Log file trigger help

[nixman]

I have Zabbix monitoring a number of log files for the string "NOTICE" and this works as expected and I can see the data lines successfully being extracted from the log.

On some of the servers I generate core files to do internal program verification and this also generates a "NOTICE" line in the log file.

So now I have this item that contains the "NOTICE" string but I am trying to have the trigger fire only if the string does not also include "core"...

I thought I could check and reset the trigger like this but I get an "IS NULL" error for the regexp check....

{server:[log,NOTICE].regexp(core)}=0 & {server:[log,NOTICE].nodata(30)}#1

anyone with a suggestion feel free... log monitoring is not very well documented

[nixman]

nobody ?....

this seems like basic functionality
(1) use the log function to extract lines with the string "NOTICE"
(2) in the trigger check to ensure that the value does not contain the string "core"
(3) if no data has been sent for 30 seconds turn off the trigger

[[email protected]]

The logitem should be like log[file,NOTICE]
The trigger should be
{server:log[file,NOTICE].regexp(core)}=0 & {server:log[file,NOTICE].nodata(30)}#1

[nixman]

I appreciate the reply and its my fault for typing from memory... the trigger I was using is....

{server:log[file,"NOTICE"].regexp(core)}=0 & {server:log[file,"NOTICE"].nodata(30)}#1

the error in the zabbix log is....

3448:20090724:201756 Expression [{18926}=0 & {18925}#1] for item [35827][server:log[file,"NOTICE"]] cannot be evaluated: unable to get function value: lastvalue IS NULL for function [18926][server:log[file,"NOTICE"].regexp(core)]

the error is repeated every interval check