A_Complete_Log_Infrastructure_with_Zabbix_Alerting.pdf

《A_Complete_Log_Infrastructure_with_Zabbix_Alerting.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、Loginfrastructure&ZabbixloggingtoolsintegrationAboutmeMeLinuxSystemArchitect@ICTRAfromBelgium(...)IT :Linux&SysAdminwork,Security,ICTRAICTforRailforTransport–Mobility–Security1800ITProfessionals–engineers-techniciansFacts :5.500KMfibreoptic

2、3maindatacenters,alotof'technical'locations2.600camera'sin51majorrailwaystations...2ICTRA,ICTforRailTicketingsolutionsInformationsystemsTraininfoinrealtimeICTnetworkManagementcomputerhardwareNMBSGroupFleetmanagementsystemGSMforRailIntegratedsecurity

3、solutionsMonitoringoftrains3OurzabbixinstallationUsedbydifferentteamsLinuxteam→useofautomation(Puppet)Solaristeam→heaveuseofscriptsandAPITrainannouncementsystemteam1masterserverinactive-slave(Pacemaker)proxiesMySQLmaster-slavecluster(differents

4、tory...)withMasterHA4Whydowelog?Goallegalreasonscentralstorageanalysismetricssecurity(compliance)anomalyandfaultdetection→monitoringRequirementsaveragenumberofevents/second,peakloadresiliencyagainstcrackingattemptsneeded?central/de-central?

5、remotelocations?searchperformance5Typicalreasons(SANS)Detect/PreventUnauthorizedAccessandinsiderAbuseMeetRegulatoryRequirementForensicAnalysisandCorrelationEnsureRegulatoryComplianceTrackSuspiciousBehaviorITTroubleshootingandNetworkOperationM

6、onitorUserActivityBestPractices/FrameworkssuchasCOBIT,ISO,ITIL,etc.DeliverReportstoDepartmentsMeasureApplicationPerformanceAchieveROIorCostReductioninSystemMaintenance6WheredoesZabbixfitin?ZabbixperfectformonitoringresourcesgoodinalertingZabbi

7、xisNOTaimedatanalyzingahugeamountoflogfilestransformationoflogfilesstoringlogfilesOthertoolsareperfectforgathering,transformationandanalysisAndcanuseZabbixforalertingwhenconditionx,x,zhappens7Although...duetopopulardemand,filecontentandlogfilepa

8、rsinghasbeenaddedinZabbix2.2changesforvfs.file.regexp[]vfs.file.regmatch[]log[]andlogrt[]cannowreturnapartofastringorapart–'aninterestingnumber'usingregexpsubgroupsReadthezabbixblogpostbyRichard:-)8PartsavailableZabbixAnd...zabbix-se