ZCP_day_2_slides2_Part5.pdf

DISCOVERY USING DEPENDENT ITEMS - JSONPATH Escaping special characters from LLD macro values in JSONPath Y P When Low-level Discovery macros are used in JSONPath preprocessing and their values are resolved, the following rules of escaping special characters are applied: O C Only backslash (\) an...

DISCOVERY USING DEPENDENT ITEMS - JSONPATH Escaping special characters from LLD macro values in JSONPath Y P When Low-level Discovery macros are used in JSONPath preprocessing and their values are resolved, the following rules of escaping special characters are applied: O C Only backslash (\) and double quote (") characters are considered for escaping If resolved macro value contains these characters, each of them is escaped with a backslash If they are already escaped with a backslash: T N It is not considered as escaping Both the backslash and the following special characters are escaped once again E D JSONPath U T $.[?(@.value == "{#MACRO}")] i S LLD macro value After substitution special "value" $.[?(@.value == "special \"value\"")] c:\temp $.[?(@.value == "c:\\temp")] a\\b $.[?(@.value == "a\\\\b")] https://.../preprocessing/jsonpath_functionality/escaping_lld_macros 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 84 DISCOVERY USING DEPENDENT ITEMS - JSONPATH If macros have special characters: Y P Use double quotes LLD macro value JSONPath $.[?(@.value == "{#MACRO}")] After substitution special "value" $.[?(@.value == {#MACRO})] O C $[?(@.value == "special \"value\"")] T N $[?(@.value == special \"value\")] Result OK Bad JSONPath expression If special characters are used in the path: E D They should be enclosed in square brackets and double quotes U T JSONPath $.["{#MACRO}"].value S $.{#MACRO}.value LLD macro value c:\temp 6.0 Certified Professional ● Day 2 After substitution Result $.["c:\\temp"].value OK $.c:\\temp.value Bad JSONPath expression © 2023 by Zabbix. All rights reserved Theory 85 Y P T N O C E D CONTEXT SUPPORT U T IN USER MACROS S 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved 10 minutes 86 LLD - CONTEXT SUPPORT IN USER MACROS An optional context can be used in user macros: Y P Allows to override the default value with a context-specific one The context is appended to the macro name Regular expressions are supported How to create context-based macros: T N O C Define a user macro on a template, host or global level Extend the user macro with the context to match different conditions i E D FS Type Description User macro Value any User macro Any undefined FS {$LOW.SPACE} 1G /boot Context macro boot FS (small) {$LOW.SPACE:"/boot"} 100M U T S /home Context macro home FS (medium) {$LOW.SPACE:"/home"} 5G /var/log/* Context macro log FS 100G (large) {$LOW.SPACE:regex:"^/var/log/.*$"} https://www.zabbix.com/documentation/6.0/manual/config/macros/user_macros_context 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 87 USING CONTEXT MACROS IN TRIGGERS Can be defined to accomplish more flexible thresholds in trigger expressions: Y P Are based on the values retrieved by Low-level Discovery After the discovery, different thresholds will apply Configuration example: T N A trigger prototype: O C last(/host/vfs.fs.size[{#FSNAME},free]) < {$LOW.SPACE:"{#FSNAME}"} E D The triggers created from prototype: last(/host/vfs.fs.size[/home,free]) < {$LOW.SPACE:"/home"} last(/host/vfs.fs.size[/boot,free]) < {$LOW.SPACE:"/boot"} last(/host/vfs.fs.size[/var/log/mysql,free]) < {$LOW.SPACE:"/var/log/mysql"} last(/host/vfs.fs.size[/data,free]) < {$LOW.SPACE:"/data"} U T S the {$LOW.SPACE:"/data"} macro is not defined and will be calculated using {$LOW.SPACE} i https://www.zabbix.com/documentation/6.0/manual/config/macros/user_macros_context 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 88 PRACTICAL SETUP Y P 1) On the "Training Low-level discovery" template: Create a new macro {$LOW.DISK.SPACE} = 10G In the "File systems discovery" rule create a new trigger prototype to detect free space < 10G: O C 2) Execute File systems discovery rule on the Training-VM-XX host T N 3) Make sure that triggers are created, and the problem is detected 4) On the "Training Low-level discovery" template: E D Create a new context-based macro for all /dev* filesystems with value 300M Adjust the trigger prototype to use context-based macros 5) Check whether the context-based macro is used U T The problem must be resolved S 6.0 Certified Professional Day ● Day 2 2 © 2023 by Zabbix. All rights reserved 20 minutes Practical task No: 15 89 Y P E D Specific LLD Keys U T S 6.0 Certified Professional ● Day 2 T N O C © 2023 by Zabbix. All rights reserved 10 minutes 90 LLD OF LINUX SYSTEMD SERVICES Linux systemd services can be discovered only by using Zabbix agent 2: An LLD rule returns data in JSON format U T S 6.0 Certified Professional ● Day 2 Y P }, { ] } O C "{#UNIT.NAME}": "nginx.service", "{#UNIT.DESCRIPTION}": "The nginx HTTP and reverse proxy server", "{#UNIT.LOADSTATE}": "loaded", "{#UNIT.ACTIVESTATE}": "active", "{#UNIT.SUBSTATE}": "running", "{#UNIT.FOLLOWED}": "", "{#UNIT.PATH}": "/org/freedesktop/systemd1/unit/nginx_2eservice", "{#UNIT.JOBID}": 0, "{#UNIT.JOBTYPE}": "", "{#UNIT.JOBPATH}": "/" T N E D LLD macros are used in prototypes [ { "{#UNIT.NAME}": "mysqld.service", "{#UNIT.DESCRIPTION}": "mysql.service", "{#UNIT.LOADSTATE}": "not-found", "{#UNIT.ACTIVESTATE}": "inactive", "{#UNIT.SUBSTATE}": "dead", "{#UNIT.FOLLOWED}": "", "{#UNIT.PATH}": "/org/freedesktop/systemd1/unit/mysql_2eservice", "{#UNIT.JOBID}": 0, "{#UNIT.JOBTYPE}": "", "{#UNIT.JOBPATH}": "/" © 2023 by Zabbix. All rights reserved Theory 91 LLD OF LINUX SYSTEMD SERVICES Some systemd key examples: Y P Description and key The primary name of the unit systemd.unit.info[mysqld.service,Id] Service Description T N systemd.unit.info[mysqld.service,Description] O C Returned value mysqld.service MySQL Server One of states: active, reloading, inactive, failed, activating, deactivating. E D systemd.unit.info[mysqld.service,ActiveState,Unit] The last time a unit entered the active state U T systemd.unit.info[mysqld.service,ActiveEnterTimestamp] active 1562565036283903 The number of currently open connections on this socket S systemd.unit.info[dbus.socket,NConnections,Socket] i 0 https://www.zabbix.com/documentation/6.0/manual/discovery/low_level_discovery/systemd 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 92 LLD FOR WINDOWS SERVICES Windows services can be discovered by Zabbix agent: Key: service.discovery Item key: LLD rule returns data in macros: • • • • • • • • • • {#SERVICE.NAME} {#SERVICE.DISPLAYNAME} {#SERVICE.DESCRIPTION} {#SERVICE.STATE} {#SERVICE.STATENAME} {#SERVICE.PATH} {#SERVICE.USER} {#SERVICE.STARTUP} {#SERVICE.STARTUPNAME} {#SERVICE.STARTUPTRIGGER} S O C service.info[service,<param>] Item prototype example: T N service.info[{#SERVICE.NAME},state] E D U T Y P Trigger prototype example: last(/host/service.info[{#SERVICE.NAME},state])<>0 i https://.../discovery/low_level_discovery/windows_services 6.0 Certified Professional ● Day Day 22 © 2023 by Zabbix. All rights reserved Theory 93 LLD FOR WMI QUERIES Done using WQL queries Y P Results are automatically transformed into a JSON object Discovery key: wmi.getall[<namespace>,<query>] Example: T N O C wmi.getall[root\cimv2,"select * from win32_perfformatteddata_perfdisk_physicaldisk"] U T E D S [ ] 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved { "Name": "0 C:", "DiskReadBytesPersec": "0", "DiskReadsPersec": 0, "DiskWriteBytesPersec": "784167", "DiskWritesPersec": 11, "PercentIdleTime": "99", }, { "Name": "1 D:", "DiskReadBytesPersec": "6372437 "DiskReadsPersec": 14256 "DiskWriteBytesPersec": "4362378", "DiskWritesPersec": 36231, "PercentIdleTime": "65", } Theory 94 LLD OF PERFORMANCE COUNTERS It is possible to discover object instances for Windows performance counters Y P Useful for multi-instance performance counters Discovery will return all instances in the {#INSTANCE} macro Discovery keys: perf_instance.discovery[object] T N perf_instance_en.discovery[object] Example discovery key and item prototype: E D perf_instance.discovery[Processor] U T S 6.0 Certified Professional ● Day 2 O C perf_counter_en["\Processor({#INSTANCE})\% Processor Time"] [ ] © 2023 by Zabbix. All rights reserved {"{#INSTANCE}":"0"}, {"{#INSTANCE}":"1"}, {"{#INSTANCE}":"2"}, {"{#INSTANCE}":"3"}, {"{#INSTANCE}":"_Total"} Theory 95 Y P T N O C E D DIFFERENT LLD METHODS U T S 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved 20 minutes 96 CLASSIC WAY VS DEPENDENT ITEMS There are two approaches how to design LLD rules and prototypes: Y P Classic way: Every metric is polled individually Utilizes more pollers, if passive checks are used T N Problems related to Zabbix agent: More frequent requests to the agent Use active agent to avoid these problems E D U T Dependent items: O C Metrics are collected in bulk S More load on preprocessors, recommended to use proxies to offload Zabbix server Can cause spikes in data processing (triggers, history writes etc.) 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 97 DISCOVERY OF MOUNTED FILESYSTEMS By example, Zabbix agent offers two ways how to work with the filesystems: Classic: using a discovery rule with the agent key vfs.fs.discovery O C Discovery rule creates "normal" Zabbix items for every metric Active agent checks can offload Zabbix server T N A new one: vfs.fs.get as a master item Y P Discovery rule creates dependent items Everything is processed by Zabbix server using preprocessors Load can be distributed among Zabbix proxies U T E D S 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 98 DISCOVERY OF MOUNTED FILESYSTEMS - CLASSIC WAY vfs.fs.discovery item key discovers a list of mounted filesystems and their types: Y P Discovery rule 6.0 Certified Professional ● Day 2 T N O C E D U T S Prototypes © 2023 by Zabbix. All rights reserved Theory 99 DISCOVERY OF MOUNTED FILESYSTEMS - NEW WAY Uses vfs.fs.get agent item key for the master item Metrics are received in bulk { Processes the collected data using: A dependent low-level discovery rule T N $.[?(@.fsname=='{#FSNAME}')].bytes.free.first() Usage of the dependent items increases CPU utilization: U T Dependent items are processed by preprocessors "fsname": "/", "fstype": "xfs", "bytes": { "total": 26831990784, "free": 21950971904, "used": 4881018880, "pfree": 81.808957, "pused": 18.191043 }, "inodes": { "total": 13106624, "free": 13064122, "used": 42502, "pfree": 99.675721, "pused": 0.324279 } O C Item prototypes for each metric using preprocessing - JSON path E D Y P JSON example Proxies can be used to offload Zabbix server i S https://.../documentation/.../discovery/low_level_discovery/mounted_filesystems 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 100 DISCOVERY OF MOUNTED FILESYSTEMS - NEW WAY Master item: LLD macros using JSONPath: Y P T N O C Item prototype: Dependent discovery rule: U T E D S 6.0 Certified Professional ● Day 2 Preprocessing - JSON path: © 2023 by Zabbix. All rights reserved Theory 101 Y P E DLLD Using SQL U T S 6.0 Certified Professional ● Day 2 T N O C © 2023 by Zabbix. All rights reserved 10 minutes 102 LLD VIA SQL QUERIES LLD via SQL queries: Y P db.odbc.discovery[<description>,<dsn>,<connection string>] Example: db.odbc.discovery[databases,mssqlsrv_01] Results will be automatically transformed into JSON O C Column names become macro names and the selected rows become the values of these macros. T N Use column aliases to define the macro names: mysql> SELECT c.name, c.l0c# AS location FROM customers c E D The macro names: {#NAME} and {#LOCATION} Be aware that: U T The discovery rule will become not supported, if a macro name is not valid (e.g. {#L0C#}) S This is the "old way" to do SQL discovery ! db.odbc.get is much more effective compared to db.odbc.discovery 6.0 Certified Professional ● Day 2 © 2023 by Zabbix. All rights reserved Theory 103