1、需求描述
默認情況下Zabbix 模板 中網絡接口自動發現接口時，會產生很多item，有時候會有我們不需要的一些接口，這時候需要過濾掉他們。
比如我有一台運行kvm的服務器，服務器上有四個物理接口 eth0-eth3 , 三個網橋接口 br0-br2 , 還有很多個虛機的網卡接口 vnetxx ，如下所示：
1 [root@host00 ~]# ifconfig |grep HW 2 br0 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:69 3 br1 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6A 4 br2 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6B 5 eth0 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:68 6 eth1 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:69 7 eth2 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6A 8 eth3 Link encap:Ethernet HWaddr EC:F4:BB:D6:37:6B 9 vnet0 Link encap:Ethernet HWaddr FE:54:00:00:00:15 10 vnet1 Link encap:Ethernet HWaddr FE:54:00:00:00:17 11 vnet2 Link encap:Ethernet HWaddr FE:54:01:00:00:15 12 vnet3 Link encap:Ethernet HWaddr FE:54:01:00:00:17 13 vnet4 Link encap:Ethernet HWaddr FE:54:00:00:00:2F 14 vnet5 Link encap:Ethernet HWaddr FE:54:01:00:00:2D 15 vnet6 Link encap:Ethernet HWaddr FE:54:00:00:00:30 16 vnet7 Link encap:Ethernet HWaddr FE:54:01:00:00:2E 17 vnet8 Link encap:Ethernet HWaddr FE:54:00:00:00:1A 18 vnet9 Link encap:Ethernet HWaddr FE:54:01:00:00:1A 19 vnet10 Link encap:Ethernet HWaddr FE:54:00:00:00:16 20 vnet11 Link encap:Ethernet HWaddr FE:54:01:00:00:16 21 vnet12 Link encap:Ethernet HWaddr FE:54:00:00:00:11 22 vnet13 Link encap:Ethernet HWaddr FE:54:01:00:00:11 23 vnet14 Link encap:Ethernet HWaddr FE:54:00:A1:61:A1 24 vnet15 Link encap:Ethernet HWaddr FE:54:00:A2:61:A1 25 vnet16 Link encap:Ethernet HWaddr FE:54:00:A3:61:A1 26 vnet20 Link encap:Ethernet HWaddr FE:54:00:00:00:2B 27 vnet21 Link encap:Ethernet HWaddr FE:54:01:00:00:2A 28 vnet24 Link encap:Ethernet HWaddr FE:54:00:00:00:2C 29 vnet25 Link encap:Ethernet HWaddr FE:54:01:00:00:2B
這里我們只想監控服務器上的四個物理接口，對於網橋接口和虛機網卡接口不關心，由於虛機的創建刪除比較頻繁，導致該服務器在Zabbix中有很多 Item 是 Not supported 的狀態，如果等待這些不支持的監控項自動刪除大概需要等待一個月的時間。
另外在zabbix-server的日志中也會有記錄大量的錯誤日志：
1 24102:20160701:145019.036 item "10.12.29.100:net.if.in[vnet24]" became supported 2 24101:20160701:145020.037 item "10.12.29.100:net.if.in[vnet25]" became supported 3 24102:20160701:145101.129 item "10.12.29.100:net.if.out[vnet24]" became supported 4 24100:20160701:145102.130 item "10.12.29.100:net.if.out[vnet25]" became supported 5 24101:20160701:155859.871 item "10.12.29.100:net.if.in[vnet6]" became not supported: Cannot find information for this network interface in /proc/net/dev. 6 24100:20160701:155909.880 item "10.12.29.100:net.if.in[vnet17]" became not supported: Cannot find information for this network interface in /proc/net/dev. 7 24100:20160701:155941.908 item "10.12.29.100:net.if.out[vnet6]" became not supported: Cannot find information for this network interface in /proc/net/dev. 8 24102:20160701:155951.916 item "10.12.29.100:net.if.out[vnet17]" became not supported: Cannot find information for this network interface in /proc/net/dev. 9 24102:20160701:160343.187 item "10.12.29.100:net.if.out[vnet7]" became not supported: Cannot find information for this network interface in /proc/net/dev. 10 24101:20160701:160358.201 item "10.12.29.100:net.if.out[vnet22]" became not supported: Cannot find information for this network interface in /proc/net/dev. 11 24102:20160701:160359.201 item "10.12.29.100:net.if.out[vnet23]" became not supported: Cannot find information for this network interface in /proc/net/dev. 12 24100:20160701:160400.202 item "10.12.29.100:net.if.in[vnet7]" became not supported: Cannot find information for this network interface in /proc/net/dev. 13 24101:20160701:160417.217 item "10.12.29.100:net.if.in[vnet22]" became not supported: Cannot find information for this network interface in /proc/net/dev. 14 24100:20160701:160418.219 item "10.12.29.100:net.if.in[vnet23]" became not supported: Cannot find information for this network interface in /proc/net/dev. 15 24102:20160701:160420.220 item "10.12.29.100:net.if.in[vnet19]" became not supported: Cannot find information for this network interface in /proc/net/dev. 16 24101:20160701:160424.224 item "10.12.29.100:net.if.out[vnet19]" became not supported: Cannot find information for this network interface in /proc/net/dev. 17 24101:20160701:161339.730 item "10.12.29.100:net.if.out[vnet4]" became not supported: Cannot find information for this network interface in /proc/net/dev. 18 24100:20160701:161340.730 item "10.12.29.100:net.if.out[vnet5]" became not supported: Cannot find information for this network interface in /proc/net/dev. 19 24100:20160701:161358.750 item "10.12.29.100:net.if.in[vnet4]" became not supported: Cannot find information for this network interface in /proc/net/dev. 20 24100:20160701:161358.750 item "10.12.29.100:net.if.in[vnet5]" became not supported: Cannot find information for this network interface in /proc/net/dev. 21 24100:20160701:161408.760 item "10.12.29.100:net.if.in[vnet16]" became not supported: Cannot find information for this network interface in /proc/net/dev. 22 24102:20160701:161410.761 item "10.12.29.100:net.if.in[vnet18]" became not supported: Cannot find information for this network interface in /proc/net/dev. 23 24102:20160701:161413.764 item "10.12.29.100:net.if.in[vnet14]" became not supported: Cannot find information for this network interface in /proc/net/dev. 24 24101:20160701:161414.765 item "10.12.29.100:net.if.in[vnet15]" became not supported: Cannot find information for this network interface in /proc/net/dev. 25 24101:20160701:161450.795 item "10.12.29.100:net.if.out[vnet16]" became not supported: Cannot find information for this network interface in /proc/net/dev. 26 24100:20160701:161452.798 item "10.12.29.100:net.if.out[vnet18]" became not supported: Cannot find information for this network interface in /proc/net/dev. 27 24103:20160701:161455.800 item "10.12.29.100:net.if.out[vnet14]" became not supported: Cannot find information for this network interface in /proc/net/dev. 28 24100:20160701:161456.801 item "10.12.29.100:net.if.out[vnet15]" became not supported: Cannot find information for this network interface in /proc/net/dev. 29 24103:20160701:161958.077 item "10.12.29.100:net.if.in[vnet4]" became supported 30 24101:20160701:161959.075 item "10.12.29.100:net.if.in[vnet5]" became supported 31 24102:20160701:162040.114 item "10.12.29.100:net.if.out[vnet4]" became supported 32 24101:20160701:162041.116 item "10.12.29.100:net.if.out[vnet5]" became supported
2、原理分析
首先查看“Template OS Linux ”中關於網絡接口的自動發現規則，
下圖中三個框分別是：
Linux服務器網絡接口自動發現使用的key
Linux服務器網絡接口自動發現時間間隔
Linux服務器網絡接口自動發現的對象丟失后為其保留的時長
使用正則表達式過濾 zabbix_get -s 10.12.29.100 -k net.if.discovery 的結果，並將符合條件的結果賦值給 {#IFNAME} ，然后就可以監控接口 {#IFNAME} 的流量信息了，以及為接口 {#IFNAME} 的流量信息生成 Graph
接下來查看正則表達式 “@Network interfaces for discovery” 的內容，“Network interfaces for discovery”只是一組正則表達式的名字而已，其內容去下圖中的位置查看
查看已有的兩條規則：內容是屏蔽掉還回接口
下面分析以下 zabbix_get -s 10.12.29.100 -k net.if.discovery 的執行結果（zabbix在執行lld的時候就是調用zabbix_get 命令獲取被監控服務器網卡列表的）
1 [root@zabbix-server zabbix]# zabbix_get -s 10.12.29.100 -k net.if.discovery
2 {"data":[{"{#IFNAME}":"lo"},{"{#IFNAME}":"eth0"},{"{#IFNAME}":"eth1"},{"{#IFNAME}":"eth2"},{"{#IFNAME}":"eth3"},{"{#IFNAME}":"br0"},{"{#IFNAME}":"br1"},{"{#IFNAME}":"br2"},{"{#IFNAME}":"vnet12"},{"{#IFNAME}":"vnet13"},{"{#IFNAME}":"vnet0"},{"{#IFNAME}":"vnet2"},{"{#IFNAME}":"vnet10"},{"{#IFNAME}":"vnet11"},{"{#IFNAME}":"vnet1"},{"{#IFNAME}":"vnet3"},{"{#IFNAME}":"vnet8"},{"{#IFNAME}":"vnet9"},{"{#IFNAME}":"vnet20"},{"{#IFNAME}":"vnet21"},{"{#IFNAME}":"vnet24"},{"{#IFNAME}":"vnet25"},{"{#IFNAME}":"vnet4"},{"{#IFNAME}":"vnet5"},{"{#IFNAME}":"vnet6"},{"{#IFNAME}":"vnet7"},{"{#IFNAME}":"vnet14"},{"{#IFNAME}":"vnet15"},{"{#IFNAME}":"vnet16"}]}
對返回的json稍微美化一下
1 {
2 "data": [
3 {
4 "{#IFNAME}": "lo"
5 },
6 {
7 "{#IFNAME}": "eth0"
8 },
9 {
10 "{#IFNAME}": "eth1"
11 },
12 {
13 "{#IFNAME}": "eth2"
14 },
15 {
16 "{#IFNAME}": "eth3"
17 },
18 {
19 "{#IFNAME}": "br0"
20 },
21 {
22 "{#IFNAME}": "br1"
23 },
24 {
25 "{#IFNAME}": "br2"
26 },
27 {
28 "{#IFNAME}": "vnet12"
29 },
30 {
31 "{#IFNAME}": "vnet13"
32 },
33 {
34 "{#IFNAME}": "vnet0"
35 },
36 {
37 "{#IFNAME}": "vnet2"
38 },
39 {
40 "{#IFNAME}": "vnet10"
41 },
42 {
43 "{#IFNAME}": "vnet11"
44 },
45 {
46 "{#IFNAME}": "vnet1"
47 },
48 {
49 "{#IFNAME}": "vnet3"
50 },
51 {
52 "{#IFNAME}": "vnet8"
53 },
54 {
55 "{#IFNAME}": "vnet9"
56 },
57 {
58 "{#IFNAME}": "vnet20"
59 },
60 {
61 "{#IFNAME}": "vnet21"
62 },
63 {
64 "{#IFNAME}": "vnet24"
65 },
66 {
67 "{#IFNAME}": "vnet25"
68 },
69 {
70 "{#IFNAME}": "vnet4"
71 },
72 {
73 "{#IFNAME}": "vnet5"
74 },
75 {
76 "{#IFNAME}": "vnet6"
77 },
78 {
79 "{#IFNAME}": "vnet7"
80 },
81 {
82 "{#IFNAME}": "vnet14"
83 },
84 {
85 "{#IFNAME}": "vnet15"
86 },
87 {
88 "{#IFNAME}": "vnet16"
89 }
90 ]
91 }
zabbix通過系統中的正則表達式 “Network interfaces for discovery”對上面的結果進行過濾，符合條件的內容就會被zabbix進行監控。
3、解決方法
上面工作原理分析完了，解決起來也就不費勁了，我們只需對zabbix默認的正則表達式 “Network interfaces for discovery”添加兩條規則（不監控虛機網卡接口和網橋接口），如下圖所示：
為了能夠確保新配置的正則表達式生效，並看到響應的效果，我們要把host（10.12.29.100）與template（Template OS Linux ）取消關聯並清除歷史數據。
先看一下取消關聯之前host上網絡接口的監控項有56個
取消關聯並清除歷史數據，見下圖
然后重新關聯模板 “Template OS Linux ”，此處截圖省略，然后等待zabbix LLD 自動發現符合要求的網絡接口，並開始監控，按照LLD的默認值，最多需要等候一小時（3600s）
根據我們上面獲取的10.12.29.100接口信息，這里需要監控的網絡接口是 eth0-eth3 的Incoming和 Outcoming ，一共8個監控項，見下圖：
至此，問題就解決
注意：
網絡設備模板里面要過濾端口，巨集可能不為IFNAME
