Zabbix: Add process monitoring template (replaces rsyslog-only template)

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>

roles/base/files/rsyslog/zabbix-template.yml

@@ -1,35 +0,0 @@
-zabbix_export:
-  version: '7.0'
-  template_groups:
-    - uuid: 372f19ba622745aaa43b4fa0b5168262
-      name: Fedora
-  templates:
-    - uuid: cb1afd4cd71f49beae04347d027ff07b
-      template: 'Rsyslogd Processes'
-      name: 'Rsyslogd Processes'
-      groups:
-        - name: Fedora
-      items:
-        - uuid: 77b90f572e144092abbd08e29fb65dbb
-          name: 'Rsyslogd processes'
-          type: ZABBIX_ACTIVE
-          key: 'proc.num[,,,.*rsyslogd.*]'
-          tags:
-            - tag: rsyslogd
-              value: processes
-          triggers:
-            - uuid: 438b237bba7c42bab565b352c5fe26a2
-              expression: 'last(/Rsyslogd Processes/proc.num[,,,.*rsyslogd.*])=0'
-              name: 'Rsyslogd: no processes running'
-              opdata: '{ITEM.LASTVALUE1} processes'
-              priority: HIGH
-              tags:
-                - tag: rsyslogd
-                  value: down
-            - uuid: 375b16d0994d45acb22cb47e97d90fac
-              expression: 'last(/Rsyslogd Processes/proc.num[,,,.*rsyslogd.*])>2'
-              name: 'Rsyslogd: too many processes'
-              opdata: '{ITEM.LASTVALUE1} processes'
-              priority: HIGH
-      tags:
-        - tag: rsyslogd

roles/base/files/zabbix/processes-template.yml

@@ -0,0 +1,114 @@
+zabbix_export:
+  version: '7.0'
+  template_groups:
+    - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec
+      name: Fedora
+  templates:
+    - uuid: 2964a31c32a44bc286b60e83b53822e8
+      template: 'Global Process Monitors'
+      name: 'Global Process Monitors'
+      groups:
+        - name: Fedora
+      items:
+        - uuid: 15dd48ce61d54c29a05241178e8a6458
+          name: 'Crond processes'
+          type: ZABBIX_ACTIVE
+          key: 'proc.num[,,,.*crond.*]'
+          tags:
+            - tag: processes
+              value: crond
+          triggers:
+            - uuid: 94e23eec93124ecd86a0eb51daed1628
+              expression: 'last(/Global Process Monitors/proc.num[,,,.*crond.*])<>1'
+              name: 'Crond: no processes running'
+              opdata: '{ITEM.LASTVALUE1} cronds'
+              priority: HIGH
+              tags:
+                - tag: component
+                  value: health
+                - tag: scope
+                  value: processes
+        - uuid: 806ac7b74eb448d99835ebb55a38fd23
+          name: 'Rsyslogd processes'
+          type: ZABBIX_ACTIVE
+          key: 'proc.num[,,,.*rsyslogd.*]'
+          tags:
+            - tag: processes
+              value: rsyslog
+          triggers:
+            - uuid: f37e4c2a2e3d437781176ec43b8c17cc
+              expression: 'last(/Global Process Monitors/proc.num[,,,.*rsyslogd.*])=0'
+              name: 'Rsyslogd: no processes running'
+              opdata: '{ITEM.LASTVALUE1} rsyslogds'
+              priority: HIGH
+              tags:
+                - tag: component
+                  value: health
+                - tag: scope
+                  value: processes
+            - uuid: 9162c99cf1c54bf7a3a179b6bc292b82
+              expression: 'last(/Global Process Monitors/proc.num[,,,.*rsyslogd.*])>2'
+              name: 'Rsyslogd: too many processes'
+              opdata: '{ITEM.LASTVALUE1} rsyslogds'
+              priority: AVERAGE
+              tags:
+                - tag: component
+                  value: health
+                - tag: scope
+                  value: processes
+        - uuid: ae7d2f0e3c0146578f9b4ea72cba26ab
+          name: 'Total processes'
+          type: ZABBIX_ACTIVE
+          key: 'proc.num[,,all]'
+          tags:
+            - tag: processes
+              value: total
+          triggers:
+            - uuid: 41504716c94341648e001386450bbb9e
+              expression: 'last(/Global Process Monitors/proc.num[,,all])>{$PROCESSES.TOTAL.MAX}'
+              name: 'Total processes - {ITEM.LASTVALUE1} procs > {$PROCESSES.TOTAL.MAX}'
+              opdata: '{ITEM.LASTVALUE1} processes'
+              priority: HIGH
+              tags:
+                - tag: component
+                  value: health
+                - tag: scope
+                  value: processes
+        - uuid: 3f7e135aa52044be80e2d4020803655e
+          name: 'Zombie processes'
+          type: ZABBIX_ACTIVE
+          key: 'proc.num[,,zomb]'
+          tags:
+            - tag: processes
+              value: zombie
+          triggers:
+            - uuid: 62f629934bd54d0ab60cacdcca78b847
+              expression: 'last(/Global Process Monitors/proc.num[,,zomb])>{$PROCESSES.ZOMBIE.MAX}'
+              name: 'Zombie Processes - {ITEM.LASTVALUE1} procs > {$PROCESSES.ZOMBIE.MAX}'
+              opdata: '{ITEM.LASTVALUE1} zombies'
+              priority: AVERAGE
+              tags:
+                - tag: component
+                  value: health
+                - tag: scope
+                  value: processes
+            - uuid: 830903fa5a6747deaf95c6b56b9fb130
+              expression: 'last(/Global Process Monitors/proc.num[,,zomb])>{$PROCESSES.ZOMBIE.WARN}'
+              name: 'Zombie Processes - {ITEM.LASTVALUE1} procs > {$PROCESSES.ZOMBIE.WARN}'
+              opdata: '{ITEM.LASTVALUE1} zombies'
+              priority: WARNING
+              tags:
+                - tag: component
+                  value: health
+                - tag: scope
+                  value: processes
+      macros:
+        - macro: '{$PROCESSES.TOTAL.MAX}'
+          value: '12000'
+          description: 'maximum total processes'
+        - macro: '{$PROCESSES.ZOMBIE.MAX}'
+          value: '10'
+          description: 'maximum zombie processes'
+        - macro: '{$PROCESSES.ZOMBIE.WARN}'
+          value: '5'
+          description: 'warning threshiold for zombie processes'

roles/base/tasks/main.yml

@@ -511,13 +511,6 @@
   - config
   - rsyslog-audit
 
-- name: Configure Rsyslogd monitoring in Zabbix
-  ansible.builtin.include_tasks: rsyslogd-monitoring.yml
-  tags:
-    - rsyslogd
-    - zabbix_api
-  when: not inventory_hostname.startswith('logdetective')
-
 # Custom selinux policy to allow unix_chkpwd to map PAM database
 - name: Copy over our custom selinux module
   ansible.builtin.copy: src=selinux/mapchkpwd.pp dest=/usr/local/share/mapchkpwd.pp
@@ -687,6 +680,16 @@
   - config
   - base
 
+# Monitor rsyslogd, crond, total & zombie processes
+- name: Configure process monitoring in Zabbix
+  ansible.builtin.include_tasks: process-monitoring.yml
+  tags:
+    - crond
+    - processes
+    - rsyslogd
+    - zabbix_api
+  when: not inventory_hostname.startswith('logdetective')
+
 # This uses LLD discovery on md devices, and is a no-op if none are
 # found, so it should be safe to put everywhere, just in case.
 - name: Configure MD Raid monitoring in Zabbix

roles/base/tasks/process-monitoring.yml

@@ -9,20 +9,17 @@
     ansible_host: "{{ zabbix_server }}"
     ansible_zabbix_url_path: "{{ zabbix_url_path }}"
   tags:
+    - crond
+    - processes
+    - rsyslogd
     - zabbix_api
   block:
-    - name: Import Rsyslogd template file
+    - name: Import Process Monitoring template file
       community.zabbix.zabbix_template:
-        template_yaml: "{{ lookup('file', 'rsyslog/zabbix-template.yml') }}"
+        template_yaml: "{{ lookup('file', 'zabbix/processes-template.yml') }}"
         state: present
-    - name: Ensure Rsyslogd hostgroup is present
-      community.zabbix.zabbix_group:
-        host_groups:
-          - Rsyslogd servers
-        state: present
-    - name: Add self to Rsyslogd in Zabbix
+    - name: Add self to Process Monitoring in Zabbix
       community.zabbix.zabbix_host:
         host_name: "{{ inventory_hostname }}"
-        host_groups: Rsyslogd servers
-        link_templates: Rsyslogd Processes
+        link_templates: Global Process Monitors
         force: false