Dependent Items
Video Lecture
Description
In this video I expand the log file monitoring item from the last video, into one master item that returns the whole log line, and then create several dependent items from some specific data contained in each log line.
Creating dependent items means that the agent doesn't need to run possibly identical queries on a host many times in order to extract parts of a value. The master item runs once on the host, and then the Zabbix server (or Zabbix proxy if host managed by proxy) updates the dependent items each time the master item is updated.
For this I will create a new template named Web Server Access Logs and add it to the Templates/Applications group.
Master item
| Property | Value |
|---|---|
| Name | HTTP Access Log |
| Type | Zabbix (active) |
| Key | log[/var/log/apache2/access.log,"^.*",,,skip,\0,,,] or log[/var/log/nginx/access.log,"^.*",,,skip,\0,,,] |
| Type of Information | Log |
| Update Interval | 1m |
Dependent Items
Status Code Item
| Property | Value |
|---|---|
| Name | Status Code |
| Type | Dependent Item |
| Key | HTTPStatusCode |
| Type of Information | Numeric (unsigned) |
| Master item | HTTP Access Log |
Status Code Preprocessing
Regular Expression : ^(\S+) (\S+) (\S+) \[([\w:\/]+\s[+\-]\d{4})\] \"(\S+)\s?(\S+)?\s?(\S+)?\" (\d{3}|-) (\d+|-)\s?\"?([^\"]*)\"?\s?\"?([^\"]*)\"
Group : \8
Type : Numeric (unsigned)
Path Item
| Property | Value |
|---|---|
| Name | Path |
| Type | Dependent Item |
| Key | HTTPPath |
| Type of Information | Text |
| Master item | HTTP Access Log |
Path Preprocessing
Regular Expression : ^(\S+) (\S+) (\S+) \[([\w:\/]+\s[+\-]\d{4})\] \"(\S+)\s?(\S+)?\s?(\S+)?\" (\d{3}|-) (\d+|-)\s?\"?([^\"]*)\"?\s?\"?([^\"]*)\"
Group : \6
Type : Text
Referer Item
| Property | Value |
|---|---|
| Name | Referer |
| Type | Dependent Item |
| Key | HTTPReferer |
| Type of Information | Text |
| Master item | HTTP Access Log |
Referer Preprocessing
Regular Expression : ^\S+ (\S+) (\S+) \[([\w:\/]+\s[+\-]\d{4})\] \"(\S+)\s?(\S+)?\s?(\S+)?\" (\d{3}|-) (\d+|-)\s?\"?([^\"]*)\"?\s?\"?([^\"]*)\"
Group : \9
Type : Text