Clearing Events from LogFile monitoring

[mbrand5371]

Configured the following item:

log[/var/log/lskn/lskn_procmon.log,alert]

With the following trigger:

({LSKN_Template_LOG_procmon.log:log[/var/log/lskn/lskn_procmon.log,alert].str(alert)}>0)

Will send us an event (critical) if the log file has the following content:

Thu Nov 5 09:26:31 CET 2009 alert: Dies ist ein Test

But the log file has no "OK" statement. How can i reset the trigger status autmoatically or manually. "ack" will not work for me since the trigger state is not changed.

[mbrand5371]

Second idea

Configured the following item:

log[/var/log/lskn/lskn_procmon.log]

With the following trigger:

({LSKN_Template_LOG_procmon.log:log[/var/log/lskn/lskn_procmon.log].str(alert)}>0)

Will send us an event (critical) if the log file has the following content:

Thu Nov 5 09:26:31 CET 2009 alert: Dies ist ein Test

To avoid getting an complete backup from the servers logfile i've changed the "keep history" value in the item to one day.

But (there's always a but): zabbix will check the log every 10 minutes. How can i set up the trigger to stay longer as the next check without this conditoin?

Example:
The trigger ist working fine and changed to "problem".
The log will continue with another entrys.

This will normally set back the trigger, but i want to hold him for a custom defined time.

Any ideas ?

[richlv]

well, short answer - see 'str' function documentation

long one just a copy from the manual :

"Find string in last (most recent) value. Parameter defines string to find. Case sensitive!
Second optional parameter is number of seconds or number of lines to analyse. In this case more than one value will be processed."