监控日志

1.创建脚本存放目录，写脚本，给执行权限，改脚本存放目录的属主属组为zabbix

在客户端上进入根目录

[root@lwq-client ~]# cd /scripts/
//传入脚本log.py
[root@lwq-client scripts]# ls
check_swap.sh  log.py  zabbix.sh
[root@lwq-client scripts]# chmod a+x log.py 
[root@lwq-client scripts]# chown -R zabbix.zabbix log.py 
[root@lwq-client scripts]# ll
总用量 12
-rwxr-xr-x. 1 zabbix zabbix  187 8月  25 09:50 check_swap.sh
-rwxr-xr-x. 1 zabbix zabbix 1854 8月  25 10:27 log.py
-rwxr-xr-x. 1 zabbix zabbix  126 8月  24 16:45 zabbix.sh

//log.py脚本内容如下
#!/usr/bin/env python3
import sys
import re

def prePos(seekfile):
    global curpos
    try:
        cf = open(seekfile)
    except IOError:
        curpos = 0
        return curpos
    except FileNotFoundError:
        curpos = 0
        return curpos
    else:
        try:
            curpos = int(cf.readline().strip())
        except ValueError:
            curpos = 0
            cf.close()
            return curpos
        cf.close()
    return curpos

def lastPos(filename):
    with open(filename) as lfile:
        if lfile.readline():
            lfile.seek(0,2)
        else:
            return 0
        lastPos = lfile.tell()
    return lastPos

def getSeekFile():
    try:
        seekfile = sys.argv[2]
    except IndexError:
        seekfile = '/tmp/logseek'
    return seekfile

def getKey():
    try:
        tagKey = str(sys.argv[3])
    except IndexError:
        tagKey = 'Error'
    return tagKey

def getResult(filename,seekfile,tagkey):
    destPos = prePos(seekfile)
    curPos = lastPos(filename)

    if curPos < destPos:
        curpos = 0

    try:
        f = open(filename)
    except IOError:
        print('Could not open file: %s' % filename)
    except FileNotFoundError:
        print('Could not open file: %s' % filename)
    else:
        f.seek(destPos)

        while curPos != 0 and f.tell() < curPos:
            rresult = f.readline().strip()
            global result
            if re.search(tagkey, rresult):
                result = 1
                break
            else:
                result = 0

        with open(seekfile,'w') as sf:
            sf.write(str(curPos))
    finally:
        f.close()
    return result

if __name__ == "__main__":
    result = 0
    curpos = 0
    tagkey = getKey()
    seekfile = getSeekFile()
    result = getResult(sys.argv[1],seekfile,tagkey)
    print(result)

2.更改客户端配置文件agentd.conf

[root@lwq-client ~]# vim /usr/local/etc/zabbix_agentd.conf
UnsafeUserParameters=1
UserParameter=check_log[*],/usr/bin/python /scripts/log.py $1 $2 $3   //传参数

[root@lwq-client ~]# which python
/usr/bin/python
[root@lwq-client scripts]# /usr/bin/python log.py /var/log/httpd/error_log 
0
[root@lwq-client ~]# cd /var/log/httpd/ 
[root@lwq-client httpd]# ll -d
drwx------. 2 root root 41 8月  24 16:30 .
[root@lwq-client httpd]# setfacl -m u:zabbix:r-x .       //给zabbix用户读和执行权限

3.重启zabbix_agent

[root@lwq-client ~]# pkill zabbix
[root@lwq-client ~]# zabbix_agentd 

4.在服务端手动测试

[root@lwq-server ~]# zabbix_get -s 192.168.176.112 -k check_log['/var/log/httpd/error_log','/tmp/qq.seek','error']
0

5.配置网页界面，添加监控项以及触发器

添加监控项

添加触发器

6.验证

在配置文件/var/log/httpd/error_log打印字符
[root@lwq-client httpd]# echo "error" >> /var/log/httpd/error_log 

检测——>最新数据——>主机群组——>主机——>应用
由上图log——>图形