Category: DevOps

Monitoring Apache Logs using Zabbix

Apart from monitoring server hardware and software key variable like CPU/Memory/Disk/Process, We also require monitoring of apache logs using Zabbix to monitor all from a single monitoring platform

Monitoring Apache Logs

If we are talking about monitoring, it covers the aspect

  • Either we want to get some logs like 404 requests or 500 requests
  • Or we want to get the number

Add/Create an Item in Zabbix

For this, You can create custom items

  • Login on Zabbix Server Frontend URL
  • Configuration > Template > Create Template
  • After creating a template, click on the newly created template, and under that click on Items
  • Click on create Item
  • Most of the elements are self-explanatory like Name, type, update interval, History period, Application group [optional]
  • The Key contains multiple methods, for now, we are using these two
    • logrt : used for getting logs with regular expression as here we trying to get logs for only 404 requests searching all files that end access_log
    • logrt.count : used for getting count with regular expression
logrt[/var/log/apache2/.*access.log, 404 ,,,skip] 
  • .*access.log is a regex pattern
  • second parameter is also a regex : <space>404<space>, searching status code
    • 41.90.12.31 – – [22/Feb/2022:05:01:43 +0000] “GET /apple-touch-icon-precomposed.png HTTP/1.1” 404 230
  • You can add more items, it is just required log file path, aggregator method, and regex
  • And you will get this Data under the Host graph along with other data

Check if Zabbix-Agent can access log file

Make sure, the Zabbix agent is able to read the log file, this can be ensured by executing the following command

su zabbix -s /bin/bash -c "tail /var/log/httpd/access_log"

if you are getting permission denied, please provide the permission to Zabbix user to read this directory

In case you are not getting data, Please cross-check for zabbix.log on the host, if there is any issue.

tail -f /var/log/zabbix/zabbix_agentd.log

Monitoring Web Scenario

Along with the apache logs, you can also any specific URL on a time interval validating the response and raising the alarm. It is like uptime robot where you add your URL and it pings to the URL and trigger an email in case URL is down.

  • Create a Web Scenario
  • Add basic detail like name, agent[zabbix/chorme], proxy if any
  • Add URL, params, and response validation under steps

Monitoring LAMP Application using Zabbix

A complete guide for monitoring LAMP [Linux/Apache/Mysql/PHP] application through Zabbix and setting up email notifications.

In the following section, I am going to use the following stack,

1- for Zabbix server: ubuntu20 / zabbix 5.0

2: For application [LAMP server] AMI 2 and steps are mentioned for AMI1 and ubuntu 18. Steps are a bit the same for another platform as well.

3. I am utilizing AWS for all Zabbix servers and LAMP Server

First of All, We need to set up a Zabbix server.

Setting Up Zabbix Server

As mentioned, we are using, Zabbix 5.0 on ubuntu.

https://www.zabbix.com/download?zabbix=5.0&os_distribution=ubuntu&os_version=20.04_focal&db=mysql&ws=apache

  • We are following exactly the same steps as mentioned on this page, except one part, where we need to install MySQL server because we are using the same machine to host zabbix database as well.

    wget https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_5.0-1+focal_all.deb    
    dpkg -i zabbix-release_5.0-1+focal_all.deb
    apt update
    apt install zabbix-server-mysql zabbix-frontend-php zabbix-apache-conf zabbix-agent
    apt-get install mysql-server mysql-client
    mysql -u root -p
    zcat /usr/share/doc/zabbix-server-mysql*/create.sql.gz | mysql -uzabbix -p zabbix
    vim /etc/zabbix/zabbix_server.conf
    vim etc/zabbix/apache.conf
    vim /etc/zabbix/apache.conf
    systemctl restart zabbix-server zabbix-agent apache2
    systemctl enable zabbix-server zabbix-agent apache2

Once setup is done and assuming port 80 is open on the zabbix server,

you can browser this url for the front end

http://<publicip>/zabbix

Default Credential to Login are

Admin / zabbix

Basic Flow of monitoring

  • There is a Zabbix server, which has a monitoring interface
  • There is a Zabbix agent installed and configured on the machine which requires monitoring [in our case, LAMP application], called Host
  • Create a Host configuration, just an entry with hostname and associate monitoring template
  • Attach some monitoring templates. There are a prebuilt template for Linux/apache/PHP/MySQL and many more services and you can also create
  • The template contains “items” which has a configuration for what needs to monitor
  • Item contains triggers that raise alarm on basis of the defined threshold
  • Zabbix agent [active/passive] utilized to send the data to Zabbix server on basis of these template configurations.
    • Active: where agent sends the data automatically [Prefer This to save unnecessary polling of agent]
    • Passive, Zabbix server will make a request to Zabbix agent to pull the data
  • Dashboard/Graph/Screen to monitor
  • Media to add notification

Setting Up Zabbix Agent on LAMP Server [AMI 2]

Considering the following stack of LAMP application

  • Linux: AMI 2, Apache server, php 7.4 through FPM, MySQL server

Install the agent

rpm -Uvh https://repo.zabbix.com/zabbix/5.0/rhel/7/x86_64/zabbix-agent-5.0.9-1.el7.x86_64.rpm
systemctl enable zabbix-agent.service 

install the agent and enable at boot

Edit Agent Config File

vim /etc/zabbix/zabbix_agentd.conf
  • Define Value in Server:<zabix server IP/ if the same network then private ip will work>, Used for passive monitoring
    • Server=172.31.23.126,18.116.121.251
  • Listen Port 10050
    • ListenPort=10050
  • Define value in ServerActive, for agetn active
    • ServerActive=172.31.23.126,18.116.121.251
  • Define Hostname, This value is used it uniquely identify in Zabbix server and IT SHOULD BE EXACT MATCH in Zabbix server host configuration
    • Hostname=lampserver

Restart the service,

systemctl restart zabbix-agent.service

Setting up Host Configuration in Zabbix Server

  • Login on Zabbix server URL : HTTP://<pulbicip>/zabbix
  • Under Configuration, click on Host, add the exact hostname
  • Add Ip of the host <private/public depend upon network>, the default port
  • Make sure 10051 and 10050 ports are open on the client and server for communication
  • Add template, you can import the custom template attached in the link

Once setup zabbix client will be able to sent data to server, You can check logs on zabbix client machine

tail -f /var/log/zabbix/zabbix_agentd.log

It will start monitoring linux basic like CPU/Memory/Disk etc

Setting Up Apache configuration on LAMP server

For monitoring purposes, We need to add some configurations so that Zabbix agent can send that data to Zabbix server.

  • Make sure server info module is enabled
    • >>> httpd -M

Once the module is enabled, add the following line in httpd.conf [/eth/httpd/conf/httpd.conf]

<Location /server-info>
SetHandler server-info
Order Deny,Allow
Deny from all
Allow from localhost
</Location>

restart the apache server

service httpd restart

test this from the command line,

curl http://localhost/server-info

It should provide server information. Once this is done, you can monitor the host and graphs, and you will be getting up detail about the apache server

You Can Monitor

  • apache load, worker status, process, etc
  • monitor long request or time taking request

Setting Up PHP-FPM for monitoring

To monitor php-fpm process , You need to modify two file,

  • edit php-fpm config from the file vim /etc/php-fpm.d/www.conf
  • uncomment folloowing
    • pm.status_path = /status
    • ping.path = /ping
    • ping.response = pong
  • Edit httpd conf file [/etc/httpd/conf/httpd.conf] and add the following code
<LocationMatch "/status">
    SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost/status"
  Allow from localhost 
</LocationMatch>

<LocationMatch "/ping">
   c
  Allow from localhost 
</LocationMatch>

note : Just check php-fpm path is same for you

For php 5.6, there may be change in name of php-fpm process, like
SetHandler “proxy:unix:/run/php5.6-fpm/www.sock|fcgi://localhost/status”

You Can Monitor

  • PHP-fpm load, process, etc
  • monitor long request or time taking request

Making Changes so that Apache access logs can be monitored

In my custom template, I have added a few custom items to monitor the number of 404 status code requests, 500 status code requests, and 404 logs

  • You will get this Data under the Host graph along with other data

Make sure, the Zabbix agent is able to read the log file, this can be ensured by executing the following command

su zabbix -s /bin/bash -c "tail /var/log/httpd/access_log"

if you are getting permission denied, please provide the permission to Zabbix users to read this directory.

Setting Up Zabbix Agent on AMI 1

Install the agent

rpm -Uvh https://repo.zabbix.com/zabbix/5.0/rhel/6/x86_64/zabbix-agent-5.0.9-1.el6.x86_64.rpm
chkconfig zabbix-agent on

Rest of the steps are same.

Setting Up Zabbix Agent on Ubuntu

Install the agent

wget https://repo.zabbix.com/zabbix/5.0/ubuntu/pool/main/z/zabbix/zabbix-agent_5.0.9-1%2Bbionic_amd64.deb
dpkg -i zabbix-agent_5.0.9-1+Bbionic_amd64.deb

install the agent and enable it at boot

Although Process is the same except there are changes in file location, as,

  • the apache config file will be located at /etc/apache2/apache.conf
  • In template item we are accessing apache logs, the location will be changed in case of ubuntu [/var/log/apach2/]

Adding Email Notification

  • Login on web interface of zabbix server http://<publicip>/zabbix
  • Click on administartion > media > Email [html]
  • Add SMTP configuration [if aws, you cand use AWS SES service]
  • Click on test to test the configuration
  • Click on User under Administration > Users
  • Click on media > add media > select email and enter email id

Monitoring Apache Logs using Zabbix

Apart from monitoring server hardware and software key variable like CPU/Memory/Disk/Process, We also require monitoring of apache logs using Zabbix to monitor all from a…
Read More