ZABBIX Forums  
  #1  
Old 20-09-2017, 07:58
0226 0226 is offline
Junior Member
 
Join Date: Sep 2017
Posts: 4
Default Regarding LOG Monitoring.

Regarding LOG Monitoring. I want a trigger to be active only if a error occurred "5 times in a log file in last 2 minutes". this was done using below trigger.
"{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0"
but question is if trigger set to active state once it will never go back to ok state.
how can i set if this process did't repeat in next 3-4 minutes then set it to normal OK state.
Reply With Quote
  #2  
Old 20-09-2017, 11:44
kasik kasik is offline
Junior Member
 
Join Date: Aug 2017
Posts: 21
Lightbulb manual close

Quote:
Originally Posted by 0226 View Post
Regarding LOG Monitoring. I want a trigger to be active only if a error occurred "5 times in a log file in last 2 minutes". this was done using below trigger.
"{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0"
but question is if trigger set to active state once it will never go back to ok state.
how can i set if this process did't repeat in next 3-4 minutes then set it to normal OK state.
i'm not so sure if this will solve your problem but what about using manual close? because when you know about it and solve it then u can close it manualy.
Reply With Quote
  #3  
Old 20-09-2017, 14:18
Semiadmin Semiadmin is offline
Senior Member
 
Join Date: Oct 2014
Location: Moscow, Russia
Posts: 530
Send a message via Skype™ to Semiadmin
Smile

{Zabbix server:log["/opt/test.log","error text"].count(120,"error text")}>4
Or, may be
{Zabbix server:log["/opt/test.log","error text"].count(120,"error text")}=5
if you need exactly 5 errors in 2 minutes
Reply With Quote
  #4  
Old 20-09-2017, 14:27
0226 0226 is offline
Junior Member
 
Join Date: Sep 2017
Posts: 4
Default Regarding log monitoring

Quote:
Originally Posted by kasik View Post
i'm not so sure if this will solve your problem but what about using manual close? because when you know about it and solve it then u can close it manualy.
Could you please help regarding my query.

trigger to be active only if a error occurred "10 times in a log file in last 10 minutes".

below was working fine only for this condition.
{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0


if i use condition .count(600,10) it is not working. when 5-6 alerts appeared it set alert in active mode.

in short my query is --> a trigger to be fired active only if "error text" occurred 10 times in last 10 minutes. and after some time it must set it to OK state.

please help.
Reply With Quote
  #5  
Old 20-09-2017, 14:40
Semiadmin Semiadmin is offline
Senior Member
 
Join Date: Oct 2014
Location: Moscow, Russia
Posts: 530
Send a message via Skype™ to Semiadmin
Default

0226, just try to read about "count" function
https://www.zabbix.com/documentation...gers/functions
and you'll uderstand all thing
Reply With Quote
  #6  
Old 23-09-2017, 08:03
0226 0226 is offline
Junior Member
 
Join Date: Sep 2017
Posts: 4
Default Regarding log monitoring

Quote:
Originally Posted by Semiadmin View Post
0226, just try to read about "count" function
https://www.zabbix.com/documentation...gers/functions
and you'll uderstand all thing
we are able to get alert according to our need. see below trigger.

{Zabbix server:log["/opt/test.log","ERROR",,300].count(5m,"ERROR")}>9

alert will be active (Problem State) if we will received "Error" more than 9 in last 5 minutes.but we are not able to take back this alert to the OK state. please help.

Note: lets assume alert got active. and now "Error" keyword is not appearing in log file, then it will not set it to OK State.

Any help would be appreciated.
Reply With Quote
Reply

Tags
count, item, log, monitoring, trigger

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 12:06.