Re: A few questions regarding Solaris

[Mike Lococo <mikelococo () gmail com>]

On 08/31/2010 03:20 PM, Robert Riskin wrote:
> Mike thank you very much for the info, i'm curious how you have Zabbix
> watch your perfmon file with certain columns.  I use Zabbix in a
> separate environment (and I love it) but am planning on deploying in
> production by year-end.

I add a userparameter to the zabbix_agentd.conf file as follows (ignore
linebreaks, it should all be on one line):

   UserParameter=snort.perfmon[*],tail -n1 '/var/log/snort
   /$1/snort.stats' | awk -F ','  '{print $ $2}'

This uses tail to grab the last line of a stats file, and pipes that
line into awk in order to print a particular column.  $1 and $2 are
zabbix variables that allow you to create "items" that monitor different
interfaces and columns without having to create a separate
"userparameter" for every one.  Note the extra dollar-sign in the awk
print statement... which is necessary because both awk and zabbix use
dollar-signs in their variable names.

I then add items to a host/template for each interface and column that I
want to monitor with keys like so:

snort.perfmon[eth1,46]
snort.perfmon[eth1,47]
snort.perfmon[eth2,46]
snort.perfmon[eth2,47]

The four items above would monitor received packets (column 46) and
dropped packets (column 47) for eth1 and eth2.  Zabbix won't calculate a
ratio for you, but you can plot both values in a stacked graph, which is
a good rough substitute.  Also be wary of the update interval in zabbix
vs the update interval for the perfmon pre-processor, you want them to
be roughly the same so you're not polling the same value over and over
again or missing values.  I update my stats about every 10 minutes.

Cheers,
Mike Lococo

------------------------------------------------------------------------------
This SF.net Dev2Dev email is sponsored by:

Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users