Active Checks and Log Watching

[fandingo]

Hello,

I'm new to Zabbix, and I'm having quite a bit of trouble setting up a log monitor. I can't determine if the Active Agent is not working at all, or if my log item/trigger is setup incorrectly.

I'm trying to monitor a log file that looks like:
QA4 :: 1354371771 :: 020_grid_progress :: M020_grid_progress :: alert :: Grid recovery completed on Sat Dec 1 09:22:49 2012: There were 17 active application(s) when the grid controller went down. 3 application(s) have been recovered. The state of 11 applications has been reacquired.3 application(s) failed to be recovered. See the controller system log for details.

I've setup the following trigger:
(({LOG_HOST:log[/var/log/ald.log,,,5000,].regexp(":: alert ::")})#0)

When looking at the trigger screen, everything initially is fine (green check in the error column). However once I update the item or trigger, I get a red X in the error column with a message: "Trigger expression updated. No status update so far." It's been like that for over an hour.

I don't see anything useful in the agent logs, but there is an interesting message in the server log:

16214:20121203:130837.458 cannot send list of active checks to [10.1.0.5]: host [zabbix01.local] not found

When I configured Zabbix, I set "zabbix01.local" as the optional name.

My agent configuration has
Server=zabbix01.local
ServerActive=10.1.05 # This IP matches the fqdn from "Server=" directly above.

Does anyone know how to fix this problem? Any help is greatly appreciated.

Thanks,

[Speedfight]

did you set the rights for the user zabbix to look in to the file?

[fandingo]

Yes, the file (and parent directories) is world-readable.

[tchjts1]

Active agents are specific on naming conventions for the monitored hosts in 2 places...

host [zabbix01.local] not found

...Tells me one thing. Whatever you have on your monitored host in zabbix_agentd.conf file on the line Hostname= does not match what you have entered in the Zabbix frontend for the name of the host there. These must be identical, including case sensitive.

If you make changes to zabbix_agentd.conf, be sure to restart the agent process.

[fandingo]

Thanks. I think that I have the host not found problem fixed. Zabbix still doesn't like my log item:

I found this message on the agent:

25111:20121203:171004.448 JSON before sending [{
"request":"agent data",
"data":[
{
"host":"dc2opsdashqa01",
"key":"log[\"\/var\/log\/applogic-dashboard-messages.log\",'::','UTF-8',10000,'all']",
"value":"ZBX_NOTSUPPORTED",
"clock":1354576199,
"ns":447089304},
{
"host":"dc2opsdashqa01",
"key":"log[\"\/var\/log\/messages\",'puppet','UTF-8',100000,'all']",
"value":"ZBX_NOTSUPPORTED",
"clock":1354576199,
"ns":447221507}],
"clock":1354576204,
"ns":448173247}]
25111:20121203:171004.448 JSON back [{
"response":"success",
"info":"Processed 2 Failed 0 Total 2 Seconds spent 0.000054"}]
25111:20121203:171004.448 In check_response() response:'{
"response":"success",
"info":"Processed 2 Failed 0 Total 2 Seconds spent 0.000054"}'


I've tried quoting a variety of ways. I saw a forum post that recommended using double quotes for the file name and single quotes for everything else. That didn't work. I also tried removing the quotes from the max line parameter (which is my current config), but it didn't work either.

[tchjts1]

Can you post a screenshot of the configuration for your item?