Skip to content

Dependent Items

Video Lecture

Dependent Items Dependent Items

Description

In this video I expand the log file monitoring item from the last video, into one master item that returns the whole log line, and then create several dependent items from some specific data contained in each log line.

Creating dependent items means that the agent doesn't need to run possibly identical queries on a host many times in order to extract parts of a value. The master item runs once on the host, and then the Zabbix server (or Zabbix proxy if host managed by proxy) updates the dependent items each time the master item is updated.

For this I will create a new template named Web Server Access Logs and add it to the Templates/Applications group.

Master item

Property Value
Name HTTP Access Log
Type Zabbix (active)
Key log[/var/log/apache2/access.log,"^.*",,,skip,\0,,,]
or
log[/var/log/nginx/access.log,"^.*",,,skip,\0,,,]
Type of Information Log
Update Interval 1m

Dependent Items

Status Code Item

Property Value
Name Status Code
Type Dependent Item
Key HTTPStatusCode
Type of Information Numeric (unsigned)
Master item HTTP Access Log

Status Code Preprocessing

Regular Expression : ^(\S+) (\S+) (\S+) \[([\w:\/]+\s[+\-]\d{4})\] \"(\S+)\s?(\S+)?\s?(\S+)?\" (\d{3}|-) (\d+|-)\s?\"?([^\"]*)\"?\s?\"?([^\"]*)\"

Group : \8

Type : Numeric (unsigned)

Path Item

Property Value
Name Path
Type Dependent Item
Key HTTPPath
Type of Information Text
Master item HTTP Access Log

Path Preprocessing

Regular Expression : ^(\S+) (\S+) (\S+) \[([\w:\/]+\s[+\-]\d{4})\] \"(\S+)\s?(\S+)?\s?(\S+)?\" (\d{3}|-) (\d+|-)\s?\"?([^\"]*)\"?\s?\"?([^\"]*)\"

Group : \6

Type : Text

Referer Item

Property Value
Name Referer
Type Dependent Item
Key HTTPReferer
Type of Information Text
Master item HTTP Access Log

Referer Preprocessing

Regular Expression : ^\S+ (\S+) (\S+) \[([\w:\/]+\s[+\-]\d{4})\] \"(\S+)\s?(\S+)?\s?(\S+)?\" (\d{3}|-) (\d+|-)\s?\"?([^\"]*)\"?\s?\"?([^\"]*)\"

Group : \9

Type : Text

Dependent items

Item value preprocessing

Comments