Complex Log monitoring with UserParameter and unsupported item

[hirschnf]

I don't know, is it a bug or is it a feature.

I want to monitor a logfile which is not a simple phrase. So I wrote a little Shell-Script und put it to the agent config as a UserParameter.
If the script found the expression it returns the matched lines, if not it returns nothing.
But if a UserParameter returns nothing it will be mark as an unsupported item.
And this is poor.
Because the script is only running every 10 minutes - i think it's the interval for unsupported items to check whether they are ok. The normal update interval is set to 30 seconds.
In my opinion in this case the item should not marked as unsupported.

Now I can modify my script to return every time a string but than I have a lot of useless data in the db for this item.

Who has an idea to solve this? Is there an other way to put the results of the script to the zabbix item? Perhaps Zabbix sender will be a way but then I need a cronjob outside of zabbix.

Any ideas are welcome...

[arikin]

Custom Regexs available

Have you tried creating custom regex and using them in the log checks?

Manual: regular_expressions

Which version of zabbix are you using?

[hirschnf]

Thank you for this hint. I don't use these regular expressions.
Do you know how to implement these expressions in a item?
The information in the manual is little.

I have found a workaround for my original question.
I've defined two items - first item as a UserParameter which starts the script every 30 seconds. The script always return 0 for ok or 1 for failure and in the script I use the zabbix_sender command to fill my second item.

So I don't need a cronjob outside of zabbix and all items are supported.

[arikin]

Not translated

Tried but the Regular expression wasn't translated before being sent to the agent on the remote server...

I setup an active agent with a key and the name of the regex.
Key: log["/var/log/messages",Action_pgpool_start,"UTF-8",100]

But that name of the regex doesn't get translated to the actual expression...

  2088:20110921:111440.694 Before read
  2088:20110921:111440.699 Got [{
        "response":"success",
        "data":[
                {      
                        "key":"log[\"\/var\/log\/messages\",Action_pgpool_start,\"UTF-8\",100]",
                        "delay":"30",
                        "lastlogsize":"0",
                        "mtime":"0"}]}]
  2088:20110921:111440.699 In parse_list_of_checks()
  2088:20110921:111440.699 In disable_all_metrics()
  2088:20110921:111440.699 In add_check('log["/var/log/messages",Action_pgpool_start,"UTF-8",100]', 30, 0, 0)

But simple POSIX regex work directly in the Key.
log["/var/log/messages","Action.* pgpool_.*_start","UTF-8",100]

To take care of the no data problem make it become false after 1 second:
{server:log["/var/log/messages","Action.* pgpool_.*_start"].nodata(0)}#1

[hirschnf]

But if you want to monitor a logfile with an entry over more than one line it doesn't work.

Example:
log[/tmp/test.log,.*\n.*Error.*\n.*,"UTF-8",100]

you will get no return...

in the POSIX regex it works...

[danrog]

This is how we get multiple lines on a web.page.regex item:

.*([[:space:]].*)+

Try replacing your \n's with this.