Monitoring Log File and related trigger

[g.vecchi]

Hi all.
I would to set up an item that check if a string matches in a rotate log file during a setted interval (N seconds): when it match in the interval, the trigger have to generate a PROBLEM event, but, if in the next interval it doens't match anymore, the trigger have to generate an OK event.

I've tried in this way:

Item:
Type: Zabbix Agent (active)
Key: logrt["/path/to/file.log","String","UTF-8",10]
Type of information: Log
Update interval (in sec): N

Trigger:
Expression: {host:logrt["/path/to/file.log","String","UTF-8",10].str(String)}=1
Event generation: Normal

The trigger generate a PROBLEM event as soon as the String match, but it still remains in this state in spite of the String doesn't match in next update interval.

I hope I've been as clear as possible...

Any ideas?

[JBo]

Hi,

I've tried in this way:

Item:
Type: Zabbix Agent (active)
Key: logrt["/path/to/file.log","String","UTF-8",10]
Type of information: Log
Update interval (in sec): N

You are only collecting lines that contain "String".

Trigger:
Expression: {host:logrt["/path/to/file.log","String","UTF-8",10].str(String)}=1
Event generation: Normal

The trigger generate a PROBLEM event as soon as the String match, but it still remains in this state in spite of the String doesn't match in next update interval.

Since Zabbix receives only lines with "String", it will always stay in PROBLEM state.

Aby ideas?

Just remove "String" condition from your key:
Key: logrt["/path/to/file.log",,"UTF-8",10]

Hope this helps
JBo

[g.vecchi]

Ok, I will try.
Can you explain me better the value "10" in:

logrt["/path/to/file.log","String","UTF-8",10]

The manual (http://www.zabbix.com/documentation/...ile_monitoring) says that:

"Zabbix Agent does not send more than maxlines of a log file per second. The limit prevents overloading of network and CPU resources and overrides the default value provided for MaxLinesPerSecond parameter in the configuration file of the agent."

but, I configure the item update interval N that's different to maxlines interval (1 second), so I can't understand what it is used for...

Thanks

[JBo]

Ok, I will try.
Can you explain me better the value "10" in:

logrt["/path/to/file.log","String","UTF-8",10]

The manual (http://www.zabbix.com/documentation/...ile_monitoring) says that:

"Zabbix Agent does not send more than maxlines of a log file per second. The limit prevents overloading of network and CPU resources and overrides the default value provided for MaxLinesPerSecond parameter in the configuration file of the agent."

but, I configure the item update interval N that's different to maxlines interval (1 second), so I can't understand what it is used for...

Thanks

It just means that you won't receive more than 10*N lines per update.

I tend to stick with simple setups so, in this case I would just use:
logrt["/path/to/file.log"]
(default values are generally OK).

Regards,
JBo

[g.vecchi]

[SOLVED] Monitoring Log File and related trigger

It works! (I set maxlines=100)
Thank you very much for your support guy.

Bye!