zabbix配置https监控nginx服务器状态

zabbix监控nginx服务器状态

环境说明：

服务端IP	要安装的应用
192.168.32.125	lnmp架构 zabbix server

提前关闭防火墙和selinux，并配置好了yum源，包括epel源

//生成证书
[root@localhost ~]# cd /etc/pki/CA 
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
..................................................+++
.............+++
e is 65537 (0x10001)
[root@localhost CA]# ll private/
total 4
-rw-------. 1 root root 1679 Aug 11 21:09 cakey.pem
[root@localhost CA]#  openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:www.a.com
Organizational Unit Name (eg, section) []:www.a.com
Common Name (eg, your name or your server's hostname) []:www.a.com
Email Address []:1@2.com
[root@localhost CA]# ls
cacert.pem  certs  crl  newcerts  private

[root@localhost ~]#  (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
...................................................................................................................+++
....................................+++
e is 65537 (0x10001)
[root@localhost ~]# ls
anaconda-ks.cfg         nginx-1.14.2.tar.gz
echo-nginx-module-0.61  nginx-1.16.1.tar.gz
httpd.key               v0.61.tar.gz
[root@localhost ~]#  openssl req -new -key httpd.key -days 365 -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:www.a.com
Organizational Unit Name (eg, section) []:www.a.com
Common Name (eg, your name or your server's hostname) []:www.a.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@localhost ~]# ls
anaconda-ks.cfg         nginx-1.14.2.tar.gz
echo-nginx-module-0.61  nginx-1.16.1.tar.gz
httpd.csr               v0.61.tar.gz
httpd.key
[root@localhost ~]#  openssl ca -in /root/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Aug 12 01:20:53 2020 GMT
            Not After : Aug 12 01:20:53 2021 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HB
            organizationName          = www.a.com
            organizationalUnitName    = www.a.com
            commonName                = www.a.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                71:73:00:52:90:3E:4A:0E:3A:C9:38:AF:C2:97:97:6B:4A:6F:8B:71
            X509v3 Authority Key Identifier: 
                keyid:E6:5D:3A:CA:1D:72:44:88:0B:06:9E:15:6B:63:CC:6C:F0:2E:97:B2

Certificate is to be certified until Aug 12 01:20:53 2021 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

[root@localhost ~]# ls
anaconda-ks.cfg         httpd.key
echo-nginx-module-0.61  nginx-1.14.2.tar.gz
httpd.crt               nginx-1.16.1.tar.gz
httpd.csr               v0.61.tar.gz

//创建证书存放目录

[root@localhost ~]# mkdir /usr/local/nginx/ssl
[root@localhost ~]# ls
anaconda-ks.cfg         nginx-1.14.2.tar.gz
echo-nginx-module-0.61  nginx-1.16.1.tar.gz
httpd.crt               v0.61.tar.gz
httpd.csr               www.example.com.pem
httpd.key
[root@localhost ~]# cp httpd.crt httpd.key /usr/local/nginx/ssl
[root@localhost ~]# cd /usr/local/nginx/ssl
[root@localhost ssl]# ls
httpd.crt  httpd.key

//修改配置文件
[root@localhost ~]# vim /usr/local/nginx/conf/nginx.conf
    server {
        listen       443 ssl;
        server_name  localhost;

        ssl_certificate      /usr/local/nginx/ssl/httpd.crt;
        ssl_certificate_key  /usr/local/nginx/ssl/httpd.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }
[root@localhost ~]# nginx -s reload
[root@localhost ~]# ss -tanl
State       Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN      0      128     *:80                  *:*                  
LISTEN      0      128     *:22                  *:*                  
LISTEN      0      100    127.0.0.1:25                  *:*                  
LISTEN      0      128     *:443                 *:*                  
LISTEN      0      128    :::22                 :::*                  
LISTEN      0      100       ::1:25                 :::*  

因为zabbix是用php语言开发的，所以必须先部署lamp架构，使其能够支持运行php网页
lnmp部署
1. 部署zabbix
1.1 zabbix服务端安装

#安装依赖包
[root@www ~]# yum -y install net-snmp-devel libevent-devel
 
#下载zabbix
[root@www ~]# wget https://cdn.zabbix.com/zabbix/sources/stable/5.0/zabbix-5.0.2.tar.gz
 
[root@www ~]# tar xf zabbix-5.0.2.tar.gz 
[root@www ~]# cd zabbix-5.0.2
[root@www zabbix-5.0.2]# ls
aclocal.m4  build      conf          configure     database  INSTALL     Makefile.am  misc     README  ui
AUTHORS     ChangeLog  config.guess  configure.ac  depcomp   install-sh  Makefile.in  missing  sass
bin         compile    config.sub    COPYING       include   m4          man          NEWS     src
 
#创建zabbix用户
[root@www zabbix-5.0.2]# useradd -r -M -s /sbin/nologin zabbix
[root@www zabbix-5.0.2]# id zabbix
uid=994(zabbix) gid=992(zabbix) groups=992(zabbix)
 
#配置zabbix数据库
[root@www zabbix-5.0.2]# mysql -uroot -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.30 MySQL Community Server (GPL)
 
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
 
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
#utf-8是Zabbix支持的唯一编码，要使Zabbix服务器/代理与MySQL数据库正常工作，需要字符集UTF 8和UTF 8_bin排序规则。
mysql> create database zabbix character set utf8 collate utf8_bin;
Query OK, 1 row affected (0.00 sec)
 
mysql> grant all privileges on zabbix.* to zabbix@localhost identified by 'zabbix123!';
Query OK, 0 rows affected, 2 warnings (0.00 sec)
 
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
 
mysql> quit
Bye
 
 
[root@www zabbix-5.0.2]# ls
aclocal.m4  build      conf          configure     database  INSTALL     Makefile.am  misc     README  ui
AUTHORS     ChangeLog  config.guess  configure.ac  depcomp   install-sh  Makefile.in  missing  sass
bin         compile    config.sub    COPYING       include   m4          man          NEWS     src
[root@www zabbix-5.0.2]# cd database/mysql/
[root@www mysql]# ls
data.sql  double.sql  images.sql  Makefile.am  Makefile.in  schema.sql
[root@www mysql]# mysql -uzabbix -pzabbix123! zabbix < schema.sql
mysql: [Warning] Using a password on the command line interface can be insecure.
[root@www mysql]# mysql -uzabbix -pzabbix123! zabbix < images.sql
mysql: [Warning] Using a password on the command line interface can be insecure.
[root@www mysql]# mysql -uzabbix -pzabbix123! zabbix < data.sql
mysql: [Warning] Using a password on the command line interface can be insecure.
 
 
 
#编译安装zabbix
[root@www zabbix-5.0.2]# ./configure --enable-server  --enable-agent  --with-mysql  --with-net-snmp  --with-libcurl  --with-libxml2
[root@www zabbix-5.0.2]# make install

1.2 zabbix服务端配置

[root@www zabbix-5.0.2]# ls /usr/local/etc/
zabbix_agentd.conf  zabbix_agentd.conf.d  zabbix_server.conf  zabbix_server.conf.d
 
#修改服务端配置文件
#设置数据库信息
 
[root@www ~]# vim /usr/local/etc/zabbix_server.conf
....
DBPassword=zabbix123!       //设置zabbix数据库连接密码
....
 
#启动zabbix_server和zabbix_agentd
启动zabbix服务端失败
[root@localhost zabbix-3.2.7]# /usr/local/zabbix/sbin/zabbix_server start
/usr/local/zabbix/sbin/zabbix_server: error while loading shared libraries: libmysqlclient.so.20: cannot open shared object file: No such file or directory

解决方法：
[root@localhost zabbix-3.2.7]# find / -name libmysqlclient.so.20
/usr/local/src/mysql-5.7.20/libmysql/libmysqlclient.so.20
/usr/local/mysql/lib/libmysqlclient.so.20
[root@localhost zabbix-3.2.7]# echo "/usr/local/mysql/lib" >> /etc/ld.so.conf
[root@localhost zabbix-3.2.7]# ldconfig

再重启即可成功。
[root@www zabbix-5.0.2]# zabbix_server 
[root@www zabbix-5.0.2]# zabbix_agentd 
[root@www zabbix-5.0.2]# ss -tanl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port              
LISTEN      0      100                     127.0.0.1:25                                          *:*                  
LISTEN      0      128                             *:443                                         *:*                  
LISTEN      0      128                             *:10050                                       *:*                  
LISTEN      0      128                             *:10051                                       *:*                  
LISTEN      0      128                     127.0.0.1:9000                                        *:*                  
LISTEN      0      128                             *:80                                          *:*                  
LISTEN      0      128                             *:22                                          *:*                  
LISTEN      0      100                         [::1]:25                                       [::]:*                  
LISTEN      0      80                           [::]:3306                                     [::]:*                  
LISTEN      0      128                          [::]:22                                       [::]:*           
 
 
 
#按zabbix部署要求修改/etc/php.ini的配置并重启php-fpm
[root@www ~]# sed -ri 's/(post_max_size =).*/\1 16M/g' /etc/php.ini
[root@www ~]# sed -ri 's/(max_execution_time =).*/\1 300/g' /etc/php.ini
[root@www ~]# sed -ri 's/(max_input_time =).*/\1 300/g' /etc/php.ini
[root@www ~]# sed -i '/;date.timezone/a date.timezone = Asia/Shanghai' /etc/php.ini
[root@www ~]# service php-fpm restart
Gracefully shutting down php-fpm . done
Starting php-fpm  done
 
 
 
[root@www ~]# cd zabbix-5.0.2
[root@www zabbix-5.0.2]# ls
aclocal.m4  ChangeLog     config.log     configure.ac  include     Makefile     misc     sass
AUTHORS     compile       config.status  COPYING       INSTALL     Makefile.am  missing  src
bin         conf          config.sub     database      install-sh  Makefile.in  NEWS     ui
build       config.guess  configure      depcomp       m4          man          README
[root@www zabbix-5.0.2]# cd ui/
[root@www ui]# mkdir /usr/local/nginx/html/zabbix
[root@www ui]# cp -a . /usr/local/nginx/html/zabbix/
[root@www ui]# chown -R nginx.nginx /usr/local/nginx/html/zabbix/
[root@www ui]# ls  /usr/local/nginx/html/zabbix/
actionconf.php      conf                         httpconf.php     map.import.php     slides.php
api_jsonrpc.php     conf.import.php              httpdetails.php  map.php            srv_status.php
app                 correlation.php              image.php        modules            sysmap.php
applications.php    discoveryconf.php            imgstore.php     overview.php       sysmaps.php
assets              disc_prototypes.php          include          queue.php          templates.php
audio               favicon.ico                  index_http.php   report2.php        toptriggers.php
auditacts.php       graphs.php                   index.php        report4.php        tr_events.php
browserwarning.php  history.php                  index_sso.php    robots.txt         trigger_prototypes.php
chart2.php          host_discovery.php           items.php        screenconf.php     triggers.php
chart3.php          hostgroups.php               js               screenedit.php     vendor
chart4.php          hostinventoriesoverview.php  jsLoader.php     screen.import.php  zabbix.php
chart5.php          hostinventories.php          jsrpc.php        screens.php
chart6.php          host_prototypes.php          local            services.php
chart7.php          host_screen.php              locale           setup.php
chart.php           hosts.php                    maintenance.php  slideconf.php
 
 
 
#配置nginx
[root@www ~]# vim /usr/local/nginx/conf/nginx.conf
......
 
    server {
        listen       80;
        listen       443 ssl;
        server_name  www.test.com;
 
        ssl_certificate      /usr/local/nginx/ssl/www.test.com.crt;
        ssl_certificate_key  /usr/local/nginx/ssl/www.test.com.key;
 
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
 
        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;
 
        location / {
            root   html/zabbix;
            index  index.php;
        }
        location = /status {
            stub_status;
        }
 
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
 
        location ~ \.php$ {
            root           html/zabbix;
            fastcgi_pass   127.0.0.1:9000;
            fastcgi_index  index.php;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            include        fastcgi_params;
        }
 
}
 
......
 
 
#重新加载nginx配置文件
[root@www ~]# nginx -s reload
 

 
#设置zabbix/conf目录的权限，让zabbix有权限生成配置文件zabbix.conf.php
[root@www ~]# chmod 777 /usr/local/nginx/html/zabbix/conf
[root@www ~]# ll -d /usr/local/nginx/html/zabbix/conf
drwxrwxrwx 3 nginx nginx 94 Jul  6 05:54 /usr/local/nginx/html/zabbix/conf
 
 
 
#配置zabbix开机自启
[root@www core]# pwd
/root/zabbix-5.0.2/misc/init.d/fedora/core
[root@www core]# ls
zabbix_agentd  zabbix_server
[root@www core]# cp -a . /etc/init.d/
 
[root@www core]# chkconfig --add zabbix_server 
[root@www core]# chkconfig --add zabbix_agentd 
[root@www core]# chkconfig zabbix_server on
[root@www core]# chkconfig zabbix_agentd on

2. 编写脚本，取出需要的值来监控nginx状态

#编写脚本
[root@www ~]# mkdir /scripts
[root@www ~]# cd /scripts/
[root@www scripts]# ls
Reading_value.sh  requests_value.sh  Writing_value.sh
[root@www scripts]# cat requests_value.sh 
#!/bin/bash
value=`curl -k -s 192.168.32.125/status | awk 'NR==3{print $3}'`
echo $value
 
[root@www scripts]# cat Reading_value.sh 
#!/bin/bash
value=`curl -k -s 192.168.32.125/status | awk 'NR==4{print $2}'`
echo $value
 
[root@www scripts]# cat Writing_value.sh 
#!/bin/bash
value=`curl -k -s 192.168.32.125/status | awk 'NR==4{print $4}'`
echo $value
 

2.1 修改配置文件，添加自定义key

[root@www scripts]# vim /usr/local/etc/zabbix_agentd.conf
 
......
Server=192.168.32.125 #改为服务端ip
ServerActive=192.168.32.125	#改为服务端ip
......
 
### Option: UnsafeUserParameters
#       Allow all characters to be passed in arguments to user-defined parameters.
#       The following characters are not allowed:
#       \ ' " ` * ? [ ] { } ~ $ ! & ; ( ) < > | # @
#       Additionally, newline characters are not allowed.
#       0 - do not allow
#       1 - allow
#
# Mandatory: no
# Range: 0-1
# Default:
# UnsafeUserParameters=0
UnsafeUserParameters=1
 
### Option: UserParameter
#       User-defined parameter to monitor. There can be several user-defined parameters.
#       Format: UserParameter=<key>,<shell command>
#       See 'zabbix_agentd' directory for examples.
#
# Mandatory: no
# Default:
# UserParameter=
UserParameter=requests_value,/bin/bash /scripts/requests_value.sh
UserParameter=Reading_value,/bin/bash /scripts/Reading_value.sh
UserParameter=Writing_value,/bin/bash /scripts/Writing_value.sh
 
 
 
 
[root@www scripts]# service zabbix_agentd restart
Restarting zabbix_agentd (via systemctl):                  [  OK  ]
 
 
 
#测试配置的key
[root@www scripts]# zabbix_get -s 192.168.32.125 -k requests_value
689
[root@www scripts]# zabbix_get -s 192.168.32.125 -k Writing_value
1
[root@www scripts]# zabbix_get -s 192.168.32.125 -k Reading_value
0

查看监控