Skip to content

Auditing & Monitoring — Cheatsheet

Logging, local monitoring, Zabbix and SNMP — 2024–2025

Table of Contents

Monitoring and Auditing

Term Purpose
Monitoring tracking state and performance
Logging recording events chronologically
Auditing demonstrating who did what and when
Alerting reacting when a condition occurs
Observability explaining behavior from metrics, logs and traces

Monitoring mainly answers what's happening right now?; auditing supports who did what and was it allowed?. A metric without context or an action threshold is rarely useful.

A good monitoring cycle

goal → indicator → data source → collection → baseline → trigger → action → evaluation

Monitor what users experience

A running process is not proof that the service works. Combine resource, service and end-to-end checks.

Measurement Strategy

Type Examples
Availability ping, port, HTTP response, process status
Performance CPU, RAM, latency, throughput, queue length
Capacity free disk, database growth, interface speed
Correctness status code, content check, checksums
Security failed logins, privilege changes, config changes
  • Build a baseline of normal behavior first.
  • Choose the interval based on rate of change and risk.
  • Avoid alert fatigue: every alert needs an owner and a course of action.
  • Consider both false positives and false negatives.
  • Account for retention, privacy, storage and time synchronization.

Linux Monitoring

uptime
top
free -h
df -hT
du -sh /var/*
lsblk
ip -s link
ss -tulpn
ps aux --sort=-%cpu | head
systemctl --failed
Signal Interpretation
load average runnable/uninterruptible tasks; compare with CPU count
%wa CPU waiting on I/O
available memory more useful than free alone
swap in/out memory pressure, not just allocated swap
filesystem usage check capacity as well as inode usage 
journalctl -p warning..alert
journalctl -u ssh --since today
journalctl -f

Windows Monitoring and Auditing

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Get-Service | Where-Object Status -ne Running
Get-Counter '\Processor(_Total)\% Processor Time'
Get-Volume
Get-NetAdapterStatistics

Key tools: Task Manager, Resource Monitor, Performance Monitor, Event Viewer and PowerShell.

Event logs

Log Contents
Application applications and services
System drivers and Windows components
Security audit events
Setup installation/configuration 
Get-WinEvent -LogName System -MaxEvents 50
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)}

Audit policy determines which success/failure events get recorded. Without a policy, there's no evidence afterward; overly broad auditing causes noise and storage pressure.

Logging

A useful log record contains a timestamp with timezone, source/host, severity, event ID/type, identity, action, result and correlation ID.

Syslog severity ranges from 0 Emergency to 7 Debug; a lower number is more severe.

Level Meaning
0–2 emergency, alert, critical
3–4 error, warning
5–6 notice, informational
7 debug

Centralize logs so an attacker cannot easily wipe them at the source. Use NTP, transport security, access control, rotation and retention.

Secrets

Never log passwords, tokens, private keys or unnecessary personal data.

Zabbix Architecture

agents / SNMP / IPMI / web checks
              ↓
       Zabbix server/proxy
              ↓
            database
              ↓
          web frontend
Component Function
Server polling, trapping, evaluation and actions
Agent OS and application metrics on the host
Proxy collects for remote sites and buffers
Database configuration, history and trends
Frontend configuration, visualization and management

Passive agent: the server requests data. Active agent: the agent requests the item list and sends values. Active checks often work better behind NAT/firewalls.

Hosts, Items and Preprocessing

A host has a name, visible name, groups, interface(s), templates and macros. The hostname must exactly match for active agent checks.

An item defines:

  • type (agent, SNMP, trapper, simple check, HTTP agent, ...);
  • key/OID/URL;
  • data type and unit;
  • update interval and history/trend retention;
  • preprocessing and tags.

Examples of agent keys:

system.cpu.util[,user]
vm.memory.size[available]
vfs.fs.size[/,pfree]
net.if.in[eth0]

Preprocessing can apply JSONPath, regex, multiplier, delta per second, trimming and discard-unchanged. Test preprocessing with real input.

Triggers, Events and Actions

A trigger evaluates item history and gets a severity. Conceptually:

item value → trigger expression → problem event → action → notification/command
                                            ↓
                                      recovery event

Use hysteresis to avoid flapping: don't let problem and recovery switch at exactly the same threshold.

problem:  free disk < 10%
recovery: free disk > 15%

Actions consist of conditions, operations and recovery/update operations. Media types determine the channel (mail, webhook, ...); a user needs media, an active period and a matching severity.

Test the full chain

A correct trigger doesn't guarantee a notification. Test the event, action conditions, user permissions, media and delivery.

Templates and Visualization

Templates bundle items, triggers, graphs, discovery rules, dashboards and macros. Link the same template to multiple hosts and override differences with user macros such as {$CPU.WARN}.

  • Low-level discovery automatically creates items/triggers for filesystems or interfaces.
  • Graphs show time series; dashboards combine widgets.
  • Maps show dependencies and status; use them for operational overview, not as static decoration.

A trigger dependency prevents follow-up alerts: if a router is down, all unreachable hosts behind it don't need to alert individually.

SNMP

Term Meaning
Manager/NMS requests and receives data
Agent runs on the monitored device
MIB semantic description of objects
OID numeric object identifier
GET/GETNEXT/GETBULK retrieve data
SET change a value
Trap/Inform agent sends an event
Version Security
v1 community string, no real security
v2c more efficient/GETBULK, still a community string
v3 users, authentication and privacy/encryption

Use SNMPv3 authPriv where possible, restrict source IPs, and grant read-only access.

snmpget -v2c -c public 192.0.2.10 1.3.6.1.2.1.1.3.0
snmpwalk -v2c -c public 192.0.2.10 1.3.6.1.2.1

ifIndex can change after a reboot/config change; discovery and interface identification based on stable properties avoid incorrect graphs.

Web and Log Monitoring

A web scenario consists of steps with a URL, method, headers/body, expected status, content check and timeout. For HTTPS, also check certificate validity and expiration.

Log items must follow newly added lines, not reread the entire file each time. Use rotation-aware keys and targeted regex.

availability: HTTP 200
correctness:  page contains an expected feature
performance:  response time under a threshold
security:     TLS certificate valid and not close to expiry

Zabbix diagnostic order

  1. Is the host/interface reachable from the server/proxy?
  2. Are the agent/SNMP credentials and firewall correct?
  3. Is the item supported and does recent data come in?
  4. Are data type, preprocessing and interval correct?
  5. Does the trigger evaluate as expected?
  6. Does the action match, and can the media type deliver?