Logfile monitoring - Best Practise

[RuudH]

Hi all,

I've managed to monitor some application and windows logs using the Zabbix Active Agent. All information from the logs is returned, so that's looking good.

Now I want to setup triggers to get notifications on various conditions. For example I want to get notified when an ERROR or WARNING message comes in.

When I create a trigger based on the string Error, the trigger is fired but removed after a new (Information) line is received. Besides that I don't get the specific error message in the trigger.

What's the best way to deal with this situation ?
- Should I create 2 different items for the logfile for both ERROR and WARNINGS ?
- How can I retrieve the specific ERROR message in the triggername, so It's mentioned in the console directly ?

Besides that I want to count the number of ERROR messages per day in the log. Is that possible and how should I set this up ?

Thanks for any assistance !

[Navoyenok]

Hi, RuudH.

I rewrote items (External VBS-script) that parses the windows-logs and returns result. This is an item exists in the Active template.
Purpose: Every second call should return the trigger in the state of OK.

Best regards, Navoyenok

[RuudH]

Thanks, but I have some application specific logs too (for example incoming FTP transfers).
I like them to be counted too on a daily bases to do some trendanalysis

[Navoyenok]

Dear, RuudH.

Listen to me, pls.

Surely you need your own script to make it. I have not found any acceptable ready script on the Internet that would solve this problem well (That I did not want to hurt in your community. Just all scripts do not resolve exactly what I need it). Each make script to fit your goals.

I can share with you my script for log analizing if you want. If your need it, than email me by [email protected].

Best regards, Navoyenok