Zabbix Low-Level Discovery PDF

LOW-LEVEL DISCOVERY(LLD) - EXAMPLE Example of the network interface discovery: Item prototype: Traffic in Trigger prototype: High traffic in LLD rule T N Graph prototype: traffic on interface E D Discovered eth0 U T S Discovered eth1 6.0 Certified Professional ● Day 2 Y P Item prototype:...

LOW-LEVEL DISCOVERY(LLD) - EXAMPLE Example of the network interface discovery: Item prototype: Traffic in Trigger prototype: High traffic in LLD rule T N Graph prototype: traffic on interface E D Discovered eth0 U T S Discovered eth1 6.0 Certified Professional ● Day 2 Y P Item prototype: Traffic out O C Trigger prototype: High traffic out Item: Traffic in Item: Traffic out Trigger: High traffic in Trigger: High traffic out Graph: traffic on interface Item: Traffic in Item: Traffic out Trigger: High traffic in Trigger: High traffic out Graph: traffic on interface © 2023 by Zabbix. All rights reserved Theory 44 LOW-LEVEL DISCOVERY COMPONENTS LLD rule consists of the following entity prototypes: Y P Item prototypes Trigger prototypes Graph prototypes Host prototypes T N Prototypes are like blueprints for the entities: U T E D S O C Prototypes If a prototype is changed, the entities will be updated: Next time the discovery rule is executed based on the update interval For passive checks it can be forced manually by using [Execute now] 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 45 LOW-LEVEL DISCOVERY RULE PROPERTIES LLD rule properties are very similar to regular Zabbix item properties: Y P LLD rule must have a name and a unique key Recommended to use the word "discovery" in both. Any item type can be used for data collection O C Data may require preprocessing before it may be used for LLD E D U T S 6.0 Certified Professional ● Day 2 T N © 2023 by Zabbix. All rights reserved Theory 46 LLD INTERNALS Update interval defines how often LLD rule is executed: Y P Based on the received discovery data, the entities will be created, removed or updated Too frequent execution on proxies can degrade proxy performance O C Proxies send LLD data over the network to Zabbix server T N Low level discovery has multiple processes involved: LLD data is collected by data collectors on every update interval (pollers, trappers etc.) E D Data can be preprocessed (optionally) - the result must be in JSON format JSON format data is passed to LLD manager, which will pass it to a free LLD worker process U T Multiple LLD workers can be started on Zabbix server, if required: S ### Option: StartLLDProcessors # Number of pre-forked instances of low level discovery processors. # Range: 1-100 StartLLDProcessors=5 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 47 LOW-LEVEL DISCOVERY(LLD) - ITEM PROTOTYPES Prototypes are created under the LLD rule like regular entities Item prototypes T N Y P O C All entities created by LLD will have a rule name displayed in orange color: E D LLD rule Items created from prototypes U T S 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 48 LLD - LOST RESOURCES Entities, which do not exist anymore, are kept for Keep lost resources period: Y P They do not exist anymore They are filtered out by LLD filters or overrides (discussed later) O C Entities will be removed automatically after this period: T N Default period is 30 days (maximum is 25 years) If a period is set to 0, the lost entities are removed on the next LLD rule execution E D The lost entities are marked with a yellow warning sign U T S 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 49 LLD - DISABLING LLD RULE If the LLD rule is disabled / not supported: Y P New entities are not created Lost entities will not be removed Changes to prototypes will take no effect Existing items and triggers will not be affected E D U T S ! T N O C Internal actions can be used to report broken LLD rules 6.0 Certified Professional ● Day 2 The LLD rule is disabled © 2023 by Zabbix. All rights reserved Items are still enabled Theory 50 LLD - CREATED ENTITIES Deleting rules/prototypes: Y P If a prototype is deleted, every entity created from this prototype is deleted immediately If a discovery rule is deleted, all the entities created by this rule will be deleted immediately E D U T S 6.0 Certified Professional ● Day 2 T N O C 4 items created by LLD rule Item prototype Outgoing traffic is deleted 2 Items left after removing prototype © 2023 by Zabbix. All rights reserved Theory 51 PRACTICAL SETUP Y P 1) Create a new template: Name: Training Low-level discovery Groups: Training/Templates O C 2) Create a new discovery rule on the "Training Low-level discovery" template: T N Name: Network interfaces discovery Use Zabbix built in network discovery key net.if.discovery Change update interval to 1 hour E D 3) Create two item prototypes for incoming and outgoing traffic 4) Link the "Training Low-level discovery" template to the "Training-VM-XX" host U T Manually execute the discovery rule and check the results 5) Add two new dummy network interfaces “eth2” and “eth3” S Manually execute the discovery rule and check the results 6) Remove the dummy network interface “eth2” and loopback interface from the item list Manually execute the discovery rule and check results 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved 20 minutes Practical task No: 11 52 Y P E DLLD INTERNALS U T S 6.0 Certified Professional ● Day 2 T N O C © 2023 by Zabbix. All rights reserved 15 minutes 53 LOW-LEVEL DISCOVERY MACROS Low-level discovery rules return data in LLD macros Y P Syntax: {#MACRO.NAME} LLD macros: Are used for creating prototypes O C Return real values of the file system name, network interface, SNMP OID, etc. T N When discovering real file systems, network interfaces, etc.: Items are created based on item prototypes Macros are substituted with real values E D Item key prototype U T S net.if.in["{#IFNAME}"] 6.0 Certified Professional ● Day 2 Item keys created from a prototype net.if.in["eth0"] net.if.in["eth1"] net.if.in["eth2"] net.if.in["eth3"] © 2023 by Zabbix. All rights reserved Theory 54 LOW-LEVEL DISCOVERY BUILT-IN MACROS Built-in discovery items have their own set of predefined LLD macros Y P discovery key LLD macros Mounted filesystems vfs.fs.discovery {#FSNAME}, {#FSTYPE} Block devices vfs.dev.discovery {#DEVNAME}, {#DEVTYPE} Network interfaces net.if.discovery {#IFNAME} CPU system.cpu.discovery {#CPU.NUMBER}, {#CPU.STATUS} Windows services service.discovery {#SERVICE.NAME}, {#SERVICE.STATE}, etc. systemd.unit.discovery {#UNIT.NAME}, {#UNIT.ACTIVESTATE}, etc. Systemd services E D T N U T O C Built-in LLD keys return an array of LLD rows at the root of JSON document Zabbix will automatically extract a macro and a value S zabbix_agent2 -t net.if.discovery [s|[{"{#IFNAME}":"eth0"},{"{#IFNAME}":"eth1"},{"{#IFNAME}":"eth2"},{"{#IFNAME}":"eth3"}]] 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 55 LOW-LEVEL DISCOVERY(LLD) - JSON FORMAT Discovery rule relies on JSON data block to generate LLD macros: Y P Zabbix JSON format can be used to generate them automatically Any valid JSON data block containing data array is supported by defining LLD mappings ## Example of built in JSON format # zabbix_agent2 -t [ s|[ { "{#FSNAME}": "{#FSTYPE}": }, { "{#FSNAME}": "{#FSTYPE}": } ] ] ! [ { "TABLE_NAME": "acknowledges", "DATA_LENGTH": "16384", "INDEX_LENGTH": "49152" }, { "TABLE_NAME": "actions", "DATA_LENGTH": "16384", "INDEX_LENGTH": "32768" } E D U T S T N vfs.fs.discovery "/sys", "sysfs" O C ## Example of Custom JSON format "/", "xfs" ] Agent Discovery data format from older versions is supported 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 56 LLD – BUILT-IN JSON FORMAT Zabbix JSON format already contains built-in LLD macro names and values: Macro names are already defined { Macros are ready for usage in prototypes O C },{ T N } Y P "{#FSNAME}": "/sys", "{#FSTYPE}": "sysfs" "{#FSNAME}": "/var", "{#FSTYPE}": "xfs" For custom JSON format LLD macro names must be mapped to JSON path E D Mapping is defined in the LLD rule properties (LLD macros tab) U T { "fsname": "/sys", "fstype": "sysfs", "bytes": {"total": 941412352,"free": 941412352} }, { "fsname": "/var", "fstype": "xfs", "bytes": {"total": 53673439232,"free": 45409468416} } S 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 57 LLD - PREPROCESSING An example of received data block: TABLE_NAME acknowledges actions Raw data separated by tabs Preprocessing steps: Replace \t (tabs) with ; (semicolons) T N Use built-in CSV to JSON functionality DATA_LENGTH 16384 16384 O C Y P INDEX_LENGTH 49152 32768 E D After preprocessing - JSON data block is ready for processing with LLD U T LLD macro {#TABLE.NAME} is mapped to JSON path $.TABLE_NAME [{ S "TABLE_NAME": "acknowledges", }, { "TABLE_NAME": "actions", }] 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 58 Y P T N O C E D Low-level Discovery U T Prototypes S 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved 15 minutes 59 LOW-LEVEL DISCOVERY (LLD) - ITEM PROTOTYPES Item prototypes have the same properties as regular items Mandatory requirements: LLD {#MACRO} in the item key Keys must be unique T N Use {#MACRO} as key’s[parameter] Y P O C E D Recommended: U T To use {#MACRO} in the item name Use {#MACRO} in tags i S https://www.zabbix.com/documentation/.../discovery/low_level_discovery#item_prototypes 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 60 LLD - TRIGGER PROTOTYPES Trigger prototypes: Y P It is recommended to use LLD {#MACRO} in the trigger name LLD {#MACRO} can be used in tags Expression may contain: Item prototypes from the same LLD rule Regular items from any host/template E D U T i S T N O C https://.../documentation/.../low_level_discovery#trigger_prototypes 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 61 LLD - TRIGGER PROTOTYPE DEPENDENCIES Trigger prototype dependencies: Y P Between trigger prototypes from the same LLD rule Between a trigger prototype and any host/template regular trigger E D U T S 6.0 Certified Professional ● Day 2 T N O C © 2023 by Zabbix. All rights reserved Theory 62 LLD - ADDITIONAL ATTRIBUTES The item / trigger prototypes have additional attributes: Description Create enabled If checked (default), the item/trigger will be added in an enabled state. If unchecked, the item/trigger will be added to a host, but in a disabled state. Discover If checked (default), the item / trigger will be added to a host. If unchecked, the item / trigger will not be added to a host S T N O C E D U T ! Y P Parameter Create enabled setting won't affect already existing entities! 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 63