Monitor Log File

[harishgupta111]

Hi, I am trying to monitor one log file. Here are the steps that I am following

//Zabix Config. File

# This is a config file for Zabbix Agent (Windows)
# To get more information about Zabbix, go to http://www.zabbix.com

############ GENERAL PARAMETERS #################

### Option: DebugLevel
# Specifies debug level
# 0 - no debug
# 1 - critical information
# 2 - error information
# 3 - warnings
# 4 - for debugging (produces lots of information)
#
# Mandatory: no
# Default:
DebugLevel=4

### Option: LogFile
# Name of log file.
#
# Mandatory: no
# Default:
# LogFile=

LogFile=C:\Zabbix_agentd.log

### Option: LogFileSize
# Maximum size of log file in MB.
# 0 - disable automatic log rotation.
#
# Mandatory: no
# Range: 1-1024
# Default:
# LogFileSize=1

### Option: SourceIP
# Source IP address for outgoing connections.
#
# Mandatory: no
# Default:
# SourceIP=

### Option: EnableRemoteCommands
# Whether remote commands from Zabbix server are allowed.
# 0 - not allowed
# 1 - allowed
#
# Mandatory: no
# Default:
EnableRemoteCommands=1

##### Passive checks related

### Option: Server
# List of comma delimited IP addresses (or hostnames) of Zabbix servers.
# No spaces allowed. First entry is used for receiving list of and sending active checks.
# Note that hostnames must resolve hostname->IP address and IP address->hostname.
#
# Mandatory: yes
# Default:
# Server=

Server=192.168.148.61

### Option: Hostname
# Unique hostname.
# Required for active checks and must match hostname as configured on the server.
#
# Default:
# Hostname=system.uname

Hostname=192.168.148.82

### Option: ListenPort
# Agent will listen on this port for connections from the server.
#
# Mandatory: no
# Range: 1024-32767
# Default:
ListenPort=10050

### Option: ListenIP
# Agent will listen on the specified interface.
#
# Mandatory: no
# Default:
# ListenIP=0.0.0.0

# ListenIP=127.0.0.1

### Option: DisablePassive
# Disable passive checks. The agent will not listen on any TCP port.
# Only active checks will be processed.
# 0 - do not disable
# 1 - disable
#
# Mandatory: no
# Default:
# DisablePassive=0

##### Active checks related

### Option: DisableActive
# Disable active checks. The agent will work in passive mode listening for server.
#
# Mandatory: no
# Default:
# DisableActive=0

# DisableActive=1

### Option: ServerPort
# Server port for retrieving list of and sending active checks.
#
# Mandatory: no
# Default:
ServerPort=10051

### Option: RefreshActiveChecks
# How often list of active checks is refreshed, in seconds.
#
# Mandatory: no
# Range: 60-3600
# Default:
RefreshActiveChecks=120

### Option: BufferSend
# Do not keep data longer than N seconds in buffer.
#
# Mandatory: no
# Range: 1-3600
# Default:
# BufferSend=5

### Option: BufferSize
# Maximum number of values in a memory buffer. The agent will send
# all collected data to Zabbix Server or Proxy if the buffer is full.
#
# Mandatory: no
# Range: 1-65535
# Default:
# BufferSize=100

### Option: MaxLinesPerSecond
# Maximum number of new lines the agent will send per second to Zabbix Server
# or Proxy processing 'log' and 'eventlog' active checks.
# The provided value will be overridden by the parameter 'maxlines',
# provided in 'log' or 'eventlog' item key.
#
# Mandatory: no
# Range: 1-1000
# Default:
# MaxLinesPerSecond=100

############ ADVANCED PARAMETERS #################

### Option: StartAgents
# Number of pre-forked instances of zabbix_agentd that process passive checks.
#
# Mandatory: no
# Range: 1-16
# Default:
StartAgents=5

### Option: Timeout
# Spend no more than Timeout seconds on processing
#
# Mandatory: no
# Range: 1-30
# Default:
# Timeout=3

### Option: Include
# You may include individual files or all files in a directory in the configuration file.
#
# Mandatory: no
# Default:
# Include=

# Include=c:\zabbix\zabbix_agent.userparams.conf
# Include=c:\zabbix\zabbix_agentd\

####### USER-DEFINED MONITORED PARAMETERS #######

### Option: UserParameter
# User-defined parameter to monitor. There can be several user-defined parameters.
# Format: UserParameter=<key>,<shell command>
# Note that shell command must not return empty string or EOL only.
# Example: UserParameter=system.test,echo 1
#UserParameter=system.test,echo 1


///////////////////////////////////////////////////////////////////////////
here is the image of Front end item
Attchment.

Actually my requirement is to monitor the log file and display the graph. But after completing every step I am getting no data on my graph. And when i checked my zabbix_agentd.log file I found error

7196:20111116:143327.433 Sending [{
"request":"active checks",
"host":"192.168.148.82"}]
7196:20111116:143327.439 Before read
7196:20111116:143327.444 Got [{
"response":"failed",
"info":"host [192.168.148.82] not found"}]

Please help me in this.

Thanks in advance.

[harishgupta111]

Please suggest

Hi, Is anyone there in ZABBIX Admin. who can help me on this thread. As I posted this thread last week but still I have no answer from anyone. Please give some solution or just confirm whether we can create graph from log file data.?

[JiP]

Hi,

I'm not skilled in Zabbix enough, but I think create graph from log or text data is not possible.

But you can parse log file by external script via UserParameter (http://www.zabbix.com/documentation/...ser_parameters) and send numbers to zabbix.

[harishgupta111]

Thanks

Thanks JiP, I would really appreciate if you could help me more in this. I need this asap. But don't have much idea how to do this. So just give me more clarification on this.

[JiP]

Zabbix agent can run external scripts on monitored host. So you can monitor a lot of things. E.g. "Advanced log file monitoring". The functionality is available with setting UserParameter in zabbix_agent.conf

First: Configure zabbix_agentd.conf:

EnableRemoteCommands=1
UnsafeUserParameters=1
DisableActive=0
UserParameter=key.in.zabbix.frontend[*],C:/command.bat $1
- "$1" - represents passing arguments

(more: http://www.zabbix.com/documentation/...ser_parameters)

The string "C:/command.bat" could be replaced by your script or command. Make sure the script always write something on output otherwise monitoring fail.

Second: You have to write script that returns desired value in every period.

[harishgupta111]

HI JiP,

Thanks a lot. Actually I m new to Zabbix so that's why I don't have much knowledge about this.

My Zabbix_agent is running on Window server and my log file is also there.
Path of Log file: D:\msg.log
and in my log file this is the information :

2012-11-14 10:51:48,287 [pool-1-thread-76] ERROR Orabbix - Error Harish Gupta 192.168.148.61 on port 1
2012-11-14 10:51:48,287 [pool-1-thread-76] ERROR Orabbix - Error Harish Gupta 192.168.148.61 on port 10051
2012-11-14 10:51:48,287 [pool-1-thread-76] ERROR Orabbix - Error Harish Gupta 192.168.148.61 on port 10051
2012-11-14 10:51:48,287 [pool-1-thread-76] ERROR Orabbix - Error Harish Gupta 192.168.148.61 on port 10051
2012-11-14 10:51:48,287 [pool-1-thread-76] ERROR Orabbix - Error Harish Gupta 192.168.148.61 on port 10051
2012-11-14 10:51:48,287 [pool-1-thread-76] ERROR Orabbix - Error Harish Gupta 192.168.148.61 on port 10051
2012-11-14 10:51:48,288 [pool-1-thread-76] ERROR Orabbix - Error Harish Gupta 192.168.148.61 on port 10051

Now I just want to know that how many times the Error word is cmng in my log file. And on the basis of this count i need to generate Graph.

So if you have any script for this or any link which can help me for this. Please share.

Thanks very much in advance. And you gave me 1 hope

[hirschnf]

I would create a Batch-Script which will generate the output of one line with one value.
This value is the count of the errors.
As JIP wrote, insert a UserParameter in your zabbix_agentd.conf file.

Then create in Zabbix a item from type "zabbix_agent" and the key is your UserParameter. In the example from JIP it is "key.in.zabbix.frontend[parameter1 parameter2]".
I am not sure about the parameters. So in the first step I would work without parameters like this: key.in.zabbix.frontend
The type of information is Numeric and Data type is decimal.

Hope, this helps you

[JiP]

I'm sorry but scripting in windows is not my hobby yet but maybe my piece of bash code can help you. Try it convert somehow to VBS or python or whatever you want.

#!/bin/bash 

# backup file with number of lines I've read
lineCounterFile='./lcf'

# test if file exist
if [[ -e $lineCounterFile ]]; then
    nOld=`cat $lineCounterFile`
else
    `echo 0 > $lineCounterFile`
    nOld=0
fi


# get size of file in lines
n=`cat $1 | wc -l`

# no new lines -> write "0" to stdout
if [[ "$n" -eq "$nOld" ]]; then
    echo 0
    exit
fi


# if the file is smaller than stored number of lines then analyze whole file otherwise analyze the new ones
if [[ "$n" -lt  "$nOld" ]]; then
    nOld=0
fi


# evaluate count of new lines in log file
nDelta=$(($n-$nOld))

# do checking. In $1 is log name
content=`tail -n $nDelta $1 | grep ERROR | wc -l`
   
echo $content
# delete old content of backup file
`cat /dev/null > $lineCounterFile`

# store new value 
`echo $n > $lineCounterFile`

Script returns to zabbix number of lines with word "ERROR" in time period. Zabbix can automaticly create graph from this.

[hirschnf]

This is a Batch Example to get only the value:

C:\Temp>type test.cmd
@echo off

for /F "tokens=1,2,3,4* delims=. " %%i IN ('find /C "error" test.log') do (
        echo %%l
)

Later you can replace "error" through %1
and test.log through %2
This is the way if you want to use Parameters in batchfiles

[harishgupta111]

Thanks guys

Hi Frank, JiP,

Thanks guys. I have created the Item and configure the settings in agent config. file. :->UserParameter=key.in.zabbix.frontend[*],$1
Right now I haven't mention any scripting file not even path of my log file. So, from here just tell me next step. Frank please help.
Right now in Dashboard its showing no data in graph. and {key.in.zabbix.frontend 30 90 365 Zabbix agent Active} status is active.

Now I think everything on way, I just need to get the count from my log file.
Frank please tell me further step.
And Jip, in your scripting please tell me where should I specify the path of my log file.

[harishgupta111]

Thanks

Thanks Frank.. I just saw your post. let me try this and then ll update you soon. Thanks once again

[harishgupta111]

Hi Frank

Hi Frank,

I completed all the steps but still no-data is showing in graph. here is the details
in agent config. file:->
UserParameter=key.in.zabbix.frontend[*],C:/temp/test.cmd $1

and in test.cmd file:->
C:\Temp>type test.cmd
@echo off

for /F "tokens=1,2,3,4* delims=. " %%i IN ('find /C "error" test.log') do (
echo %%l
)
This is what I m getting in log file. Now 1 more problem come. in status its showing not supported

232:20111124:170452.444 JSON before sending [{
"request":"agent data",
"data":[
{
"host":"OrderPath",
"key":"key.in.zabbix.frontend",
"value":"\r\nC:\\Windows\\system32>C:\\Temp test.cmd 1>type \r\n'C:\\Temp' is not recognized as an internal or external command,\r\noperable program or batch file.",
"clock":1322134492}],
"clock":1322134492}]
232:20111124:170452.455 JSON back [{
"response":"success",

[JiP]

try this:
create file "C:/temp/test.bat". And put into the file this content:

@echo off

for /F "tokens=1,2,3,4* delims=. " %%i IN ('find /C "error" %1') do (
echo %%l
)

then

UserParameter=key.in.zabbix.frontend[*],C:/temp/test.bat $1

and to the frontend:
key.in.zabbix.frontend[C:/path/to/monitored/log]

[harishgupta111]

Hi JiP,

I tried this but still no data is shown in graph .

[JiP]

Hmm, interesting.

Did you try run the batch script from cmd? What answer you get?

And are you viewing the graph via Monitoring->Overview and then you should see your monitored item. Then if you click on value, menu with option "show graph" is shown.

More information about item, configuration error from zabbix is needed.