Help Monitoring logs with zabbix 1.1 alpha10

[phpkid]

I am testing the new log monitoring using active check. Zabbix is storing the data from the log, I have setup a trigger like so...

{zabbix:log[/var/log/messages].str(failure)}=0

looking for a failure in the syslog. Testing by echoing "failure" in the log does not fire off the trigger. Do I have the trigger setting wrong? Sould it equal 1 instead of 0? Any help would be greatly appreciated.

TIA,
Troy

BTW.... Zabbix rocks!

[phpkid]

Re:

Has anyone run into this?

Troy

[Nate Bell]

What exactly does log[/var/log/messages] do? As far as I am aware, this item is not built into Zabbix. Your use of it seems to suggest it's supposed to return the text of messages.

I haven't tried it, but unless you have set up a custom script to interpret all that data, I'm afraid Zabbix won't know what to make of it. If that's the case, you probably want to grep failure /var/log/messages | wc -l which will return 0 if no instances of failure were found, or >0 if ones were found. Or, you could grep for failure in the file, and echo none is no instances were found, and echo failure is some were.

{zabbix:log[/var/log/messages].str(failure)}=0 is checking the last string stored for the item log to see if the string failure is present. If it returns 1 the string is there, and if it returns 0, the string isn't. So even if your item is collecting the data you expect it is, your trigger is set to go off if it doesn't find failure in the last item.

Hope some of that helps,
Nate