log file monitoring fields

[angelhc]

Hello all,

We need to monitor a value on the field #11 (for example, and the field separator is a pipe) and evaluate if this value is bigger than 10 secons on a very updated log ( ~100 values per second) so with the log item is not possible because it can't find for field separator.

Any idea?

Thanks!!

[Colttt]

can you tell me an example?? sorry but i dont understand you.

[angelhc]

Ok, maybe I've to explaint it better

Log example line:
2011-01-18 09:17:24,578|invoicepeti|4|111|2|55.5

What I want to check is
If the field #3 is equal to "invoicepeti" and field #7 is greatter than "50" in more than 3 lines on the same check (one check = 100 lines max) send an event to zabbix, or maybe I've to do an shell script daemon to check this log and use zabbix_sender?...

[dima_dm]

: maybe I've to do an shell script daemon to check this log and use zabbix_sender?...

UserParameter (or zabbix_sender) and script is use much better for large logfile, plural search of the samples and complex search, statistics.
log it is type text, for it it is possible to use only string functions, but no mathematical functions.
See

http://www.zabbix.com/forum/showthread.php?t=20530

[Colttt]

Log example line:
2011-01-18 09:17:24,578|invoicepeti|4|111|2|55.5

What I want to check is
If the field #3 is equal to "invoicepeti" and field #7 is greatter than "50" in more than 3 lines on the same check (one check = 100 lines max) send an event to zabbix, or maybe I've to do an shell script daemon to check this log and use zabbix_sender?...

awk '/invoicepeti/ {if ($7 > 50) print "1"}' /var/log/EXAMPLELOG

in zabbix_agentd.conf:

UserParameter=error.log,awk '/invoicepeti/ {if ($7 > 50) print "1"}' /var/log/EXAMPLELOG

now you can say zabbix-server if error.log = 0 all its ok and when its 1 you hav an error..

[angelhc]

Thanks so much!!! it's running perfectly.
We never use the user parameter on this way and I think is a powerfull tool.