ZABBIX Forums  
  #1  
Old 05-12-2017, 17:45
moshikoy moshikoy is offline
Junior Member
 
Join Date: Aug 2017
Posts: 16
Question Log Monitor mail flood prevention

Hi,
Recently I've created a log file monitor. and an action to inform by mail on patterns found in log files.
when monitoring /var/log/syslog, in case of a RAM issue the log is filled with thousands of errors and all are being caught and an email is being sent for each alert (which caused my email to receive 100,000 emails from zabbix log file monitor.

How can I avoid this from happening in the future?

Thanks,
- Moshe
Reply With Quote
  #2  
Old 06-12-2017, 10:40
andris andris is offline
Senior Member
 
Join Date: Feb 2012
Location: Riga, Latvia
Posts: 126
Default

You can take a look into <maxdelay> parameter for log[], log.count[], logrt[], logrt.count[] items - see https://www.zabbix.com/documentation...s/zabbix_agent.

<maxdelay> parameter was designed to deal with fast growing log files by skipping records in case of huge number of messages in short time.

Also consider using log.count[] or logrt.count[] - they do not send every matching record to server but only number of matching records.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 03:24.