ZABBIX Forums  
Old 05-12-2017, 17:45
moshikoy moshikoy is offline
Junior Member
Join Date: Aug 2017
Posts: 22
Question Log Monitor mail flood prevention

Recently I've created a log file monitor. and an action to inform by mail on patterns found in log files.
when monitoring /var/log/syslog, in case of a RAM issue the log is filled with thousands of errors and all are being caught and an email is being sent for each alert (which caused my email to receive 100,000 emails from zabbix log file monitor.

How can I avoid this from happening in the future?

- Moshe
Reply With Quote
Old 06-12-2017, 10:40
andris andris is offline
Senior Member
Join Date: Feb 2012
Location: Riga, Latvia
Posts: 134

You can take a look into <maxdelay> parameter for log[], log.count[], logrt[], logrt.count[] items - see

<maxdelay> parameter was designed to deal with fast growing log files by skipping records in case of huge number of messages in short time.

Also consider using log.count[] or logrt.count[] - they do not send every matching record to server but only number of matching records.
Reply With Quote
Old 21-12-2017, 20:04
tgrissom tgrissom is offline
Junior Member
Zabbix certified professionalZabbix certified specialist
Join Date: Nov 2017
Location: Sunny Florida USA
Posts: 7
Default Log mode 'Skip'

In Zabbix 3.0 at least, there is a field "mode" that if you specifies 'skip' will cause the monitor to send items from the current end of file moving forward .

From the 3.0 documentation regarding the log and logrt items:

mode - possible values: all (default), skip - skip processing of older data (affects only newly created items)."
You may also look at the max lines but Skip is what specifically you are asking about for newly created items.
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

All times are GMT +2. The time now is 00:26.