Zabbix LLD 设置过滤条件，不自动监控某些item
1、需求描述
默认情况下Zabbix 自带模板 "Template OS Linux" 中网络接口LLD自动发现除还回接口外的所有接口，当这并不一定是我们想要的结果。
比如我有一台运行kvm的服务器，服务器上有四个物理接口 eth0-eth3 , 三个网桥接口 br0-br2 , 还有很多个虚机的网卡接口 vnetxx ，如下所示：
1 [root@host00 ~]# ifconfig |grep HW 2 br0 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:69 3 br1 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6A 4 br2 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6B 5 eth0 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:68 6 eth1 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:69 7 eth2 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6A 8 eth3 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6B 9 vnet0 Link encap:Ethernet HWaddr FE:54:00:00:00:15 10 vnet1 Link encap:Ethernet HWaddr FE:54:00:00:00:17 11 vnet2 Link encap:Ethernet HWaddr FE:54:01:00:00:15 12 vnet3 Link encap:Ethernet HWaddr FE:54:01:00:00:17 13 vnet4 Link encap:Ethernet HWaddr FE:54:00:00:00:2F 14 vnet5 Link encap:Ethernet HWaddr FE:54:01:00:00:2D 15 vnet6 Link encap:Ethernet HWaddr FE:54:00:00:00:30 16 vnet7 Link encap:Ethernet HWaddr FE:54:01:00:00:2E 17 vnet8 Link encap:Ethernet HWaddr FE:54:00:00:00:1A 18 vnet9 Link encap:Ethernet HWaddr FE:54:01:00:00:1A 19 vnet10 Link encap:Ethernet HWaddr FE:54:00:00:00:16 20 vnet11 Link encap:Ethernet HWaddr FE:54:01:00:00:16 21 vnet12 Link encap:Ethernet HWaddr FE:54:00:00:00:11 22 vnet13 Link encap:Ethernet HWaddr FE:54:01:00:00:11 23 vnet14 Link encap:Ethernet HWaddr FE:54:00:A1:61:A1 24 vnet15 Link encap:Ethernet HWaddr FE:54:00:A2:61:A1 25 vnet16 Link encap:Ethernet HWaddr FE:54:00:A3:61:A1 26 vnet20 Link encap:Ethernet HWaddr FE:54:00:00:00:2B 27 vnet21 Link encap:Ethernet HWaddr FE:54:01:00:00:2A 28 vnet24 Link encap:Ethernet HWaddr FE:54:00:00:00:2C 29 vnet25 Link encap:Ethernet HWaddr FE:54:01:00:00:2B
这里我们只想监控服务器上的四个物理接口，对于网桥接口和虚机网卡接口不关心，由于虚机的创建删除比较频繁，导致该服务器在Zabbix中有很多 Item 是 Not supported 的状态，如果等待这些不支持的监控项自动删除大概需要等待一个月的时间。
另外在zabbix-server的日志中也会有记录大量的错误日志：
1 24102:20160701:145019.036 item "10.12.29.100:net.if.in[vnet24]" became supported 2 24101:20160701:145020.037 item "10.12.29.100:net.if.in[vnet25]" became supported 3 24102:20160701:145101.129 item "10.12.29.100:net.if.out[vnet24]" became supported 4 24100:20160701:145102.130 item "10.12.29.100:net.if.out[vnet25]" became supported 5 24101:20160701:155859.871 item "10.12.29.100:net.if.in[vnet6]" became not supported: Cannot find information for this network interface in /proc/net/dev. 6 24100:20160701:155909.880 item "10.12.29.100:net.if.in[vnet17]" became not supported: Cannot find information for this network interface in /proc/net/dev. 7 24100:20160701:155941.908 item "10.12.29.100:net.if.out[vnet6]" became not supported: Cannot find information for this network interface in /proc/net/dev. 8 24102:20160701:155951.916 item "10.12.29.100:net.if.out[vnet17]" became not supported: Cannot find information for this network interface in /proc/net/dev. 9 24102:20160701:160343.187 item "10.12.29.100:net.if.out[vnet7]" became not supported: Cannot find information for this network interface in /proc/net/dev. 10 24101:20160701:160358.201 item "10.12.29.100:net.if.out[vnet22]" became not supported: Cannot find information for this network interface in /proc/net/dev. 11 24102:20160701:160359.201 item "10.12.29.100:net.if.out[vnet23]" became not supported: Cannot find information for this network interface in /proc/net/dev. 12 24100:20160701:160400.202 item "10.12.29.100:net.if.in[vnet7]" became not supported: Cannot find information for this network interface in /proc/net/dev. 13 24101:20160701:160417.217 item "10.12.29.100:net.if.in[vnet22]" became not supported: Cannot find information for this network interface in /proc/net/dev. 14 24100:20160701:160418.219 item "10.12.29.100:net.if.in[vnet23]" became not supported: Cannot find information for this network interface in /proc/net/dev. 15 24102:20160701:160420.220 item "10.12.29.100:net.if.in[vnet19]" became not supported: Cannot find information for this network interface in /proc/net/dev. 16 24101:20160701:160424.224 item "10.12.29.100:net.if.out[vnet19]" became not supported: Cannot find information for this network interface in /proc/net/dev. 17 24101:20160701:161339.730 item "10.12.29.100:net.if.out[vnet4]" became not supported: Cannot find information for this network interface in /proc/net/dev. 18 24100:20160701:161340.730 item "10.12.29.100:net.if.out[vnet5]" became not supported: Cannot find information for this network interface in /proc/net/dev. 19 24100:20160701:161358.750 item "10.12.29.100:net.if.in[vnet4]" became not supported: Cannot find information for this network interface in /proc/net/dev. 20 24100:20160701:161358.750 item "10.12.29.100:net.if.in[vnet5]" became not supported: Cannot find information for this network interface in /proc/net/dev. 21 24100:20160701:161408.760 item "10.12.29.100:net.if.in[vnet16]" became not supported: Cannot find information for this network interface in /proc/net/dev. 22 24102:20160701:161410.761 item "10.12.29.100:net.if.in[vnet18]" became not supported: Cannot find information for this network interface in /proc/net/dev. 23 24102:20160701:161413.764 item "10.12.29.100:net.if.in[vnet14]" became not supported: Cannot find information for this network interface in /proc/net/dev. 24 24101:20160701:161414.765 item "10.12.29.100:net.if.in[vnet15]" became not supported: Cannot find information for this network interface in /proc/net/dev. 25 24101:20160701:161450.795 item "10.12.29.100:net.if.out[vnet16]" became not supported: Cannot find information for this network interface in /proc/net/dev. 26 24100:20160701:161452.798 item "10.12.29.100:net.if.out[vnet18]" became not supported: Cannot find information for this network interface in /proc/net/dev. 27 24103:20160701:161455.800 item "10.12.29.100:net.if.out[vnet14]" became not supported: Cannot find information for this network interface in /proc/net/dev. 28 24100:20160701:161456.801 item "10.12.29.100:net.if.out[vnet15]" became not supported: Cannot find information for this network interface in /proc/net/dev. 29 24103:20160701:161958.077 item "10.12.29.100:net.if.in[vnet4]" became supported 30 24101:20160701:161959.075 item "10.12.29.100:net.if.in[vnet5]" became supported 31 24102:20160701:162040.114 item "10.12.29.100:net.if.out[vnet4]" became supported 32 24101:20160701:162041.116 item "10.12.29.100:net.if.out[vnet5]" became supported
2、原理分析
首先查看“Template OS Linux ”中关于网络接口的自动发现规则，
下图中三个框分别是：
Linux服务器网络接口自动发现使用的key
Linux服务器网络接口自动发现时间间隔
Linux服务器网络接口自动发现的对象丢失后为其保留的时长
使用正则表达式过滤 zabbix_get -s 10.12.29.100 -k net.if.discovery 的结果，并将符合条件的结果赋值给 {#IFNAME} ，然后就可以监控接口 {#IFNAME} 的流量信息了，以及为接口 {#IFNAME} 的流量信息生成 Graph
接下来查看正则表达式 “@Network interfaces for discovery” 的内容，“Network interfaces for discovery”只是一组正则表达式的名字而已，其内容去下图中的位置查看
查看已有的两条规则：内容是屏蔽掉还回接口
下面分析以下 zabbix_get -s 10.12.29.100 -k net.if.discovery 的执行结果（zabbix在执行lld的时候就是调用zabbix_get 命令获取被监控服务器网卡列表的）
1 [root@zabbix-server zabbix]# zabbix_get -s 10.12.29.100 -k net.if.discovery 2 {"data":[{"{#IFNAME}":"lo"},{"{#IFNAME}":"eth0"},{"{#IFNAME}":"eth1"},{"{#IFNAME}":"eth2"},{"{#IFNAME}":"eth3"},{"{#IFNAME}":"br0"},{"{#IFNAME}":"br1"},{"{#IFNAME}":"br2"},{"{#IFNAME}":"vnet12"},{"{#IFNAME}":"vnet13"},{"{#IFNAME}":"vnet0"},{"{#IFNAME}":"vnet2"},{"{#IFNAME}":"vnet10"},{"{#IFNAME}":"vnet11"},{"{#IFNAME}":"vnet1"},{"{#IFNAME}":"vnet3"},{"{#IFNAME}":"vnet8"},{"{#IFNAME}":"vnet9"},{"{#IFNAME}":"vnet20"},{"{#IFNAME}":"vnet21"},{"{#IFNAME}":"vnet24"},{"{#IFNAME}":"vnet25"},{"{#IFNAME}":"vnet4"},{"{#IFNAME}":"vnet5"},{"{#IFNAME}":"vnet6"},{"{#IFNAME}":"vnet7"},{"{#IFNAME}":"vnet14"},{"{#IFNAME}":"vnet15"},{"{#IFNAME}":"vnet16"}]}
对返回的json稍微美化一下
1 { 2 "data": [ 3 { 4 "{#IFNAME}": "lo" 5 }, 6 { 7 "{#IFNAME}": "eth0" 8 }, 9 { 10 "{#IFNAME}": "eth1" 11 }, 12 { 13 "{#IFNAME}": "eth2" 14 }, 15 { 16 "{#IFNAME}": "eth3" 17 }, 18 { 19 "{#IFNAME}": "br0" 20 }, 21 { 22 "{#IFNAME}": "br1" 23 }, 24 { 25 "{#IFNAME}": "br2" 26 }, 27 { 28 "{#IFNAME}": "vnet12" 29 }, 30 { 31 "{#IFNAME}": "vnet13" 32 }, 33 { 34 "{#IFNAME}": "vnet0" 35 }, 36 { 37 "{#IFNAME}": "vnet2" 38 }, 39 { 40 "{#IFNAME}": "vnet10" 41 }, 42 { 43 "{#IFNAME}": "vnet11" 44 }, 45 { 46 "{#IFNAME}": "vnet1" 47 }, 48 { 49 "{#IFNAME}": "vnet3" 50 }, 51 { 52 "{#IFNAME}": "vnet8" 53 }, 54 { 55 "{#IFNAME}": "vnet9" 56 }, 57 { 58 "{#IFNAME}": "vnet20" 59 }, 60 { 61 "{#IFNAME}": "vnet21" 62 }, 63 { 64 "{#IFNAME}": "vnet24" 65 }, 66 { 67 "{#IFNAME}": "vnet25" 68 }, 69 { 70 "{#IFNAME}": "vnet4" 71 }, 72 { 73 "{#IFNAME}": "vnet5" 74 }, 75 { 76 "{#IFNAME}": "vnet6" 77 }, 78 { 79 "{#IFNAME}": "vnet7" 80 }, 81 { 82 "{#IFNAME}": "vnet14" 83 }, 84 { 85 "{#IFNAME}": "vnet15" 86 }, 87 { 88 "{#IFNAME}": "vnet16" 89 } 90 ] 91 }
zabbix通过系统中的正则表达式 “Network interfaces for discovery”对上面的结果进行过滤，符合条件的内容就会被zabbix进行监控。
3、解决方法
上面工作原理分析完了，解决起来也就不费劲了，我们只需对zabbix默认的正则表达式 “Network interfaces for discovery”添加两条规则（不监控虚机网卡接口和网桥接口），如下图所示：
为了能够确保新配置的正则表达式生效，并看到响应的效果，我们要把host（10.12.29.100）与template（Template OS Linux ）取消关联并清除历史数据。
先看一下取消关联之前host上网络接口的监控项有56个
取消关联并清除历史数据，见下图
然后重新关联模板 “Template OS Linux ”，此处截图省略，然后等待zabbix LLD 自动发现符合要求的网络接口，并开始监控，按照LLD的默认值，最多需要等候一小时（3600s）
根据我们上面获取的10.12.29.100接口信息，这里需要监控的网络接口是 eth0-eth3 的Incoming和 Outcoming ，一共8个监控项，见下图：
至此，我们的问题就解决完了
