Getting Zabbix to check a log once a day...

[Govenor]

Greetings,

I am trying to setup a few items and triggers to monitor file movement. Currently we have a process that takes a .dat file, moves it to a server, processes it, and creates a log file. That log file is what I am trying to get Zabbix to monitor and I need it to three things.

1. Once a day the errorlog.txt should have been modified by no latter than 7am starting at 650am. If it has not been modified by 7am, to send an alert.

I am not sure what function for the trigger I should set for it to only check once a day at this time, or if even Zabbix can do that?

2. After this log file has been modified, and contains the words Error, Zero, or Failed in it, it needs to send an alert. I have already set the item as log[<filepathname on the host>\errorlog.txt,Error|Failed|Zero] and I dont know why but to see if the item is working i went into Monitoring>Latestdata and the item on that host says "Accessible Only as Active Check" Which I am not sure that means considering the status of it is Active, and the Type is Zabbix Agent (active), so I dont know why Zabbix isnt able to collect data on that item.

I just dont know how to set the trigger, again, to only do this once a day?

3. To check that .dat file that resides on that server to make sure that the file has been modified and if it process stagnant data (data that hasnt changed in 24hrs) to also alert someone that our process has (or is about to) process old data.


Also, is there a Maximum number for the delta trigger function? If not I guess i could just set it to 86400 or so to equal one day? I know it sounds like alot, but any help would be GREATLY appreciated, for I feel myself going gray, as I type this up.... :eek:

(And yes I have been staring at the Manuel for a few hours with not help, and I am using Zabbix 1.6.8)

Regards

[simonuk1]

You probably better writing a script on that zabbix can run at 7am to check the file and then write a flag file for zabbix to check etc.

running the log monitoring and giving it a time period for the error and checking existence of update file might be a bit a a pain.

[Govenor]

even if I have to do this for 19 other servers?

I as hoping to get it right once in zabbix with the items and triggers, and then just clone, change the variables, rinse and repeat as nessary for all 19 of my servers that this process runs on. I was hoping Zabbix would be able to do this with some sort of ease?

[exkg]

Hi,


1. if you set some 'strings' to search your item can update every 1 second (this a agent task and will only send any data to server accordind the wanted string). To get alerts in specific periods you need use TIME funcion:

time - Returns current time in HHMMSS format. Example: 23055

Use of function time():
({zabbix: system.cpu.load[all,avg1].min(300)}>2)&({zabbix:
system.cpu.load[all,avg1].time(0)}>000000)& ({zabbix:
system.cpu.load[all,avg1].time(0)}<060000)
The trigger may change its status to true, only at night (00:00-06:00) time.

2. A good start point: http://www.zabbix.com/documentation/1.8/manual/log_file_monitoring. Have you active checks active in agent side ?

3. I think "vfs.file.time[file<, mode>]" can help in this case;



[]s,
Luciano

[porban]

The function time is not supported in version 1.8.2.
How can I do the same check ({zabbix:
system.cpu.load[all,avg1].time(0)}>000000) in the version 1.8.2 ?

[Inspiring]

My Dos batch file returns the file name if they are created today:

findfile.bat (in UK time format):

@echo off
cd /d %1
for /f "Tokens=1-3 Delims=/ " %%a in ('date /t') do set dd=%%a&set mm=%%b&set yy=%%c
dir /TW %2 | find /C "%dd%/%mm%/%yy%"

Then set up in Zabbix:

zabbix_agentd.conf:

UserParameter = companyName.checkfile.taskName,"C:\Program Files\Zabbix Agent\findfile.bat" "D:\Thefilefolder" *.tib

At last, at the Zabbix I have this trigger:

({Server:companyName.checkfile.taskName.last(0)}<1)&({Server:companyName.checkfile.taskName.time(0)}>160000)&({Server:companyName.checkfile.taskName.time(0)}<180000)

So overall, if a .tib file is not created between 4 and 6 PM, then the trigger will be on.

Hope that the above is helpful!

[Twirrim]

I know this is a bit of a necropost, but I'm looking at doing something similar to this now, and this is what came up on a search and figure others might come across this when they search.

I have files that should be updated every minute. I want to be alerted if they haven't been updated for more than 5 minutes.

Here's what I've figured out today that seems to be working:

vfs.file.time[/path/to/file/monitored], set up to check every 60 seconds and stored as Delta (Simple Change). If everything is running smoothly the returned figure should be no less than 60. If everything has failed on the system that delta will be 0.

The I've got a trigger set up to watch that figure, if it remains at 0 for more than 5 minutes, trigger an alert.

In your case add a vfs.file.time to monitor the file you want checked, set it at a long check interval. Then get it to alert you if within, say, a 24 hour period the delta never goes above 0. If it's working that delta should change at some point. I'm not sure about checking at a specific time but that should at least get you in the right ball park?