則：內容是屏蔽掉還回接口

 

 

     下面分析如下 zabbix_get -s 10.12.29.100 -k net.if.discovery 的執行結果（zabbix在執行lld的時候就是調用zabbix_get 命令獲取被監控服務器網卡列表的）

 

 

1 [root@zabbix-server zabbix]# zabbix_get -s 10.12.29.100 -k net.if.discovery
2 {"data":[{"{#IFNAME}":"lo"},{"{#IFNAME}":"eth0"},{"{#IFNAME}":"eth1"},{"{#IFNAME}":"eth2"},{"{#IFNAME}":"eth3"},{"{#IFNAME}":"br0"},{"{#IFNAME}":"br1"},{"{#IFNAME}":"br2"},{"{#IFNAME}":"vnet12"},{"{#IFNAME}":"vnet13"},{"{#IFNAME}":"vnet0"},{"{#IFNAME}":"vnet2"},{"{#IFNAME}":"vnet10"},{"{#IFNAME}":"vnet11"},{"{#IFNAME}":"vnet1"},{"{#IFNAME}":"vnet3"},{"{#IFNAME}":"vnet8"},{"{#IFNAME}":"vnet9"},{"{#IFNAME}":"vnet20"},{"{#IFNAME}":"vnet21"},{"{#IFNAME}":"vnet24"},{"{#IFNAME}":"vnet25"},{"{#IFNAME}":"vnet4"},{"{#IFNAME}":"vnet5"},{"{#IFNAME}":"vnet6"},{"{#IFNAME}":"vnet7"},{"{#IFNAME}":"vnet14"},{"{#IFNAME}":"vnet15"},{"{#IFNAME}":"vnet16"}]}

 

     對返回的json稍微美化一下

 

 1 {
 2   "data": [
 3     {
 4       "{#IFNAME}": "lo"
 5     },
 6     {
 7       "{#IFNAME}": "eth0"
 8     },
 9     {
10       "{#IFNAME}": "eth1"
11     },
12     {
13       "{#IFNAME}": "eth2"
14     },
15     {
16       "{#IFNAME}": "eth3"
17     },
18     {
19       "{#IFNAME}": "br0"
20     },
21     {
22       "{#IFNAME}": "br1"
23     },
24     {
25       "{#IFNAME}": "br2"
26     },
27     {
28       "{#IFNAME}": "vnet12"
29     },
30     {
31       "{#IFNAME}": "vnet13"
32     },
33     {
34       "{#IFNAME}": "vnet0"
35     },
36     {
37       "{#IFNAME}": "vnet2"
38     },
39     {
40       "{#IFNAME}": "vnet10"
41     },
42     {
43       "{#IFNAME}": "vnet11"
44     },
45     {
46       "{#IFNAME}": "vnet1"
47     },
48     {
49       "{#IFNAME}": "vnet3"
50     },
51     {
52       "{#IFNAME}": "vnet8"
53     },
54     {
55       "{#IFNAME}": "vnet9"
56     },
57     {
58       "{#IFNAME}": "vnet20"
59     },
60     {
61       "{#IFNAME}": "vnet21"
62     },
63     {
64       "{#IFNAME}": "vnet24"
65     },
66     {
67       "{#IFNAME}": "vnet25"
68     },
69     {
70       "{#IFNAME}": "vnet4"
71     },
72     {
73       "{#IFNAME}": "vnet5"
74     },
75     {
76       "{#IFNAME}": "vnet6"
77     },
78     {
79       "{#IFNAME}": "vnet7"
80     },
81     {
82       "{#IFNAME}": "vnet14"
83     },
84     {
85       "{#IFNAME}": "vnet15"
86     },
87     {
88       "{#IFNAME}": "vnet16"
89     }
90   ]
91 }

 

     zabbix經過系統中的正則表達式 「Network interfaces for discovery」對上面的結果進行過濾，符合條件的內容就會被zabbix進行監控。

 

---

三、解決方法

 

     上面工做原理分析完了，解決起來也就不費勁了，咱們只需對zabbix默認的正則表達式 「Network interfaces for discovery」添加兩條規則（不監控虛機網卡接口和網橋接口），以下圖所示：

 

 

     爲了可以確保新配置的正則表達式生效，並看到響應的效果，咱們要把host（10.12.29.100）與template（Template OS Linux ）取消關聯並清除歷史數據。

 

     先看一下取消關聯以前host上網絡接口的監控項有56個

 

 

     取消關聯並清除歷史數據，見下圖

 

 

     而後從新關聯模板 「Template OS Linux 」，此處截圖省略，而後等待zabbix LLD 自動發現符合要求的網絡接口，並開始監控，按照LLD的默認值，最多須要等候一小時（3600s）

 

     根據咱們上面獲取的10.12.29.100接口信息，這裏須要監控的網絡接口是 eth0-eth3 的Incoming和 Outcoming ，一共8個監控項，見下圖：

 

 

     至此，咱們的問題就解決完了