issues with logrt item on ver 1.8.1

[paebersold]

I'm trying to use the logrt item to monitor text logfiles of the below format

/var/tmp/logtest/log.DD

ie
# ls /var/tmp/logtest
log.1 log.2

I want to match the string "error" (this is a simple test case)

However I can't get any matching occuring. Instead the zabbix agent goes into a cpu loop around the init_logfiles() routine. Ie cpu load increases, the log file (running in debug level 4) is full of "init_logfiles()", etc.

The item line I have is...

logrt[/var/tmp/logtest/log,error]

I tried various different file paths (eg /var/tmp/logtest/log*, /var/tmp/logtest/log.*) however all result in the same end result (cpu loop).

The server is Solaris 10, Zabbix 1.8.1 (revision 9702). Below is an example of the log file loop I see...

28395:20100128:165315.415 In init_logfiles()
28395:20100128:165315.415 We are in the *nix directory reading cycle.
28395:20100128:165315.415 Cannot process read entry [/var/tmp/logtest//.].
28395:20100128:165315.415 Cannot process read entry [/var/tmp/logtest//..].
28395:20100128:165315.415 Adding the file [/var/tmp/logtest//log.1] to logfiles.
28395:20100128:165315.415 In add_logfile() filename: [log.1] mtime: [1264657142]
28395:20100128:165315.415 Adding the file [/var/tmp/logtest//log.2] to logfiles.
28395:20100128:165315.416 In add_logfile() filename: [log.2] mtime: [1264656247]
28395:20100128:165315.416 In free_logfiles() number of logfiles [2]
28395:20100128:165315.416 In process_logrt() filename [/var/tmp/logtest/log] las
tlogsize [512] mtime [1264656169]
28395:20100128:165315.416 In split_filename()
28395:20100128:165315.416 In split_string()
28395:20100128:165315.416 "part1" [/var/tmp/logtest/]
28395:20100128:165315.416 "part2" [log]
28395:20100128:165315.416 In init_logfiles()
28395:20100128:165315.416 We are in the *nix directory reading cycle.
28395:20100128:165315.416 Cannot process read entry [/var/tmp/logtest//.].
28395:20100128:165315.416 Cannot process read entry [/var/tmp/logtest//..].
28395:20100128:165315.416 Adding the file [/var/tmp/logtest//log.1] to logfiles.
28395:20100128:165315.417 In add_logfile() filename: [log.1] mtime: [1264657142]
28395:20100128:165315.417 Adding the file [/var/tmp/logtest//log.2] to logfiles.
28395:20100128:165315.417 In add_logfile() filename: [log.2] mtime: [1264656247]
28395:20100128:165315.417 In free_logfiles() number of logfiles [2]
28395:20100128:165315.417 In process_logrt() filename [/var/tmp/logtest/log] las
tlogsize [512] mtime [1264656169]
28395:20100128:165315.417 In split_filename()
28395:20100128:165315.417 In split_string()
28395:20100128:165315.417 "part1" [/var/tmp/logtest/]
28395:20100128:165315.417 "part2" [log]
28395:20100128:165315.417 In init_logfiles()

So is my logrt just wrong or is something else going on here?

Thanks.

[richlv]

log.* should be the correct syntax. do the files contain 'error' string ?
what is item interval set to ?
why do you think there's a problem ?

[paebersold]

Hi richlv,

Yes, the log does contain the string "error". Ie my test file has...

# cat /var/tmp/logtest/log.1
asdf
fff
error asf
asfs
error

Update interval is set to 30 seconds.

There is a problem because zabbix hasn't detected any of the "error" strings in the file. Ie I do a "echo error >> /var/tmp/logtest/log.1" and zabbix does not detect it. This added to the fact that zabbix with the logrt item enabled uses 20-40% of the cpu instead of the normal less than 1%.