Custom log monitoring

[horakmar]

Hello everybody, please help if you know.
I would like to monitor AIX errorlog, which is unfortunately binary ring buffer. I can do it with AIX native tool errpt and some scripting.
I defined custom item 'errorlog' of type log, on client side connected to script
(UserParameter=errlog,/usr/local/bin/zabbix_errpt)
But custom scripts are supposed to always return some value
(# Note that shell command must not return empty string or EOL only.)
So what should I return from script, when there are no new records in errorlog?
When I return nothing, I got in Zabbix log:
Active check [errlog] is not supported. Disabled.
When I return anything else (for example digit 0), i got that recorded for every monitoring interval.

Thank you,
Martin

[alixen]

Hi,

May be you could change your item type to "Zabbix trapper" and send data directly from your script with zabbix_sender. This way, you send only when you have some data.
Since your script will not be called automatically by Zabbix, you'll have to set a cron job for that.

Regards,
Alixen

[horakmar]

Yes, that's possible, thank you.
But I still wonder, how to perform custom monitoring of parameter of type log.

[alixen]

Hi,

But I still wonder, how to perform custom monitoring of parameter of type log.

I'm not sure to understand what you mean by "custom monitoring".
If you mean defining some triggers, trigger functions that apply to log type items apply: str, regexp, iregexp; and of course, more general functions as last, prev, change,...

Regards,
Alixen

[horakmar]

Custom log monitoring

Hi,
I'm not sure to understand what you mean by "custom monitoring".
If you mean defining some triggers, trigger functions that apply to log type items apply: str, regexp, iregexp; and of course, more general functions as last, prev, change,...
Regards,
Alixen

I mean writing script or program running on client, which monitor some special (binary, encrypted, etc.) log file. It is integrated into Zabbix by "UserParameter=..." in client config. The type of this item is "log".
Question is: What should the client script return, if there isn't new data in the monitored log?
Of course there is the solution through Zabbix trapper and sender. But is it possible also through UserParameter?

Martin

[alixen]

Hi,

Of course there is the solution through Zabbix trapper and sender. But is it possible also through UserParameter?

My understanding is that it is not possible because Zabbix agent only manages log items internally (eventlog, log and logrt parameters) but I may be wrong.

Maybe some Zabbix developper could give you a better answer.

Regards,
Alixen

[sammiam]

zabbix monitoring for errpt

Here's how I monitor my errpt logs using zabbix:

1) create a UserParameter on my AIX host
UserParameter=aix.errpt,errpt -T PERM,UNKN,TEMP | wc -l | awk '{print }'

2) create an item in my AIX OS Template called aix.errpt I set mine to run once an hour

3) create a trigger:
Name: ERRPT
Expression: {Template OS AIX:aix.errpt.change(0)}#0

What this does is perform a "line count" of the number of lines that the "errpt" command produces, and if the difference between the current and last time that the monitor ran is not zero, then an alert, in my case, a page is sent to my pager letting me know that a TEMP, UNKN (unknown), or PERM entry was just put into errpt.