[ZBX-2651] Eventlog processing on Agent side. Serious experiments about performance and sequence sending. Created: 2010 Jul 05 Updated: 2017 May 30 Resolved: 2015 Feb 08 |
|
Status: | Closed |
Project: | ZABBIX BUGS AND ISSUES |
Component/s: | Agent (G) |
Affects Version/s: | 1.8.2 |
Fix Version/s: | None |
Type: | Incident report | Priority: | Major |
Reporter: | Oleksii Zagorskyi | Assignee: | Unassigned |
Resolution: | Won't fix | Votes: | 5 |
Labels: | eventlog, logmonitoring | ||
Remaining Estimate: | Not Specified | ||
Time Spent: | Not Specified | ||
Original Estimate: | Not Specified |
Attachments: | Create_Customized_Alarm_Eventlog.rar Eventlog processing on Agent side (RU version).txt One_Item_ID444_or_555.png Two_Item_ID444+555.png processor_load_differenses.png |
Description |
I spent a few very accurate and serious experiments with processing Windows Eventlog. Then, using the bat file, I filled the event log. As a result, the eventlog has 100200 events in a clear sequence of a particular algorithm. (the eventlog was filled with 18 minutes 2010.Jun.28 22:26:20 FireSRC Information 555 100000 range END. Text for ALARM with ID 555 The basic principle - through every thousand ordinary event (EventID 333) are repeated several distinctive events (EventID 444,555) which we will filter on the Zabbix-agent side. Bat file and reg file, you can take from the attached file. Then I created a few different keys and made experiments. Immediately, I note that if the agent cofig define DebugLevel = 4, then the speed of processing eventlog catastrophic falls, so the speed need to check without the debug level! All parameters of the agent, which may affect performance - defaulted, but one exception MaxLinesPerSecond = 1000. This is done to better express the difference in the speed of the agent works. All Items have attribute Update interval (in sec)=1. Thus, first experiment: two Items with keys: Second experiment: single Item with key: That is significantly faster than in the previous example. This processor is Core2Duo 3.0Ghz load also smaller (see picture "processor_load_differenses.png") Another dimension - the sequence of construction and sending events by agent. As you can see in the picture "Two_Item_ID444+555.png" events were generated and transmitted to the server is not in the same sequence as they were created on the Windows Host. They are generated as the agent read them (two different Items) and transmit to the server. This is not quite right !!! It is suggested that the idea: to make that - when the agent asks and receives from the server the list of active checks, it groups the entire Items for each Eventlog in separate groups and when parsing of the eventlog will process new event through the elements in this group in a single pass !!! Thus will be fulfilled the real sequence of events from the agent side within each unique journal!. Also on the idea will be improved performance. Example realistic Items for single Windows Host: I also want to prove that in the real environment may be situations where I described the remark is relevant. Although the experiment was made for the Item key eventlog[], but all told, probably true, also for keys log[] and logrt[]. Sorry for my English (original Russian text attached) |
Comments |
Comment by Anthony [ 2010 Jul 06 ] |
Присоединяюсь к предыдущему оратору: прошу рассмотреть вопрос об усилении модуля мониторинга Windows-логов. Спасибо за внимание. |
Comment by Alexander Vladishev [ 2015 Feb 08 ] |
Mass of improvements with log-monitoring was introduced in latest versions of Zabbix. Please try it! I close the issue. |
Comment by Oleksii Zagorskyi [ 2015 Feb 08 ] |
An idea I described here is actually closer to ZBXNEXT project. Meanwhile I don't have objections to close current issue |