Tired of Nagios and Cacti? Try Zabbix.

One of my professional duties in my past ten years was monitoring systems. Even my diploma thesis was dedicated to distributed monitoring (altough my professor sucked badly ). Apart from a few custom-programmed scripts to analyze special situations (e.g. proxy clusters) I used tools that fellow administrators will find familiar: Nagios and Cacti. And another less famous text-configuration-based monitoring tool called Cricket.  That worked well somehow but Cricket was hard to learn for my coworkers and Cacti seems unreliable and fundamentally broken in terms of SNMP checking. Besides why do I have to set up availability checking in Nagios and set up checking of the same parameters in another software to draw graphs? Then in 2009 I came across an open-source software I hadn’t heard of before: Zabbix. And although it has a few rough edges it seems way more professional than other common tools (the commercial tools I saw were even worse than the open-source variants). I tried it and after a lot of reading and trying it looks like it has a good potential to replace Nagios and Cacti. So I thought I’d sum up my personal experiences with all of these tools.

Nagios. Their makers claim that it’s the “industry-standard in IT infrastructure monitoring“. Honestly it’s a great tool but considering how many years it has been existing it barely evolved.  During my diploma thesis in the year 2000 I wrote an alternative software that I called “MrNetwork” that dealt with flaws that Nagios hasn’t even fixed today. Still Nagios is a tool I have used for many years and it is very reliable.Nagios service detail screen Advantages:

  • open source
  • large community
  • many powerful plugins (and own plugins are easy to create: just write a program that prints a one-line string and set a certain return code)
  • easy-to-use web frontend
  • debugging plugins is moderately simple.
  • many thought-out features like host groups or notification options that make your life easier
  • dependencies (so that you don’t get 100 alerts if a router between the Nagios server and other servers went down)
  • nagvis plugin with a great interactive editor that draws nice management-suitable graphs (although I found the ndo2db interface hard to set up at first and a little flaky)

Annoyances:

  • The focus is on availability checking – you don’t get fancy graphs on the values that are monitored (e.g how the CPU load was over time). So you’ll need a second tool and set up the same checks there just to get graphs. But availability percentages are computed automatically.
  • Textual configuration that has so many different settings that you need to look up the parameters often. A web-based configuration would probably be better (and is available as an add-on but I haven’t tested it).
  • Third-party plugins are often very badly programmed and barely documented that it appeared easier to reinvent the wheel. (“Look, ma, I can has plugins.”)
  • Some views on the web interface are not very obvious (e.g. clicking on the title of a host group gives a nice view of all hosts with all services).
  • Many plugins don’t have corresponding configuration entries so you have to find out how they work and write configuration entries yourself (and those which are preconfigured take some archeology to find out which parameters they expect). This is a huge time-waster for beginners. And in your services configuration you have to verify your checks configuration to understand the meaning of each parameter. Or do you remember what “check_http 80!john!doe!10!30!body” is supposed to check?
  • Every  set of parameters of a certain plugin requires a distinct configuration entry. The plugins have dozens of configuration switches that you may need one day. Want to set a timeout on HTTP checks? Write another check configuration. Want to check for a certain string in the HTTP response? Write another check configuration. And so on.
  • Most checks are run from the Nagios server itself (the NRPE plugin to do the checks on the respective remote systems somehow refused to work properly here) which is suboptimal and puts a lot of load on the server.
  • By default every alert triggers a notification. So if you can’t define proper dependencies (e.g. if you want to check your web server in all 30 supported languages and there is some logical error) then you will get spammed with alerts.

Cricket. As Nagios does not support plotting graphs of the monitored values I was in need of another piece of software. Basically Cricket is a frontend to RRD (which stores data in a rotating/round-robin file that keeps data of the last X minutes/hours/days). It has a textual configuration that takes a lot of getting used to. It’s main principle is inheritance of settings – they call it “configuration tree“. Which means you have a master DEFAULTS file that contains general settings like how to query SNMP. In a subdirectory you define a certain class of devices that you want to monitor – e.g. routers (the DEFAULTS are inherited to this level). Within the routers directory you can just define a list of routers you want to monitor. All settings are inherited from “above” (parent directories). It’s more a geek tool for shell lovers. Cricket screenshotAdvantages:

  • very quick to monitor a large set of similar devices once the general device class is defined
  • simple web interface
  • very reliable
  • can monitor SNMP values (it does this very well) or execute external scripts – thus can be easily extended
  • flexible graphing – you can sum up values of two graphs into a new graph (aka “mtargets” – multiple targets)
  • different check frequencies can be configured for different subtrees through cron (by default values are collected every 5 minutes – this can be set as low as one minute if needed)

Annoyances:

  • the textual configuration is error-prone (leading to funny Perl errors that can be hard to debug)
  • users may expect to see all parameters of a certain device instead of all devices having a certain parameters (“Give me the statistics of router42” instead of “Let’s see the temperature of all routers we have.”)
  • customizing the graphs (drawn by RRD tool) isn’t trivial
  • Frequency of checks is by default 5 minutes. Before RRD can draw the first value of a graph it needs three values. So you’ll be waiting 15 minutes before you see any results.
  • RRD rounds data by default. So the yearly graph doesn’t show the peaks that the daily graphs do. (This can be fixed by not graphing the average values but the maximum values.) Long-time archiving of graphed data is not possible without throwing away the RRD files and manually customizing them. Changing the monitoring frequency (aka “heartbeat”) is not possible either without throwing away the data and starting from scratch either.
  • No proper built-in alerting in case certain thresholds are exceeded.

Cacti. Another frontend to RRD – and a pretty sophisticated one. Nearly everything is configured through its web interface. And the result is beautiful. It’s not entirely reliable though and SNMP support (at least in version 0.8.7b) is a big fail. I like Cacti because its user interface is much better than Cactis but it’s less reliable and flexible. Cacti screenshotAdvantages:

  • Beautiful and (for most features) simple web interface. Nice features like graphs that can be zoomed using Javascript.
  • Fine-grained permissions system. So a certain user may get read-only access to a certain subtree.
  • The tree where graphs are placed can be configured freely so you get exactly the view you want.

Disadvantages:

  • Doesn’t hide the RRD magic very well. The user is easily confused by templates, data sources and the like.
  • Graphing sometimes just stops working for no reason or values are missing although the server isn’t overloaded and other software doesn’t show such outages. According to a quick search on the lazyweb I’m not the only one with such effects.
  • Setting up many systems means a lot of clicking in the web interface. Setting up new kinds of checks (aka “templates”) means even more clicking and is very error-prone.
  • The quality of some third-party templates I tested was pretty bad. Creating new templates is tedious, error-prone, frustrating and close to black magic. Nothing for the casual user at least.
  • Doesn’t handle SNMP correctly (this is the biggest fail in my opinion and makes it unusable here). Although it knows how to query indexes (e.g. ifDescr to get the names of your network interfaces) it just seems to stored fixed OIDs. So once the SNMP tables change the order or number of items (which isn’t unusual) then suddenly other parameters get graphed.
  • Frequency of checks is by default 5 minutes. Increasing the frequency leads to missing data and wrong results.
  • As it uses RRD and needs 3 valid values you won’t see that your monitoring fails until you wait 3×5=15 minutes. Not suitable for impatient non-smokers like me. 🙂
  • Debugging failed checks is close to impossible. If a check fails then I find myself clicking around randomly trying to find typos because the alternative is digging around in database entries.
  • The web interface is sometimes confusing. A refresh of SNMP tables is done by clicking a unmeaning green circle icon. Adding new items to a list is done by clicking an inconspicious “Add” link that doesn’t even look like a link.
  • Another UI confusion: graphs are created from the “devices” view. But they are deleted from the “graph management” view.
  • No alerting in case certain thresholds are exceeded. Another tool like Nagios would still be needed to notify you.
  • Can’t sum up multiple targets so monitoring failover clusters doesn’t work well.
  • RRD averages data when putting daily values into weekly values, weekly into monthly and monthly into yearly. So the yearly graph doesn’t show the peaks that the daily graphs do. (This can be fixed by not graphing the average values but the maximum values.) Long-time archiving of detailed graphed data is not possible (RRD). Changing the monitoring frequency (aka “heartbeat”) is not possible either without throwing away the data and startin from scratch.

Zenoss. People pointed me to Zenoss which is supposed to offer the same functionality as other monitoring systems but is much more integrated. So this short list is more a quick one-day-experimental expression than a thorough analysis. But in the end much of the fuss is just marketing. Advantages:

  • Beautiful web interface
  • Nice gimmicks like google maps integration to show you where your servers are down worldwide. Only makes sense when monitoring networks with several/many remote locations.
  • Can partly discover parameters of systems automatically. That works for static routes (although I wonder why the heck I want to monitor static routes), file systems and network interfaces. On the other hand processes can’t be discovered automatically and have to be set up manually.
  • Does not come with a specific agent but plays rather well with plain old SNMP.
  • Can monitor Windows through native WMI.
  • Large fanbase.

Annoyances:

  • Web interface feels slow (Zope is bloated)
  • Opaque operation. It does not tell what’s actually going on. You can add monitoring and check back later if anything worked they way you want.
  • Questionable reliability. In a test here I was monitoring a running process. The process was said to be down and suddenly went to “up” after a while although nothing had changed on the system.
  • Just one dashboard. Several dashboards similar to Zabbix “screens” would be nice.
  • Configuration and data is spread across MySQL, the internal Zope database storage and RRD files on disk.
  • The dependency graph is a nice Flash-based applet displaying how the systems are connected. But it does not show any details about the systems aside from whether they are up or down. And clicking on a host does not take you anywhere but center on the system. Beautiful but it could do so much more than just look beautiful.
  • I dislike the way that things are configured. The context menu with the “down arrow” needs to be used. I’d prefer simple “add” or “delete” actions instead of navigating the menu all the time. Looks like Javascript is used wrongly here.
  • Limited open-source version. Full version needs to be paid for.

Zabbix (1.8.2). I’m using the backported Zabbix 1.8.2 on Debian Lenny here. Debian Lenny’s native 1.4 version lacked some interesting features like proper SNMP handling. Zabbix seems close to the perfect monitoring system I had always dreamt of. I would have designed it differently in some aspects though.

Advantages:

  • Availability Monitoring (like Nagios) and graphing (like Cacti) is combined into one tool.
  • Highly configurable. User John may just get an SMS for problems of high severity during the weekend and on weekdays get a Jabber message. Even automatic actions like restarting services can be set up.
  • The notifications actually help the person who gets the message. “Low disk space on /var on web5” with an additional comment is pretty helpful even when sent via SMS. Notifications are completely customizable with macro variables.
  • Very performant. A Zabbix agent can be installed on the systems (available for several operating systems – even for Windows) which gathers the information on each system efficiently. The agent can even call scripts or shell one-liners to gather information. This kind of data collection is very efficient. You will need a server with a good I/O performance and a lot of RAM though so that the database can work efficiently. At first I virtualized Zabbix on a Debian server on a VmWare server with 1 GB of RAM. The database access became so slow that showing graphs or recent events made me store at a busy mouse cursor for up to a minute. On a server with 4 GB of RAM, a large MySQL key buffer and SAS disks the system runs well again.
  • Collecting items (gather information about system parameters) happens at set intervals. You don’t have to wait for several minutes until you see results (it usually takes half a minute). Each item can have a custom check interval. So you can check for the CPU load every 30 seconds but check the number of free inodes on /home just once an hour.
  • Fast web interface.
  • Sophisticated monitoring of web sites. Zabbix can follow a path of simulated mouse clicks on a web site and check for functionality and response time.
  • Real-time graphs. Values are by default collected every 30 seconds. You quickly see where you are going.
  • Permissions system. Certain users can be limited to certain views.
  • Gathered data is stored in a database (MySQL, PostgreSQL, SQLite) instead of an unflexible RRD file. Storage periods (aka “history”) can be configured freely. Backing up the database is all there is to be done.
  • Templates (that can even link to further templates) save time in setting up many checks.
  • Graphs (plots of values over time) can be customized like which items are plotted and in what way. Even pie charts are possible.
  • Even the parameters that don’t get an explicit graph can be graphed at any time. E.g. the agent has tracked the CPU load on a system that you never cared about then you can graph that with one mouse-click.
  • Screens and slide shows can be used for high-level views (aka “dashboards”) or to be displayed on a big geeky display. They can combine textual display of the status as well as clocks, ad-hoc graphs or predefined graphs.
  • Very flexible trigger expressions. For example you can tell a trigger to fire if the average system load over the last 15 minutes is above a certain value. As all measured parameters are stored in a backend database you can use all kinds of mathemical expressions. Like firing a trigger if the average number of running processes during the last half hour is above 50. All other software I tested just has access to the last value gathered.
  • Alerting/notifications can be scripted easily by using shell scripts.
  • Remote monitoring made easy by using a Zabbix proxy.
  • Paid support and paid custom programming available. But the software is completely open-sourced.
  • 320 page PDF manual with screenshots and nice references. (Although I’d personally prefer an online help. Currently the “?” link within the web interface just points to the PDF that you can download.)

Annoyances:

  • A lot of mouse moving and clicking is required to set up things. For example setting up an alert if the free space on a disk on a certain server is getting too low then you need to set up hosts, items, triggers and actions. Some of the clicking seems redundant. E.g. I didn’t find a way to create triggers automtically for a set of checks. If I monitor how full the “/home” partition is then I’d like to set a threshold in the same configuration step.
  • Takes a little patience understanding the concepts (because there is no hidden magic) although they make sense after half a day.
  • The web interface is crammed full of features. For casual users it’s confusing to navigate. In a real-life network you find yourself setting host variables, juggling templates and unless you remember everything you did you will not get a good overview of your configuration. Zabbix is very complex but in my opinion it would need an even better web interface to deal with its featurs properly.
  • The map editor was close to unusable at first but has improved in version 1.8. It still takes a lot of time to set up the maps. The map editor could really use fewer mouse clicks to set up the map. I was also missing a feature to add current item values to the map (like the server room temperature or bandwidth on our load balancer). You can just add triggers which occupy a lot of space on the map, too.
  • You can just return one value per item. Sometimes you need to return a good/bad value plus some additional information. Nagios for example delivers a return code for OK/WARNING/ALERT and also a text string. In Zabbix this are different items.
  • Zabbix gets painful when you want to monitoring different assets of the same kind. Different network interfaces, disk partitions, MySQL instances or web server ports. Templates are pretty useless here. You will have to copy every item and trigger.
  • Does not detect the available assets in a monitored server automatically. Imagine that you want to monitor the space on all disk partitions on a system. You will have to copy over or create the check items manually or define all possible checks in a template and disable those you don’t need. Cacti handles that better by offering you a list of partitions to monitor. Zenoss can do that partly. The zabbix agent should be able to handle such a service discover automatically. (The built-in “Discovery” feature rather seems to detect new servers in a given network range automatically. But that’s something different.)
  • Hard to debug. Why was an action not run? Who would get alerted for a certain trigger? Why has a value become ‘unknown’ without a reason? Of course there are reasons for what Zabbix does. But it often takes clicking and guessing instead of telling the user.

See my Zabbix screencasts if you like to learn more.

See also: Ben Rockwood’s blog Further similar  software I didn’ test thoroughly: Hyperic and Opsview. All of the above tools are great. I’m not meaning to say that “Zenoss is total crap” for example. The differences are subtle. And whether a piece of software suits your needs really depends on your expectations. I love that all this software is available as open-source. And a totally unscientific but fun analysis of the community is counting the number of active people in the respective channels on the Freenode IRC network:

  • #nagios: 133 users
  • #cacti: 58 users
  • #cricket: 2 users
  • #zenoss: 54 users
  • #zabbix: 61 users

Either Nagios has the largest fanbase or perhaps that means that the majority of people needs help with it. 🙂

66 thoughts on “Tired of Nagios and Cacti? Try Zabbix.

  • 2009-09-20 at 12:13
    Permalink

    Zabbix is using php unfortunately – and php is not an option for me, it sucks way too much.
    I still hope that the Zenoss developers finish to port Zenoss to a more modern application server than Zope2.8, then I could imagine it would be the best replacement for all of the mentioned tools.

    Reply
    • 2010-02-14 at 09:54
      Permalink

       

      Hi guys,
       
      now I used http://www.bijk.com for server performance monitoring and i'm happy.
       
      Bijk.com is web-se SaaS service for monitoring group of servers online, with online show performance graphs.
      Reply
      • 2010-04-19 at 11:04
        Permalink

        bijk people are advertising in any monitoring related post on the web, but bijk is not an option for people who care about security, about the law or about their jobs.

        If I would catch one day one of our admins installing a remote monitoring service as root sending vital server data live to a remote service like bijk I will fire him instantly! So beware of such security nightmares like bijk.com

        I speculate that bijk is run by some secret service members, same story like more and more cloud providers are beeing invaded by secret service members right now – while the "enterprise" ctos around the globe are still planning on migrating into the cloud, the dark forces are already there waiting for your data…

        Reply
        • 2010-07-31 at 04:52
          Permalink

          That was my inital thought when I read the setup instructions. bijk has a beautiful interface and I really wanted to set it up but I was shocked when I saw how it works. If they release the code for a version I host myself, sure but until then thanks but no thanks!!

          Reply
  • 2009-09-20 at 12:22
    Permalink

    or opsview (http://opsview.org/), that is nagios with a sane web ui.

    You can use all your nagios plugins with opsview, that is a very big plus point.

    To be absolutely honest, nagios can also do trending graphs with the pnp4nagios plugin, at work I have used it for nearly a year and a half and it works really nice.

    I am migrating our nagios to opsview at work because I do not want to be the only one to maintain it. Maintaining nagios is not hard, but apparantly editing files is something windows admins cannot do any more.

    Reply
  • 2009-09-20 at 12:58
    Permalink

    To avoid too much clicking in Zabbix it helps to work a lot with templates. If you fight yourself through the DB design you can even add things to the template en mass with SQL but you’ve to re-add all devices to that template afterwards so that they get the new things added (or you do that with SQL aswell – somewhat painful).

    Beside that I decided double the checking interval for a lot of snmp values to 60s because otherwise the load on some components goes up to high aswell as on the Zabbix host.

    Reply
  • 2009-09-20 at 16:24
    Permalink

    Tired of all of the cons of Zabbix? Try ZenOSS. It is open source and is MUCH more integrated than most all of the commercial monitoring tools, let alone the open source ones. Oh and re: nagviz and the map editor, ZenOSS has uses the google maps API for graphing. You have to put in the locations, but it works like a charm. The biggest competitor against ZenOSS Enterprise is ZenOSS Core, their open source version. There isn’t much comparable to it.

    Besides fine grained alerting and dependency checking, it gives you some really pretty graphs. Here is a graph of a Linux Server my team manages:

    http://www.digitalprognosis.com/pics/zenoss2.png

    Reply
  • 2009-09-20 at 19:20
    Permalink

    I’m with natxo, give opsview a spin. It’s like a shell on top of Nagios and gives you a solution to most – if not all – of the annoyances you listed:
    – Fancy (configurable) graphs
    – Web based configuration
    – The same third-party plugins as Nagios. I do recognize that some are bad, but therefore, there are enough available. Better have a hard-to-learn plugin than no plugin at all.
    – The web interface has been improved
    – You can have exceptions to your service checks, which means that you can override for instance your default “warning at 90% disk full for that one server where 10% free actually means 5TB free.
    – The NRPE (which is available for multiple platforms) should not be too hard to get running. The friendly Opsview community will surely give you a hand.
    – Due to the comfortable web interface, it’s easy to set Opsview to not notify you on every alert ( if that is what you like).

    If you’re familiar with Linux systems, give it a spin. I’ve been working with a lot of monitoring systems and I’m happy with Opsview now. If you’re using Debian, adding the repository and doing an apt-get install opsview-server gets you rolling. Never been easier to setup a decent monitoring system and although I’m already using it for a long time, it still amazes me every now and then with the functionality and ease-of-use.

    One major point for me was the ease of use of distributed monitoring – not sure if that’s an issue for you.

    Reply
  • 2009-09-22 at 11:02
    Permalink

    @Bernd Zeimetz: I wouldn’t develop in PHP either (I’m a Python fan) but it makes the Zabbix web interface very fast to navigate.

    @natxo: I tried Opsview and honestly didn’t spend much time with it. But it didn’t feel very “integrated”. A dozen different tools glued together cluttering the file system. If I had more time I would have tried it more thoroughly.

    @Jeff: Zenoss is pretty integrated indeed (except that it stored data in MySQL, Zope internally and RRD). The Google maps API is a nice feature for show and tell but it doesn’t really add much value here with just three locations. The graphs are a nice frontend to RRD but it’s still RRD. The dependency graph is nice, too, but somehow very limited – feels very read-only. I’d say that Zenoss has the most eye-candy but power-wise it’s not outstanding regarding my expectations. Decent but no killer application worth the huge fuss around it.

    It’s been a close shootout but I’m not using Zabbix and configuring it. Should be the solution with the least surprises I guess.

    Reply
  • 2009-09-22 at 22:27
    Permalink

    I have an small installation howto (source way) for Debian Lenny (Server and Agent) in Spanish that maybe someone could translate into English.

    Request if needed.

    J.

    Reply
  • 2009-09-24 at 21:40
    Permalink

    J.-
    Perhaps we could use Google Translate? If you have the howto online somewhere, please post a reply. Thanks!
    -D

    Reply
  • 2009-10-12 at 19:03
    Permalink

    Most people who say nagios is too much work simply do not know how to use nagios properly. The key is to use hostgroups. Define all your tests once, then automatically add them to a new host just by including that host in the correct host groups. This also includes service dependencies. For example, I manage a number of web (apache) servers. The pages will not load properly if the postgresql server is down. So I set all the web servers in a host group. I then create a service dependency specifying that all members of that hostgroup are dependent upon the postgresql connection service check being good. If I had another web server I simply include that hostgroup name in the list and it’s dealt with. The service checks and all relevant dependencies are automatically created.

    When I add another server I almost never need to add any service checks. There are exceptions, of course. Some servers are one-offs, so the service checks are uniquely defined, but this is the exception.

    As for graphs, there is an addon for nagios called nagiosgraph. It adds basic graphing functionality to nagios and gives you access to the graphs right in the nagios interface. As with my service checks and dependencies, the addition of graphs is also handled in the hostgroups. Once a graph is defined it is automatically included when I add a server to the correct hostgroup. Define once, use many times. The downside is nagiosgraph can be a bitch to set up initially.

    I played with Zabbix. Its graphing capabilities are excellent, but I found it to be no where near the power and functionality of nagios when it came to monitoring your infrastructure.

    Reply
    • 2011-01-16 at 08:48
      Permalink

      Of course we don't know how to use it properly. It's a mess of over-complexity, poor administration, and typical uber-geek linuxisms (arguably the most user-hostile and inconsiderate computing platform conceivable. Let me make something clear: we want to monitor running servers, disk-arrays, network switches, routers, firewalls, and the like. We do not not want to reprogram an operating system. We do not want to reinvent the SNMP poll. We do not want to have to sit down and think of all the the test we require for examining a simple two-port router or twelve-port switch. Nagios forces us to do all that as if our infrastructure were the first ever built. We suffered through that mess for over 3 years with a staff of 3 and I often wonder if the time we put into managing this monument to computing inefficiency actually exceeding the downtime we experienced during the same period.


      In case it hasn't gotten through your thick skulls and taped-up glasses, we want to ACCOMPLISH the task of computing infrastructure monitoring/alerting, not reimagine it as its own science/art. In typical Linux fashion, Nagios expects us to start out with a PhD and grow rapidly from there.


      In power and flexibility, Nagios is clearly king but I didn't want to make supporting it my career, which it very nearly became. Perhaps you who support and expand Nagios might take a moment to remember that we all do not have two weeks to work on merely getting one router monitored.  I'll bet most of us would be required to have that much done within a workday. It's just too much work for too little benefit and was a nightmare as a result.  Why not just put a few "canned" installation and startup options to help the people in the real world get up and running quickly? (We can work on our PhDs later.)  You say that most people who complain aren't using it properly.  Who on the even remotely normal side of the IQ scale could?

      Reply
      • 2011-01-16 at 16:15
        Permalink

        Funny how these types of replies hit in fits and spurts. Nothing for months and then sudden interest again. Oh well, just an observation.  Anyway, I have to agree with the last post that Nagios is just a little too far beyond a typical sysadmin's level. We tried Nagios for a few days and couldn't so much as get a single switch monitored  to our satisfaction. We were able to do that with Zenoss in a matter of a few hours. I'm sure that Nagios has advantages for those who can make it work but lots of us are tool-users, not tool builders and we have to apprach our work with those limitations.

        Reply
        • 2011-01-24 at 21:04
          Permalink

          Companies set up new goals during the first couple of months. Usually, the big boss tells his engineers that monitoring

          "need improvement". Thus a big interest to the subj. I went though this three years ago. Been using Zenoss for 2.

          It is harder to learn, but once you get a hold of zendmd and python snippets for Event Transform – it'll save your … head multiple times.

          We monitor some time sensitive equipment down to seconds. Our NOC calls customer before they even know that their links are down.

          Reply
      • 2011-05-26 at 11:26
        Permalink

        I've just setup nagios for the first time at a company using around 50 hosts, including the modules for graphing the results (nagiosgraph) and using plenty of remote checks, most of which I wrote or adapted from existing ones. With all the "special case" machines I had to accommodate, it's taken around a month to six weeks. ( today I could do it much quicker)

        The most important thing with nagios is to understand how to separate the host definitions from the service definitions. Once you've got that worked out the rest is easy, just create a host with "define host" then add it's name to the right hostgroup and you'll have the right services monitored and graphed with no extra work.

         

        I agree that some of the documentation leaves a lot to be desired, so I would recommend buying one of the books so you can get started quickly.

        Good luck. 

        Reply
      • 2011-11-23 at 09:31
        Permalink

        Haha… if you want extensibe, scaleable and robust go with Nagios. Your opinion that its hard to setup is mearly that… I have thounds of hosts and devices, 10's of thousands of services… geographically distributed in multiple datacenters. Guess what it cost (I'll give you a hint)… Oh and it didn't take months/years to setup. Its text based configuration is what makes it so powerful and scaleable, and if you were/had real admins you would see the advantages with it.

        Maybe you should stick to managed hosting, and leave the real work to the professionals.

        Reply
        • 2011-11-23 at 09:36
          Permalink

          I'll rephrase, if you want to monitor a handful of hosts and can't be bothered to properly learn a new tool then maybe you should go with something else (although you will regret it later).

          Reply
      • 2011-11-23 at 09:36
        Permalink

        Sounds like you are looking for something like Observium instead of Nagios 🙂

        Reply
        • 2011-11-25 at 04:54
          Permalink

          take a look at check_mk, livestatus and multisite in terms of exending autodetection of services with Nagios, a nicer interface and easy distributed setups   

           

          problems i see right away with observism is scaleability…at least nothing in the docs about. 

          Reply
      • 2012-01-27 at 03:51
        Permalink

        Shinken is a re-write of Nagios in Python. It now provides templates that apply to hosts and a more robust discovery framework. This makes it much more accessible for SMBs. Notably, it is crossplatform, so you can do native powershell, wmi queries and other windows stuff.

        Sure, it still has a lot of that text complexity some people fear. For large environments, it has an easy no nonsense HA and distributed architecture thanks to the Python Pyro object module. It has business processes, criticality modifiers for identifying business impacts. (Coffee pot is critical vs core router is critical)

        But you know what the main reason for using Shinken is… You can configure it to have very little false positives AND focusing on real problems. (For the geeks this means root cause identification, event suppression, business rules, correctly treating clusters)

        Having a distributed or HA monioring system is a wee bit more complex or impossible in most if not all solutions.

        Version 1.0 is on the verge of being released, it should be thunderbolt!

        http://www.shinken-monitoring.org

        Reply
        • 2012-09-02 at 06:36
          Permalink

          Shinken 1.2 just got released and it is _full_ of monitoring goodies.

          This is a project with a large and growing developer base with innovative ideas. I think it is going places. 🙂

          It is a viable alternative to Nagios, Zabbix, etc. It is also one of the few monitoring systems that has core integration for Graphite. (visualization API and UI for efficient time-series databases)

          http://www.shinken-monitoring.org

          Reply
  • 2009-10-13 at 13:04
    Permalink

    @Ogre: Thanks for the comment. It’s probably true that many Nagios administrator are not aware of how to make their lives easier. Zabbix has a totally different concept which makes it confusing if you try to apply the Nagios vocabulary. In Zabbix there are “templates” with predefined items (parameters), triggers (alert conditions) and graphs. You would typically create a template for a certain class of servers like the PostgreSQL servers you mentioned.

    Templates can even inherit other templates. So what I did here is take the Template_Linux and copy that into a Template_Debian. I changed a few items to make them suit a Debian system better (e.g. “syslog” on Debian is “rsyslog” and Apache is “apache2” instead of “httpd”). I then created sub-templates like Template_Debian_Webserver (inheriting Template_Debian) adding items that I just need for our web servers. That way nearly all checks are defined in templates. But I can still add per-host items and trigger if I so wish.

    Most of the power of Zabbix is its explicit configuration with powerful triggers and the Zabbix agent that gets installed on the systems you wish to monitor (fortunately being in Debian). The biggest advantage is probably that I can just click my way through (even though it’s sometimes excessive clicking) instead of having four config files open in the text editor while searching through different parts of the Nagios manual.

    I haven’t found anything serious where Zabbix lacks an issue that we use with Nagios. But it takes a little getting used to. Zabbix will not make you happy if you only have half an hour of spare time and would like to compare the systems.

    Reply
    • 2012-11-08 at 08:37
      Permalink

      I’ve been a Nagios admin for some time, and I’ve recently rebuilt our entire monitoring infrastructure from the ground up using the Nagios distribution at omdistro.org. What they’ve done is built a single package (RPM or DEB) which contains Nagios, Icinga, Shinken, Thruk, RRDtool, rrdcached, mod_gearman, NagVis, … . Instead of having to fight with getting all the pieces put together and configured to work correctly, you pretty much get a fully working and powerful Nagios installation out of the box. To top it off, it’s designed to make it easy to build a “site”, which can be a fabulous thing when it comes to developing new checks, updating the interface, etc. In my own case, I used the check_mk plugin (bundled) to build the entire Nagios configure (plus file delivered by Puppet), and customized the multisite interface to have the graphs, sidebar tools, etc. that were useful for our site. And for those who want web configuration, that can be done, too, (though it’s not complete).

      Reply
  • 2009-11-05 at 08:37
    Permalink

    Thanks for the post…was just what I was looking at. We are running Cacti plus Nagios…and hoped Zenoss would be the replacement but hit the same issues you mentioned. I hope we get time to look at Zabbix now.

    Thanks again.

    Reply
    • 2011-02-02 at 22:53
      Permalink

      I'm suprised Groundwork OpenSource was not included in this discussion. You get the advantages of Nagios but being much easier to configure (even more then Zabbix in my expereince) plus numerous useful plugins preconfigured and integrated.

      Reply
      • 2011-02-02 at 22:57
        Permalink

        I did not leave Groundwork out for any particular reason. It was just not on my list of software to evalute. How would you compare Zabbix to Groundwork? Which details are different or better/worse?

        Reply
        • 2012-01-13 at 17:34
          Permalink

          GroundWork is just Nagios with a whole bunch of other applications and custom development lumped on top. While Nagios can be a bear to configure, GroundWork requires a *huge* increase in resources even for a smallish site. (I should admit, I've built several Nagios systems over the past 10 years or so and I really don't find it all that difficult to use once you get the concepts down).

          If you want to go down the Nagios road take a look at Opsview. While I hate the config files it creates (which you shouldn't ever have to look at anyway), it really simplifies getting it up and running and takes most of the pain out of it. It also hides the standard Nagios interface giving you something much easier to work with.

          There are also multiple front-ends for Nagios that hid the configuration files. Take a look at Fruity, NagiosQL, and Monarch (the one GroundWork is based on).

          I have just started taking a look at Zabbix, and I'm still not sure if I like it or not. It seems to be something of a resource hog, and while flexible, the configuration looks like it will make Nagios seem easy. I am also finding the UI to be awful, not easy to navigate or understand.

          Zenoss is also on my list, but the last time I looked at it (years ago) it was really immature as far as montioring goes. While it has one of the nicest UIs of the bunch there are too many missing features and you end up having to write way too much custom code (imho) just to get the system doing anything useful. I don't know if it is still true, but even something as basic as sending e-mail and SMS notifications required custom python development the last time I looked at it.

          Reply
    • 2012-02-05 at 06:20
      Permalink

      Logicmonitor -> not open source but takes 1/1000 of the time to get the monitoring stats and alerts you want compared to the open source alertnatives. I have configured and managed cacti, mrtg, kaseya(paid product), solarwinds(paid product) and Logicmonitor is by far the best and easiest to use.

       

      http://www.logicmonitor.com

      Reply
    • 2012-03-12 at 18:39
      Permalink

      i tried it with mysql backend and it didnt run well.

      Reply
      • 2012-03-17 at 11:39
        Permalink

        Actually MySQL is the best supported database backend with Zabbix. And there are really (really!) large installations with several hundreds of values per second, proper segmentation, fast servers. So your statement is pretty lame.

        Reply
  • 2010-05-15 at 13:01
    Permalink

    I currently use zabbix to monitor a really  large environment (more than 320 servers)

    I've founded a wonderful plugin that is more than a plugin and the others monitoring systems don't have nothing of similar, and nothing that go inside oracle so deeply.

    In the hope that someone found useful my comment

    http://www.smartmarmot.com

    here you are going to find Orabbix opensource and released under GPL3

    Reply
  • 2010-05-19 at 14:05
    Permalink

    Think you need to look at Cacti again… Vanilla it has some of the disadvantages you mentioned, but get it up and running properly, and most of those go away (via the Plugin Architecture). Thresholds, mapping, monitoring, etc… are all there… Try CactiEZ via cactiusers.org. A boot CD which gets you up and running with Cacti and most good plugins already to go…

    Reply
    • 2010-06-01 at 18:15
      Permalink

      I had installed CactiEZ through Boot CD a few days back and the results are really stunning. But I agree with the article writer that some times values are missed from the graph. I had faced the same yesterday.

      Reply
      • 2014-03-27 at 22:15
        Permalink

        Cacti & instability? Strange. The whole part about Cacti is little mess, seems like novice impatient approach. No offence given.

        I have some 32000 devices in Cacti, 110000 data sources/graphs. Not a single graph was created by hand. I also have thresholds, reporting, tracking, automation of changes, alerting, 40 users using it daily, 50 gb of rrd, five years graph retention, 1 minute pooling for most of devices, different rra for most, all templates by snmp, automated empty rrd deletion, automated adding new devices and ports. I work with bundled scripts for managing devices & use its extreme filtering capabilities. Today Ive added 330 devices with some 2300 graphs and it took one minute for me (adding takes more depending on machine speed). Ive been also through some 5 upgrades through last 5 years all without loosing any data. Not to mention that Im still on single server but with ssd disks.

        I guess there is lot more to enumerate.

        In my opinion none of mentioned tools are better in graphing than Cacti. I never had troubles with core functionality, although in my scale some plugins can be speed hogs.

        Yes I admit Cacti can be hard to learn for novices, especially the automation part.

        Reply
        • 2014-03-30 at 22:36
          Permalink

          Maybe newer versions of Cacti are working more stable. But I have just seen an instance of Cacti after a break of 4-5 years from it and the UI is as ugly as years ago. So it does not look like anyone has rewritten major parts of it. I've been dealing with monitoring sytems for 20 years so I wouldn't consider me a novice. And although I'm usually a bit impatient I had to spend lots of time with these tools and am pretty sure that I haven't used these tools very wrong.

          Fortunately we can choose which piece of software we want to spend our valuable time with. But I'm really surprised that you write that "non of the mentioned tools are better in graphing than Cacti". Yes, PNP4Nagios is just another mess that is even worse than Cacti. But have you taken Zabbix for a ride? It does not have RRD's limitations. The collection frequency can be set for each item seperately as can the trending frequency. Zabbix's agent automatically registers at the master and thanks to templates you also do the work just once.

          Neither Cacti nor Zabbix can really win a price with their UI. But it just took me 10 minutes to convince a long-term Cacti database administrator of Zabbix once he saw how easily it is to work with graphcs and how cool it is to group them arbitrarily on screens.

          Reply
        • 2014-07-09 at 18:07
          Permalink

          How do you implement graphs that quickly? I have spent HOURS just adding ONE device with multiple points and often fight to get it to look “right”. Especially with graphs that dont have much range (stuff that is from 100-102 is the average, its the tenth I want graphed and I cannot get it right on the axis, it just shows up as 100,100,100,101,102..)

          Reply
  • 2010-06-04 at 14:40
    Permalink

    Hi,

    You should look at Shinken too, it’s a enhanced Nagios reimplementation in Python that allow you to have a quick and easy distributed and high availability monitoring environment, and of course with Nagios configuration and plugins compatibility.

    It's available (Open Source with a AGPL licence) at http://www.shinken-monitoring.org with even a demo virtual machine to test it in 5minutes.

    Jean Gabes, Shinken developper
     

    Reply
  • 2010-06-22 at 17:32
    Permalink

    I'm currently having a hard time with cacti.  My plan was to start with Nagios when Cacti was graphing "everything". 
    After reading your article I'll give zabbix a chance first.

    I might set it up at home too to monitor a few Drupal sites I'm running.
    Thanks for the good article.

    Reply
  • 2010-08-17 at 00:35
    Permalink

    I never had a chance to use OpenNMS in production, but it seemed roughly comparable to ZABBIX.

    The main advantage to OpenNMS I saw was that the database schema was a lot nicer, although it required the backing database server to be postgres rather than mysql.

    Regardless, I was able to hack support for it into my custom wui in a couple hours’ time. It takes *that* long just to sift through all of the debris in ZABBIX’ schema.

    Reply
  • 2010-08-20 at 17:21
    Permalink

    Thanks to a topic I was looking for a long time

    Reply
  • 2010-10-12 at 18:36
    Permalink

    nice overview, find it very useful. i did install zabbix based on this preview and concluded the minus column does not quite express the amount of pain one has to go through to get anywhere near a professional monitoring environment.

    Reply
  • 2010-12-08 at 20:51
    Permalink

    If you're tired of Nagios and Cacti, you should try LogicMonitor.

    Very flexible and configurable, yet easy to use (15 minutes to setup).

    Alerts via email or SMS, fancy graphs, dashboards, reports, multiple data collection methods, API, and much more.

    Unlimited support (email/chat/phone) is included in the price of service: $300/month for up to 25 devices – on a month to month basis, cancel anytime.

    Free trial at http://logicmonitor.com

    Reply
  • 2011-01-16 at 09:55
    Permalink

    No doubts about it. Nagios is a nightmare. While I appreciate its fans and all the efforts they put into making their individual monitoring systems work, let's take a step back. We're trying to monitor a computing infrastructure, not re-write an operating system. Nagios, in typical Linux fashion, forces its users to do nearly that. You have to understand that we aren't given months or weeks to get items like server and router monitoring working anymore. We're sometimes given hours or a few days at the most to get the whole job done (or else). That means that ease of configuration, auto-discovery of common objects and services, graphs, and a GUI to assist in proper configuration and updates are now MUSTS, not luxuries. Infrastructure monitoring should be a task, not a career. While I'm not about to tell everyone to go out and foot the $27K bill for Solarwinds (we wound up doing that, by the way – Nagios was driving too much turn-over amoung our staff – I'm not kidding. This thing BROKE people … put full-grown men in tears.), we have to be honest about these uber-geek tools and their absolutely unacceptable levels of complexity, sensitivity, and steep learning curves. Dare I say it? Nagios is complete crap. It does a lot but at the expense or requiring an uber-geek or a PhD running the system. Nothing against uber-geeks but some of us have families with whom we wish to spend occasional time. Nobody wants to afford that anymore and I don't want to lose my job because something that wasn't monitored properly didn't alert us.

    Reply
    • 2011-05-24 at 19:13
      Permalink

      Um.. that sounds like total lack of confidence and knowledge to me… Ofcourse you have to know NIX concepts.. which to most GUI users are complely foriegn. It's a SKILL just like fixing your car.. Nagios concepts are dead simple for most unix people and it's super reliable and extensible so stick to Visual Basic and Microsoft stuff if you choose to… But don't trash something just because you don't understand it.

      Reply
    • 2012-12-04 at 21:10
      Permalink

      Uber geeks? Nagios is run for 400 nodes by a college intern in his second year of computer science… Simple text file based setup and lots of inheritance (like hostgroups) that makes setting up a new node less than a minute. I think someone needs to go back to school.

      Reply
  • 2011-02-10 at 11:47
    Permalink

    Many people know good functions of Nagios. We all know good functions of that system but there is still much to do about ease of use. We should mention here product op5 Monitor that put all the good that comes from nagios functions are ads all good look features. Have any one tried that ?

    Reply
    • 2011-03-01 at 21:54
      Permalink

      I'm using it for one of the clients, with license. It's a good tool, nice integration with pnp and nagvis, easy web config, but still have some bugs, probably solved in time.

      Reply
  • 2011-03-09 at 23:40
    Permalink

    "I like Cacti for its user interface is much better than Cacti"

    Reply
  • 2011-07-20 at 06:01
    Permalink

    Would it have been better if your professor sucked well?

    Reply
  • 2012-02-21 at 19:18
    Permalink

    http://www. server focus .org.nyud.net/nagios-vs-cacti-vs-zabbix-vs-zenoss blatant plagiarism, didn't even list the author.

    Reply
    • 2012-02-21 at 21:15
      Permalink

      Thanks for the hint. I'll get in contact with them.

      Reply
  • 2012-03-04 at 22:27
    Permalink

     

    I think these zabbix guys are missing some acedemic background. I examined some code 5 years ago because it was giving me a high load on the database server.

    If you dont know what you are doing go for zabbix and if you do know what you are doing go for nagios!

    Reply
  • 2012-06-07 at 06:00
    Permalink

    I started with Nagios ages ago, and, it took a bit. but I found that with proper (no guidance) structuring of the various config files it was easy enough to manage. That is, until the explosion in VM’s (zones for us), monitoring so many “hosts” and, websites, and, adding in a test for various SSL-expiration dates, NASes, SANs, environmental monitoring, and so on – well, it go out of control. I switched to Opsview a few years back, it’s great, for numerous reasons – the ease of managing Opsview, sysadmins could add hosts & services to check (instead of asking me to add them – that was huge). Built-in graphing, etc…

    That all said, I haven’t checked out Zabbix in years, so, it’s time to give it a closer peek.

    Reply
  • 2012-09-13 at 06:51
    Permalink

    Thanks. I came from nagios (and cactii too) and had tried zabbix, but didn’t stick. When I read your comment that zabbix took a lot of point and click to start, I realized I wasn’t alone and gave it another try. Glad that I did. Those here that are mocking zabbix and saying nagios is the “real” scalable monitor are stuck in the past. One word: discovery. Once you try it, you’ll see it can’t be beat. I can bring a Windows machine online and know without worry that it will be discovered and monitored and that I will be warned if trouble looms – be it disks, CPU temperatures, loads, memory, S.M.A.R.T, APC battery status, etc. A little effort, and I am no longer stuck in the nagios rut.

    Reply
  • 2012-11-22 at 23:06
    Permalink

    thanks for the blog entry. The (53) comments also show it is a popular source of strife for sysadmins everywhere.

    I came from Orca, (watched in horror, unable to stop the big dump corporation buy the BMC-Patrol) found the Nagios, had co-workers curse at The Big Brother and Little Sister (settled on the Hobbit), I read about the Munin, the Zenoss (never heard of the Zabbix).

    I just wish Cacti was more stable, and the developers were more supportive of Solaris.

    Reply
  • 2012-11-28 at 10:09
    Permalink

    Thanks a lot for sharing your user experience with the various NMS systems. My first impression of Zabbix after two weeks is that it is a very powerful system. But setting up SNMP traps is also not as easy as it should be. SNMP is such an essential tool in monitoring, that I do not understand why even Zabbix forces their users to set up SNMPTT, SNMPD, SNMPTTRAPD…….
    It is a hassle and very error prone if you don´t do it every day. But I guess if you want quick and easy solutions you have to fork out some cash for a commercial software.

    Reply
  • 2013-01-29 at 17:25
    Permalink

    Thanks for this article. I also think that Zabbix is a step further in monitoring subject with opensource software. Although it lacks some important features that paid softwares have like: good SNMP trap support, alert (trigger) console with more functions, dinamic maps creation like Nagios, and so on…

    Reply
    • 2013-06-09 at 22:15
      Permalink

      Thanks for the reference. I generally agree that Zabbix isn't very good in determining the actual reason for an outage. It's very flexible and can be configured in great detail but still only experienced sysadmins will look at the "last top 20 events" and tell you what really happened. Even with escalation plans and dependencies I find it impossible to make sure that only one alert is going out that tells the exact problem. Sure – that works well if a disk is running full. But not if the speed setting of one of your core backbone switches is wrong. Not sure which approach is good though.

      Reply
  • 2014-05-20 at 11:03
    Permalink

    Its really a nice post, the content of this blog is really awesome and extraordinary.And also please Read link http://www.woodstone.nu/salive which provide information server monitoring software & network monitoring tools

    Reply
  • 2014-09-30 at 22:06
    Permalink

    Have you had a chance to try Hyperic 5 or Zabbix 2.4?

    Reply
  • 2015-10-22 at 04:04
    Permalink

    Zabbix, as an open source enterprise grade tool, offer the most for no extra cost. It’s configurations are fairly simple and is able to handle large scale infrastructures. More importantly, it offers more capability with a large ecosystem of integrations such as PagerDuty and BigPanda. PagerDuty acts as a router for Zabbix and allows for customization of sophisticated escalations: https://www.pagerduty.com/docs/guides/zabbix-integration-guide-2/
    BigPanda sits on top of Zabbix and compresses Zabbix alerts into manageable incidents: https://bigpanda.io/zabbix-alternative
    Overall, you get more customization and capability out of Zabbix and its ecosystem of integrated tools.

    Reply
  • 2016-02-19 at 23:14
    Permalink

    Some people seem to think this is a religious debate, and every time someone doesn’t like Nagios they insult them.
    I’ve been in this field for over 20 years and do actually have a Computer Science degree. Guess what? I switched from programming to sys admin & network engineering because I really don’t want to program – I want to design and implement networks, and the hosts, but have no desire to then spend 6 weeks tuning and tweaking a monitoring solution such as one Nagios fan mentioned here. If all you do for a living is monitor networks and systems, maybe you can justify it (but not if you worked for me). The point most people are making is valid: Cisco and Microsoft own 80% each of the network and system world, so any tool should be ready out of the box to monitor, graph and alert for Cisco devices and Microsoft systems: I shouldn’t be building my own templates for a Cisco Catalyst switch or Server 2012 system, as it is simply reinventing the wheel and a waste of anyone’s time.
    The pressure is on via DevOps. The developers I support are working on 2-week iterations to get updates out the door, and they don’t expect me to take months setting up what should be simple and straightforward monitoring and most importantly graphs. If the free/cheap tools require more time to configure than the commercial ones, then it is no longer worth the difference in price. Obviously the commercial tools require knowledge and skill as well, but I’ve used a lot of them over the years and what I see is they are getting better and cheaper all the time. You can’t make a career out of saying on your resume that you can and like to play with Nagios all day….

    Reply
  • 2016-09-16 at 15:54
    Permalink

    Some ideas of missing potential candidates to replace Nagios/Cacti:

    -Pandora FMS (http://pandorafms.org): it’s like mixing all together: zenoss, zabbix, cacti, nagios, NNM, opennms but with a nice interface, and much more sophisticated event system and management. I’ve seen replacing HP Openview and Patrol in several places. Its pretty powerful, even in their OpenSource version. They have an Enterprise version with nice PDF reporting and all these stuff, but opensource (GPL) is great. Take a look, is not very known because they’re spaniards

    -http://riemann.io/ + Graphite. Mostly do it yourself, but VERY VERY powerful and flexible, if you’re on devops stuff, this is your buddy.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close