Zabbix 2.0 low level discovery – file system

Zabbix 2.0 makes it easy to add network devices, file systems, and SNMP devices for monitoring.  They call their new method low-level discovery and I will show you how I set it up so you can quickly start monitoring your environment.

I’ll first show you how to set up low-level discovery for file systems.  Later you’ll see how to set it up for network devices and SNMP.

Low level discovery of file systems is a big improvement over how you managed file systems in previous Zabbix releases.  You no longer have to assign specific drive letters to a host or remove drives that are ‘unsupported’ from that host.

I have created file system discovery rules in the Windows template and the Linux template.

Windows Discovery Rules

The new discovery rules are created in the Zabbix UI under Configuration, Templates, Discovery.   Here are the details for setting up the low level file system discovery for the Windows template.

Name: Windows FS Discovery
Type: Zabbix agent (active)
Key: vfs.fs.discovery
Update interval: 7200
Keep lost resource period: 1
Filter macro: {#FSTYPE}
Regexp: NTFS|FAT32
Windows LDD file system discovery rule

Windows LDD file system discovery rule

Windows Item Prototypes

Once the discovery entry is made, you should create item prototypes for the items you are interested in.  The prototype will be applied to each of the discovered file system item.

I created 4 prototype items for the Windows low level file system discovery.

  • Free disk space (%)
  • Free disk space
  • Total disk space
  • Used disk space

Each item prototype is pretty much the same, just a change for the name and key.

Free disk space (%)

Name: Free disk space (%) - $1
Type:Zabbix agent (active)
Key: vfs.fs.size[{#FSNAME},pfree]
Type: Numeric (float)
Units: %
Update interval: 300
Keep history: 7
Keep trends: 365
Applications: Availability, Filesystem
Windows LDD item prototype

Windows LDD item prototype

Free disk space

Name: Free disk space - $1
Type:Zabbix agent (active)
Key: vfs.fs.size[{#FSNAME},free]
Type: Numeric (float)
Units: B
Update interval: 300
Keep history: 7
Keep trends: 365
Applications: Availability, Filesystem

Total disk space

Name: Total disk space - $1
Type:Zabbix agent (active)
Key: vfs.fs.size[{#FSNAME},total]
Type: Numeric (float)
Units: B
Update interval: 300
Keep history: 7
Keep trends: 365
Applications: Availability, Filesystem

Used disk space

Name: Used disk space - $1
Type:Zabbix agent (active)
Key: vfs.fs.size[{#FSNAME},used]
Type: Numeric (float)
Units: B
Update interval: 86400
Keep history: 7
Keep trends: 365
Applications: Availability, Filesystem

Trigger prototypes are similar to item prototypes.  Here is one example

Name: Low free disk space % - {HOST.NAME} {#FSNAME}
Expression: {c_Template_Windows:vfs.fs.size[{#FSNAME},pfree].last(0)}<10
Severity: High

Linux Discovery Rules

The details for setting up the low level file system discovery for the Linux template is similar to the Windows setup.

Here are the details for setting up the low level file system discovery for the Linux template.

Name: Linux FS Discovery
Type: Zabbix agent (active)
Key: vfs.fs.discovery
Update interval: 7200
Keep lost resource period: 1
Filter macro: {#FSTYPE}
Regexp:(nfs|ext3)

Linux low level FS discovery

The item prototypes for Linux are exactly the same as the Windows item prototypes, so I will not show show specific Linux examples.

That’s about it.  The addition of low-level discovery in Zabbix is fantastic and I’m sure you will immediately see how helpful it can be once you get it set up in Zabbix 2.0.

Let me know what you think about this new feature.  I’ll post information about network discovery and SNMP discovery shortly.


11 Comments on “Zabbix 2.0 low level discovery – file system”

  1. Chris says:

    Regexp:(nfs|ext3

    Looks like your linux regex got cut off. Minor quibble, so thanks for giving me the nugget I needed to get the default template working 🙂

  2. lupick@gmail.com says:

    I’ve to use zabbix agent and not zabbix agent (active) in order to have it working.
    a smoll fix also is to use in the trigger prototype.

    Name: Low free disk space % – {HOST.NAME} {#FSNAME}

    instead of
    Name: Low free disk space % – {HOST.NAME} {$FSNAME}

    BTW good work!!

  3. Gunsthall says:

    Hi. One conceptual question. How LLD decides where to be applied? I mean, you configure the LLD and then …. what? Does it go though all your configured hosts in Zabbix? Is it applied concurrently with network discovery rules once a new host is added? ??
    e.g. I´ve just instalesl Zabbix. I configure network discovery rules to add host bases on IP, SNMP, … whatever. What should I do to use LLD?

    Thanks!

    • I find it easiest to create the LLD rules under a template. I have a Windows template and a Linux template; each of these templates has LLD rules, items, triggers, etc for network and file systems. All of my servers are either Linux or Windows and they will be placed in either of these 2 templates and then the assigned discovery rules will be active on all nodes.

      I hope this helps

  4. dave says:

    Sweet! Very helpful – thanks!

  5. xero says:

    Can you shed some light on LLD for log file monitoring ? – Thanks!

    • Chris says:

      xero, I’ve never done log monitoring with LLD but my experience using Zabbix for direct log monitoring has not been positive. There are quite a few limitations with the way Zabbix processes logs and, basically, the larger and more active the log, the more likely it is that Zabbix will fall behind in monitoring it. Check out their docs for more detail, specifically the bullet points at the bottom of the page.

      https://www.zabbix.com/documentation/2.0/manual/config/items/itemtypes/log_items

      If you have a centralized log server and a way to monitor the logs outside of Zabbix, you can use Zabbix to alert on certain conditions as I describe in my post about Zabbix and Splunk.

      I had quite a bit of luck with Splunk, but there was a lot of money available for that setup. It’s very expensive if you have a log of daily logs. An alternative is to home brew a solution with Logstash and Kibana. There’s plenty of sites that talk about setting this combo up and it will manage as many logs as you can throw at it.

      Good luck

  6. Abhi says:

    Hello,
    I might have messed up my Zabbix NFS monitoring. What happens is when my NFS runs out of space then I get an alert on all the hosts it is mounted on ,leading to a lot of duplicate alerts. Is there any way to get around it?

    regards,
    Abhi

    • Chris says:

      Abhi,

      First place to look is to check the regular expressions for what file systems are going to be discovered and remove ‘nfs’ from that list. This would remove the NFS file systems from individual hosts that have it mounted and you’d have to rely on a trigger from the local file system check on the NFS server.

      I found this forum post that addresses a similar situation with NFS and the poster found that NFS wasn’t even listed in the regex. Hopefully following along with the post will help you out if you too find NFS not listed.
      https://www.zabbix.com/forum/showthread.php?t=44786

      Good luck


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s