Search icon
Cart icon
Close icon
You have no products in your basket yet
Save more on your purchases!
Savings automatically calculated. No voucher code required
Arrow left icon
All Products
Best Sellers
New Releases
Learning Hub
Free Learning
Arrow right icon
Over 7,000 tech titles at $9.99 each with AI-powered learning assistants on new releases
Zenoss Core 3.x Network and System Monitoring
Zenoss Core 3.x Network and System Monitoring

Zenoss Core 3.x Network and System Monitoring: A step-by-step guide to configuring, using, and adapting this free Open Source network monitoring system

By Michael Badger
$32.99 $9.99
Book Apr 2011 312 pages 1st Edition
$32.99 $9.99
$15.99 Monthly
$32.99 $9.99
$15.99 Monthly

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now
Table of content icon View table of contents Preview book icon Preview Book

Zenoss Core 3.x Network and System Monitoring

Chapter 1. Network and System Monitoring with Zenoss Core

Whether it's internal or public-facing technology, businesses of all sizes depend on the availability of their IT assets, which may include servers, routers, networks, switches, and websites. If you're picking up this book, then you already know the value of monitoring and more than likely have an installation of Zenoss Core running.

Zenoss Core is an open source network and system monitoring platform that is sponsored by Zenoss, Inc. Zenoss, Inc, develops two versions of Zenoss: Core and Enterprise. Core belongs to the community and is supported by the community.

Enterprises adds some value-added features on top of the Core version, such as an extended report library, synthetic web transactions, certified monitors (ZenPacks), and a global dashboard for multiple Zenoss installations. The additional features allow Zenoss Inc., to sell the enterprise version as a commercial software product with support. As open source consumers, we're familiar with this business model. Our focus in the book is on Zenoss Core, but the concepts will also apply to Zenoss Enterprise.

Zenoss Core is a monitoring solution that can be as complex as you need it to be. And while just about anyone can install it, turn it on, and monitor "something," Zenoss Core is packed with features in a complicated interface. The interface has been drastically improved over version 2, but it's not the type of software you can intuitively use—in other words, a bit of guidance is in order.

The role of this book is to serve as your Zenoss Core tour guide and save you hours, days, maybe weeks of time. It's designed to quickly acquaint you with the core features so you can customize Zenoss Core to your needs. It's loaded with screenshots and provides a handy reference guide. Zenoss Core provides a monitoring solution that incorporates the following:

  • Device management

  • Availability monitoring

  • Performance graphs

  • Event management

  • User and alert management

  • Plugin architecture

  • Monitoring reports

To monitor your IT assets (servers, routers, switches, websites, and anything else attached to your network), you install Zenoss Core to a server. Even though Zenoss Core is intended to be installed on a Linux server, virtual appliances are available that allow Macintosh and Windows users to install a working version of Zenoss Core by using VMware.

After installation, you can manage your Zenoss Core installation and your monitoring setup from a web-based interface. The following screenshot shows a dashboard view:

The web portal is the face of the Zenoss Core system and is the place where we spend most of our time. It provides a single access point to the monitoring system and requires no operating-system-specific knowledge to use. The web interface features drag-and-drop dashboard portlets that display a customized view of the network's health at any given time.

Device management

At the heart of the device management capabilities, Zenoss Core uses a configuration management database (CMDB), which stores a model of the IT environment and its change history. Zenoss Core supports adding IT assets (I'll switch out of "executive-speak" and just refer to the "IT assets" as devices from this point on) to the CMDB one at a time or by auto-discovering active devices by walking the routing tables. Devices are then modeled via Simple Network Management Protocol (SNMP), SSH (or Telnet), or port scans.

Zenoss Core allows us to organize devices by user-defined locations, groups, and systems. One of Zenoss Core's most powerful organizational concepts is classes, which allow us to define monitoring characteristics based on a hierarchical classification of devices, which allows a device to inherit the monitoring properties of its parent class.

The following screenshot provides a look at a device status page:

Availability and performance monitors

By using ICMP and SNMP monitoring, Zenoss Core reports on the availability of the following:

  • Network devices

  • TCP/IP services and ports

  • URL availability

  • Windows services and processes

  • Linux/UNIX processes

Zenoss Core is Level-3 network topology aware, which reduces the amount of alert chatter by creating an event about the problem device only and not about the devices that depend on it.

Performance monitors collect time series data and provide us with a graphical analysis of the following components:

  • File system statistics

  • CPU and memory usage

  • JMX monitoring for J2EE servers (available via a ZenPack)

  • Nagios and Cacti plugin support

The following screenshot shows a graph based on Zenoss Core's monitoring activity:

Using the built-in event management system, we can configure Zenoss Core to generate an event if a monitored device crosses a defined threshold.

Event management

Zenoss Core monitors a variety of sources for signs of trouble, including syslogs, availability and performance monitors, SNMP traps, Windows event logs, and custom scripts. Core features of the event management system include:

  • Custom events

  • Automatic event prioritization

  • Event deduplication

  • Up/down event correlation

The following screenshot shows the Event Console:

The event system mitigates duplicate events and auto-clears events when the status of the event changes from down to up. Zenoss Core can also collect events from custom scripts and external applications.

In response to events, Zenoss Core can send e-mail or pager alerts, run a script, or do nothing. We configure how Zenoss Core responds to an event by defining alerting rules. Alerting rules are defined on a per user or user-group basis.

Plugin architecture

Zenoss Core provides several ways for us to extend the base functionality:

  • ZenPacks: Zenoss Core's add-on modules

  • Nagios plugins

  • Cacti plugins

We install and configure a Nagios plugin in Chapter 5, Custom Monitoring Templates.

The information presented there will be valuable for those of you who want to develop your own plugins.

The ZenPack architecture allows us to package plugins and configurations for distribution to other users and the community at-large. Chapter 9, Extending Zenoss Core with ZenPacks walks you through the steps of installing a community ZenPack, and how to create your own ZenPack as well.

System reports

Zenoss Core packages a set of standard reports that allow us to view what is happening right now, as well as what has happened in the past. The reports integrate with the device management, performance monitors, events, and user functionalities.

The following screenshot shows the All Monitored Components report:

Notice the number of additional reports listed in the sidebar.

Custom device reports

The canned reports are nice, but sometimes we need to access and analyze data that the included reports do not cover. Zenoss Core enables users to write custom device reports from the web interface, as seen in the following screenshot:

We step through the creation of custom device reports in Chapter 11, Writing Custom Device Reports.

System architecture

Reviewing the system architecture now provides us with an understanding that can help troubleshoot problems that may arise later. However, reading it to start using Zenoss Core is definitely not required. So feel free to come back later.

Zenoss Core builds upon several open-source software projects to create a robust network and systems management solution. The most notable open-source software components that integrate with Zenoss Core include Zope, Python, MySQL, RRDtool, and Twisted.

When we talk about the system architecture, it helps to conceptually segregate Zenoss Core into three layers:

  • User

  • Data

  • Collection

User layer

Zenoss Core is flexible enough to work from a command line, but most of our work will take place via a web interface, which is based on the Zope application server framework.

Zope is a popular, extensible application server written in Python. It features a built-in web server, transactional object database, and HTML templates. Python is the basis for Zope; it's also the basis for Zenoss Core.

Through the web interface, we provide input with both the data and collection layers to accomplish tasks related to the following areas:

  • Navigation and organization

  • Device management

  • Availability and performance monitors

  • System reports

  • Event management

  • Settings and administration

Data layer

As we might expect, databases are the heart of the data layer, and Zenoss Core stores data in three types of databases. The Collection layer funnels device information to ZenHub, which in turns stores the data in the appropriate place, as seen in the following illustration.

Events are stored in a MySQL database. Zenoss Core generates Events when an established threshold is crossed, such as a server outage or high memory usage. Events trigger actions, such as e-mail or pager alerts.

Time series performance data gets stored in a Round Robin Database (RRD). A RRD differs from a linear database, such as MySQL, in that it's circular—which means the size does not increase over time. Data is stored in a first in, first out basis, which implies that monitoring data is consolidated and eventually lost over time. RRDtool provides Zenoss Core with the ability to log and graph performance data.

The third database deployed by Zenoss is a Configuration Management Database (CMDB). The CMDB is an Information Technology Infrastructure Library (ITIL) standard for managing the configuration, relationship, and change history of the IT environment, which creates a detailed model of the network. Zenoss uses a Zope Object Database (ZODB) to house the CMDB.

Collection layer

The collection layer includes several daemons that gather information about devices, performance, and Events. They feed information to ZenHub to distribute to the appropriate database. The Zenoss Core daemons are easy to identify—they all start with the prefix "zen".

As the following screenshot illustrates, the Daemons page provides us with the complete view of the Zenoss Daemons that includes the process ID (PID) and up/down State. Green is up; red is down. From the interface, we can also view the Log File, edit the Configuration, and start and Stop each daemon.

If we browse the file system, we will find each daemon in $ZENHOME/bin. $ZENHOME is an environment variable, which allows us to talk about the Zenoss installation directory without knowing exactly where it is. For example, I may install to /usr/local/zenoss/zenoss while you install to /home/zenoss.

Twisted is an integral network communication protocol for the daemons. The Twisted Core README file describes Twisted as an "event-based framework for Internet applications"

Device management daemons

Finding the devices on our networks is a prerequisite to managing them, and Zenoss Core not only finds the devices, it models them. Device modeling builds a detailed overview of the network by recording the following types of information: system dependencies, available services, and change history.

The following table describes the daemons responsible for discovering and modeling devices:

Device daemon



Queries the devices via SSH/Telnet, SNMP, and port scans when we model the device. Each time zenmodeler runs on a device, it compares its findings with existing configuration and updates it as necessary.


Runs each time a request is made to discover a network or device.

Zenoss uses SNMP as a primary collection protocol. However, it can also collect information via ICMP pings, port scans, and plugins.

Performance and availability daemons

The Zenoss Core performance and availability daemons help us determine if the devices on our network are available and performing within our established guidelines. If our monitored systems perform in an unexpected way, Zenoss Core generates an event.

The following daemons play an important role in collecting performance and availability data:

Performance daemon



Stores the collected performance data in RRD files so that RRDtool can graph device performance over hourly, daily, weekly, monthly, or yearly durations.


Provides a way to run custom scripts and third party plugins including Nagios and Cacti plugins from within Zenoss.


Monitors the processes on Linux, Unix, and Windows systems.


Pings a device and reports an up or down status to determine if a device is active or not.


Tests the TCP ports and reports an up or down service.

Event daemons

When a device goes down or a service crosses a predetermined threshold, such as available disk space, Zenoss Core generates an event. Events can generate a notification alert or run a custom command (to automatically take remedial action to fix the event, for example).

Not only can Zenoss Core generate its own events, but it can collect events from external sources (for example, custom system administration scripts) and convert the information to a "Zenoss-style" event.

The following table outlines the Zenoss Core event daemons:

Event daemon



Creates events from syslog messages.


Creates events from Windows event logs.


Creates events from SNMP traps. When a problem occurs on a monitored device, it generates an SNMP trap to alert Zenoss of the problem.


In this chapter we provided a brief overview of Zenoss Core's monitoring capabilities and the underlying technology that makes it all work. It's our blueprint for what we'll discuss as we devote the rest of the book to configuring our monitoring environment. As we work through the rest of the book, we'll demonstrate the core concepts that will help you adapt Zenoss Core to your specific environment.

Feel free to treat each chapter as a stand-alone topic and skip around as needed. In Chapter 2, Discovering Devices we jump right in and discover devices.

Left arrow icon Right arrow icon

Key benefits

  • Designed to quickly acquaint you with the core feature so you can customize Zenoss Core to your needs
  • Discover, manage, and monitor IT resources
  • Build custom event-processing and alerting rules
  • Write custom device reports to extract, display, and analyze monitoring data
  • A handy reference guide with loads of screenshots
  • An update of Zenoss Core Network and System Monitoring rewritten for Zenoss 3.x


For system administrators, network engineers, and security analysts, it is essential to keep a track of network traffic. Zenoss Core is an enterprise-level systems and network monitoring solution that can be as complex as you need it to be. And while just about anyone can install it, turn it on, and monitor "something", Zenoss Core has a complicated interface packed with features. The interface has been drastically improved over version 2, but it's still not the type of software you can use intuitively – in other words, a bit of guidance is in order. The role of this book is to serve as your Zenoss Core tour guide and save you hours, days, maybe weeks of time. This book will show you how to work with Zenoss and effectively adapt Zenoss for System and Network monitoring. Starting with the Zenoss basics, it requires no existing knowledge of systems management, and whether or not you can recite MIB trees and OIDs from memory is irrelevant. Advanced users will be able to identify ways in which they can customize the system to do more, while less advanced users will appreciate the ease of use Zenoss provides. The book contains step-by-step examples to demonstrate Zenoss Core's capabilities. The best approach to using this book is to sit down with Zenoss and apply the examples found in these pages to your system. The book covers the monitoring basics: adding devices, monitoring for availability and performance, processing events, and reviewing reports. It also dives into more advanced customizations, such as custom device reports, external event handling (for example, syslog server, zensendevent, and Windows Event Logs), custom monitoring templates using SNMP data sources, along with Nagios, and Cacti plugins. An example of a Nagios-style plugin is included and the book shows you where to get an example of a Cacti-compatible plugin for use as a command data source in monitoring templates. In Zenoss Core, ZenPacks are modules that add monitoring functionality. Using the Nagios plugin example, you will learn how to create, package, and distribute a ZenPack. You also learn how to explore Zenoss Core's data model using zendmd so that you can more effectively write event transformations and custom device reports.

What you will learn

Discover devices and prepare your monitoring environment Set up, model, and configure devices Monitor availability and performance Customize monitoring templates using SNMP, Nagios, and Cacti data sources Process events via the event console and event commands Collect and process events (including event transformations) from non-Zenoss Core monitoring activities Administer Zenoss Core s users, alerting rules, data backups, and settings Review built-in reports and create custom graph and multi-graph reports Write custom device reports and explore Zenoss Core data model with zendmd Incorporate device and event attributes using TALES expressions throughout Zenoss Core

Product Details

Country selected

Publication date : Apr 15, 2011
Length 312 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781849511582
Concepts :

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now

Product Details

Publication date : Apr 15, 2011
Length 312 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781849511582
Concepts :

Table of Contents

21 Chapters
Zenoss Core 3.x Network and System Monitoring Chevron down icon Chevron up icon
Credits Chevron down icon Chevron up icon
About the Author Chevron down icon Chevron up icon
About the Reviewers Chevron down icon Chevron up icon Chevron down icon Chevron up icon
Preface Chevron down icon Chevron up icon
1. Network and System Monitoring with Zenoss Core Chevron down icon Chevron up icon
2. Discovering Devices Chevron down icon Chevron up icon
3. Device Setup and Administration Chevron down icon Chevron up icon
4. Monitor Status and Performance Chevron down icon Chevron up icon
5. Custom Monitoring Templates Chevron down icon Chevron up icon
6. Core Event Management Chevron down icon Chevron up icon
7. Collecting Events Chevron down icon Chevron up icon
8. Settings and Administration Chevron down icon Chevron up icon
9. Extending Zenoss Core with ZenPacks Chevron down icon Chevron up icon
10. Reviewing Built-in Reports Chevron down icon Chevron up icon
11. Writing Custom Device Reports Chevron down icon Chevron up icon
Event Attributes Chevron down icon Chevron up icon
Device Attributes Chevron down icon Chevron up icon
Example snmpd.conf Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon

Customer reviews

Top Reviews
Rating distribution
Empty star icon Empty star icon Empty star icon Empty star icon Empty star icon 0
(0 Ratings)
5 star 0%
4 star 0%
3 star 0%
2 star 0%
1 star 0%
Filter icon Filter
Top Reviews

Filter reviews by

No reviews found
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial


How do I buy and download an eBook? Chevron down icon Chevron up icon

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

  • You may make copies of your eBook for your own use onto any machine
  • You may not pass copies of the eBook on to anyone else
How can I make a purchase on your website? Chevron down icon Chevron up icon

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

  1. Register on our website using your email address and the password.
  2. Search for the title by name or ISBN using the search option.
  3. Select the title you want to purchase.
  4. Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title. 
  5. Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)
Where can I access support around an eBook? Chevron down icon Chevron up icon
  • If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
  • To view the errata for the book, see and view the pages for the title you have.
  • To view your account details or to download a new copy of the book go to
  • To contact us directly if a problem is not resolved, use
What eBook formats do Packt support? Chevron down icon Chevron up icon

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks? Chevron down icon Chevron up icon
  • You can get the information you need immediately
  • You can easily take them with you on a laptop
  • You can download them an unlimited number of times
  • You can print them out
  • They are copy-paste enabled
  • They are searchable
  • There is no password protection
  • They are lower price than print
  • They save resources and space
What is an eBook? Chevron down icon Chevron up icon

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.