Zabbix: monitor OpenVPN client log file

This will monitor the amount of VPN clients connected and alert if that number falls below a threshold.

Create a new host item with a active check, assuming you are using the config file I posted in the OpenVPN writeup the Key will look like this;

log.count[C:\Program Files\OpenVPN\log\openvpn-status.log,^client,ANSI,100,all,0]

In Ubuntu Linux it would look similar to this;

log.count[/var/log/openvpn/openvpn-status.log,"^CLIENT_LIST,client",ANSI,100,all,0]

BTW; on Ubuntu Linux you will have to make the log visible to Zabbix agent;

sudo chmod 644 /var/log/openvpn/openvpn-status.log

I chose to make a new application for this, OpenVPN. The rest of this screen is largely up to you to decide.

Now when you go to Monitoring, Latest Data and find you server and application you should have a latest value there showing the number of VPN clients connected to that server.

  1. IF nothing is shown check the zabbix client config on that hosted server. C:\Program Files\Zabbix Agent\zabbix_agentd.conf
  2. Check line “Hostname=” and ensure that matches exactly with what the host name in Configuration > Hosts name column says. If a change is made restart the Zabbix agent service.
  3. C:\Program Files\Zabbix Agent\zabbix_agentd.log may also contain useful troubleshooting info.

Trigger

In Configuration > Hosts, click on the word triggers next to the host you want to notify. Click button top right, create trigger.

For the expression click add

  • Item; select OpenVPN for the server created in previous section.
  • Function; avg – average value of a period T
  • Last of (T); 5   (last five results), and change dropdown to Count
  • Result; < .2   (if one client use .2, if two use 1.2 etc.) (The idea here is to collect some samples. If the average is less than (total clients minus .2) then trigger the event.)

Make sure enabled is checked and set severity level