Logging triggers in zabbix_server.log

[hajducko]

Is there anyway to get Zabbix to log to the zabbix_server.log when a trigger is.. triggered? I'd like to do this without setting debug to 4, as it generates way too much information.

We use Splunk, a log monitoring software and we'd like to feed the zabbix server log into Splunk in order to see trending on alerts. Unfortunately, I can't figure out to make zabbix actually log that a trigger has been fired and there is an alert. Debug generates way too much information when set to 4, and hardly anything when set to 3.

[igor]

Hi!
No, unfortunately there are NO another way to show alerted triggers except setting DebugLevel=4 in the zabbix_server.conf file.

[trikke]

Hi,

You could create a action, that fires on Trigger=ok and Trigger=Problem ( so every event created by a trigger) and writes {TRIGGER.NAME}: {TRIGGER.STATUS} or whatever info you need, in a file.
Could this be a solution to your problem?

Greets
Patrick

[hajducko]

We ended up writing a custom media script that sends the message to syslog. We then created a 'syslog' user with that media type and setup an Action for all triggers with a status of PROBLEM to send to that user.

That way, we see our messages in syslog and can use Splunk to monitor the syslog file and get trending and a better view of how many alerts we've been receiving and when.

[richlv]

Is there anyway to get Zabbix to log to the zabbix_server.log when a trigger is.. triggered? I'd like to do this without setting debug to 4, as it generates way too much information.
...
Debug generates way too much information when set to 4, and hardly anything when set to 3.

that's a common problem. feel free to vote on https://support.zabbix.com/browse/ZBXNEXT-136

[joseph743]

script

We ended up writing a custom media script that sends the message to syslog. We then created a 'syslog' user with that media type and setup an Action for all triggers with a status of PROBLEM to send to that user.

That way, we see our messages in syslog and can use Splunk to monitor the syslog file and get trending and a better view of how many alerts we've been receiving and when.

Hi,
is it possible if you can share the script, i am facing the same issue and would be glad if you could help me

[kaspars.mednis]

the simpliest script i have used in action is

echo  {DATE} {TIME} {TRIGGER.VALUE} {TRIGGER.NAME} {ITEM.LASTVALUE}}>> /tmp/log.tmp

create it for both operation and recovery operation as remote command and you will get log like

2017.10.12 05:53:57 0 testfile has been changed on test.zbx 400422973
2017.10.12 05:54:57 1 testfile has been changed on test.zbx 3376750012
2017.10.12 05:55:57 0 testfile has been changed on test.zbx 3376750012

P.S
if you want log to syslog, use logger command instead of echo

best regards,
Kaspars