Zabbixで過去のデータを突っ込んでグラフをバッチ作成できるだろうか?
試しにApacheのアクセスログを解析してGET、POST、その他のアクセス件数をグラフ化してみた。
zabbix_senderコマンドにはタイムスタンプつきでデータを渡せるようにするオプションがあるようだ。
-i, --input-file <inputfile> Load values from input file. Specify - for standard input. Each line of file contains space delimited: <hostname> <key> <value>. -T --with-timestamps Each line of file contains space delimited: <hostname> <key> <timestamp> <value>. This can be used with --input-file option.
こういう形のデータを作ればいいと。
# perl access_log_to_zabbix_sender.pl TESTSITE sample_access_log | head TESTSITE http.count.other 1282316400 0 TESTSITE http.count.post 1282316400 2 TESTSITE http.count.get 1282316400 5.7 TESTSITE http.count.other 1282317000 0.3 TESTSITE http.count.post 1282317000 0.9 TESTSITE http.count.get 1282317000 5.2 TESTSITE http.count.other 1282317600 0.1 TESTSITE http.count.post 1282317600 1.7 TESTSITE http.count.get 1282317600 5.7 TESTSITE http.count.other 1282318200 0.3
zabbix_senderに喰わせてみる
# perl access_log_to_zabbix_sender.pl TESTSITE sample_access_log | zabbix_sender -c /etc/zabbix/zabbix_agentd.conf --input-file - --with-timestamps Info from server: "Processed 250 Failed 0 Total 250 Seconds spent 0.002968" Info from server: "Processed 182 Failed 0 Total 182 Seconds spent 0.002128" sent: 432; skipped: 0; total: 432
細かい設定
- テキトウにホストを作成する(今回はTESTSITEって名前で、あとはデフォルト)
- アイテム設定
- グラフ設定
- ログ解析スクリプトのソース
#!/usr/bin/perl use strict; use warnings; use Time::Local; use Data::Dumper; #LogFormat: 10.0.0.1 - - [30/Aug/2010:00:00:00 +0900] "GET / HTTP/1.1" 200 1024 my $INTERVAL = 10; # interval minutes my %str2month = ( Jan=>1, Feb=>2, Mar=>3, Apr=>4, May=>5, Jun=>6, Jul=>7, Aug=>8, Sep=>9, Oct=>10, Nov=>11, Dec=>12 ); my %item_key = ( GET => "http.count.get", POST => "http.count.post", OTHER => "http.count.other" ); @ARGV >= 1 or die "usage: $0 <host> <access_log> ..."; my $host = shift; my %count; while(<>){ my ($mday, $mon, $year, $hour, $min, $method) = m{\[(\d+)/(\w+)/(\d+):(\d+):(\d+):\d+ \S+\] "(\S+)}; my $time = timelocal(0, $min - $min % $INTERVAL, $hour, $mday, $str2month{$mon}-1, $year-1900); $count{$time} ||= {GET=>0, POST=>0, OTHER=>0}; $method = "OTHER" if($method ne "GET" and $method ne "POST"); $count{$time}->{$method}++; } #warn Dumper(\%count); for my $time (sort {$a <=> $b} keys %count){ while(my ($method, $key) = each(%item_key)){ my $rps = $count{$time}->{$method} / ($INTERVAL * 60); print "$host $key $time $rps\n"; } }
テキトウでごめんなさいね。
※過去分をzabbix_senderで突っ込んだあと、アイテムタイプを「Zabbixトラッパー」から普通のエージェント監視に切り替えられるのかは未検証。データ型が変わらなければ変更できるらしい