zabbix是如何实现监控的

一.多平台agent代理

Small footprint and low resource

Due to its small footprint, the agent can be run on devices with limited resources.

The monitoring configurations are centralized in Zabbix server, making it easier to manage the Zabbix agent, which can use a single configuration file on all servers.

Polling and trapping support（这个是重点）

Zabbix agents support both passive (polling) and active checks (trapping). Zabbix may perform checks based on an interval, however, it is also possible to schedule specific times for item polling.

Passive checks (polling):

• Zabbix server (or proxy) requests a value from Zabbix agent
• Agent processes the request and returns the value to Zabbix server (or proxy)

Active checks (trapping):

• Zabbix agent requests from Zabbix server (or proxy) a list of active checks
• Agent sends the results in periodically

Agent functions

The following list of checks is suported by Zabbix agent out of the box.

Network	Packets/bytes transfered Errors/dropped packets Collisions
CPU	Load average CPU idle/usage CPU utilization data per individual process
Memory	Free/used memory Swap/pagefile utilization
Disk	Space free/used Read and write I/O
Service	Process status Process memory usage Service status (ssh, ntp, ldap, smtp, ftp, http, pop, nntp, imap) Windows service status DNS resolution TCP connectivity TCP response time
File	File size/time File exists Checksum MD5 hash RegExp search
Log	Text log Windows eventlog
Other	System uptime System time Users connected Performance counter (Windows)

Log monitoring

Support for monitoring text logs and the Windows Event Log is a native function of Zabbix agent, including support for rotation.

It is possible to graph data from log items, when specific-content extraction capabilities are used.

The logs are constantly analyzed by Zabbix agent and when a defined search item is found, Zabbix server is notified and may even take some action or automatically send a notification to a user or group.

WMI『1』support

Zabbix agent features native Windows Management Instrumentation (WMI) support, enhancing the ability to easily obtain and monitor real-time system information and performance metrics from Windows servers and workstations.

WMI queries can be performed with wmi.get[] key to retrieve a single string, integer or floating point property from the specified WMI namespace class.

For more information about Windows Management Instrumentation, available classes and their properties see MSDN documentation.

二.SNMP和IPMI代理

SNMP『2』support

A Zabbix server can collect data from devices with SNMP agent versions v1, v2 or v3. SNMP agents are present not only in network equipment, but also in printers, NAS, UPS. Basically, any equipment that is present on the network can be monitored through SNMP agents.

For easier configuration, Zabbix supports the standard SNMP MIB-2, as well as specific information on an Enterprise MIB.

You can collect data by using the SNMP polling mode or receiving SNMP traps through the snmptrap daemon and zabbix_sender utility.

Additionally, you can get SNMP data with the use of dynamic indexes offering monitoring that is flexible and without performance degradation, since the resolution queries are cached.

IPMI『3』 agent

To get important data from hardware, a Zabbix server supports IPMI agents, which are present by default on Intel architecture servers like HP iLO and Dell DRAC.

三.用户无代理监控

Agentless Monitoring

While a Zabbix agent offers great features on most platforms, in some cases it is not possible to install it. For these cases, some agentless monitoring methods are provided by the Zabbix server.

Agentless functions

Network Services Check	TCP port availability TCP port response time Service check
ICMP Ping	Server availability ICMP response time Packet loss
Remote Check	Executing commands via SSH or Telnet

Network services（可以监控服务是否开启）

A Zabbix server can check if a service is listening on a port, and also checks that it is responding properly. This method is currently supported for the following services: FTP, IMAP, HTTP, HTTPS, LDAP, NNTP, POP3, SMTP, SSH, TCP and Telnet.

补充一下：（FTP端口21，SSH端口22，Telnet端口23，SMTP的端口25，HTTP端口80，POP3的端口110，HTTPS端口443）

TCP port check（监控tcp端口检测）

For cases not handled by the previous item, Zabbix server can check if there is something listening on a TCP port, informing if a service is available or not.

ICMP ping（监控ICMP的连接，ping包）

Although simple, but important, Zabbix can check if a host is responding to ICMP ping packets. Thus, it is possible to control the availability of a server, as well as the response time and packet loss.

Checks can be customized by setting the size and number of packets, timeout and delay between each packet.

SSH and Telnet（ssh或telnet可用的时候，监控可以生成图形或报警）

When the configuration of a Zabbix agent is not possible, but access via SSH or Telnet is available, a Zabbix server can run any custom command and use its return as a value collected. From this value it is possible, for example, to generate graphs and alarms.

四.自定义方法

Custom Monitoring

Add custom scripts

In addition to the built-in checks, it is possible to create custom agent checks using the user parameter feature.

Moreover, a powerful feature of a Zabbix agent is the ability to execute custom scripts. Anyone can extend Zabbix agent functionality by creating scripts in programming languages like shell script, Perl, Python, Ruby or any other that can be executed. The result of the executed script is sent to Zabbix server, which stores and processes it like any other check.

External checks

In external checks a Zabbix server can run custom scripts from their own server.

Loadable modules

Loadable modules offer a way of extending Zabbix functionality that is more performance-minded than the user parameter option or external checks. In addition to greater performance and the ability to implement any logic, modules have the potential to be developed and shared within the Zabbix community. Supported for Unix-like systems, a loadable module is basically a shared library used by Zabbix server or agent and loaded on startup.

五.计算和聚合

Calculated and Aggregate Information

Calculated items

Through an arithmetic expression, calculated items allow to create virtual data sources, where the values ​​are periodically recalculated. The result is stored, allowing to generate graphs, alarms or send notifications.

An example of a calculated item would be to calculate the sum of traffic between two ports on a network switch.

Aggregate items

With hosts being organized into groups you can create items with aggregate functions like maximum, minimum and average of an item that is common to all hosts in the group.

An example of an aggregate item would be to calculate the average of memory usage across all hosts of a specific group.

六.终端用户Web监控

Web Scenarios

Zabbix provides an effective and flexible web monitoring function, where the web module regularly executes pre-defined scenarios and stores obtained results.

Integrity of a website

Zabbix web monitoring function allows to check performance and availability of multiple web resources and based on the data collected generate graphs, alarms and send notifications about failures.

For each step of the scenario the following values are stored​​:

• Download speed
• Response time
• Response code
• Occurrence of a string in result

注释：

【1】WMI，系统插件

【2】SNMP，简单网络管理协议，可以监测连接到网络上的设备进行管理

【3】IPMI，智能平台管理接口，可以监视服务器的物理健康特征，如温度、电压、风扇工作状态、电源状态等