Sophos Zabbix



Overview

When we switch sophos off, like we did over the weekend, the server was fine and didn;t send out a flood of zabbix alerts. Upon turning Sophos back on we are seeing the same regular issues. I have setup a cron job to kill mtdd every 6 hours as well. The current version of the Sophos UTM template for Zabbix is quite straight forward and is based on the knowledgebase article 119371 in which usefull SNMP OID’s can be found. Currently the template consists of: 2 Applications (Network, 37 items &. Template to monitor the configuration of Sophos UTM v.9.6 by Zabbix 4.0. Disclaimer: This is 0.1apha version of template and script. This isn't an official template by Sophos Company or Zabbix SIA. Tested against Sophos v9.6 with 1.3 release of API engine. Tested on Zabbix.

The article show how to configure MySQL Monitoring on Zabbix. The system consists of Zabbix Server installed on CentOS and MySQL installed on Ubuntu Server

How to configure

Configure on Ubuntu Server (MySQL)

  • Create user monitoring to manage MySQL
Zabbix sophos sg
2
4
6
8
10
12
14
16
18
20
# For all the following commands HOME should be set to the directory that has .my.cnf file with password information.
# Flexible parameter to grab global variables. On the frontend side, use keys like mysql.status[Com_insert].
UserParameter=mysql.status[*],echo'show global status where Variable_name='$1';'|HOME=/etc/zabbix mysql-N|awk'{print $$2}'
# Flexible parameter to determine database or table size. On the frontend side, use keys like mysql.size[zabbix,history,data].
# Key syntax is mysql.size[<database>,<table>,<type>].
# Database may be a database name or 'all'. Default is 'all'.
# Table may be a table name or 'all'. Default is 'all'.
# Type may be 'data', 'index', 'free' or 'both'. Both is a sum of data and index. Default is 'both'.
# Database is mandatory if a table is specified. Type may be specified always.
# 'sum' on data_length or index_length alone needed when we are getting this information for whole database instead of a single table
UserParameter=mysql.size[*],echo'select sum($(case '$3' in both|'') echo 'data_length+index_length';; data|index) echo '$3_length';; free) echo 'data_free';; esac)) from information_schema.tables$([[$
UserParameter=mysql.ping,HOME=/etc/zabbix mysqladmin ping | grep -c alive
UserParameter=mysql.uptime,HOME=/etc/zabbix mysqladmin status | cut -f2 -d ':' | cut -f1 -d 'T' | tr -d ''
UserParameter=mysql.threads,HOME=/etc/zabbix mysqladmin status | cut -f3 -d ':' | cut -f1 -d 'Q' | tr -d ''
UserParameter=mysql.questions,HOME=/etc/zabbix mysqladmin status | cut -f4 -d ':'|cut -f1 -d 'S' | tr -d ''
UserParameter=mysql.slowqueries,HOME=/etc/zabbix mysqladmin status | cut -f5 -d ':' | cut -f1 -d 'O' | tr -d ''
UserParameter=mysql.qps,HOME=/etc/zabbix mysqladmin status | cut -f9 -d ':' | tr -d ''
  • Restart zabbix-agent service

systemctl restart zabbix-agent

Configure on web interface Zabbix Server

  • Create host on Zabbix Server
  • Choose template Template DB MySQL
  • Check that the MySQL monitoring service on zabbix is ​​working

Overview

The article is tutorial that configures DELL server parameters monitoring tools via iDRAC using SNMP protocol on Zabbix

Diagram

The article is configured according to the following diagram:

How to configure

Configure on DELL Server

Zabbix
  • Login to DELL Server iDRAC
  • On iDRAC Settings -> Choose Network -> Choose Services -> On SNMP Community Name: Enter key connection between Zabbix server and DELL server

Zabbix Sophos Xg Firewall

Configure on Zabbix Server

  • Install tool on Zabbix Server and check Zabbix Server is retrieving the server data

yum install net-snmp net-snmp-utils -y
snmpwalk -v2c -c public 172.16.4.151

Zabbix Sophos Snmp

  • Access web interface of Zabbix Server
  • On Configuration -> Click Hosts -> Click Create host
  • In Host name: Enter hostname
  • In Groups: Choose Linux servers
  • In SNMP Interfaces: Enter IP of DELL Server
  • In Templates -> Choose Template OS Linux SNMPv2 -> Click Add
  • On Macros -> Enter {$SNMP_COMMUNITY} => public (public is key on iDRAC)
  • Add host successfully and check the result