how to efficiently monitor multiple patterns on the same log file item?

[tvtue]

Hi all,

I want to monitor if for example three different patterns appear in /var/log/messages. To do this I can create three log file items, each with a certain regex pattern. This gives me the possiblity to check if the first pattern appeared N times in the last hour.
Now when thinking of performance, it may be better to merge those three pattern into one regex. So I only have on log item. But then I lose the flexiblity from above, i.e. using trigger functions on exactly one pattern.

How is zabbix handling this? Are log items which work on the same log file beeing pooled into one data stream? Or is the agentd doing this for every item separately?

What would be the best way to set this up?

log[/var/log/messages,pattern1]
log[/var/log/messages,pattern2]
log[/var/log/messages,pattern3]

vs.

log[/var/log/messages,pattern1|pattern2|pattern3]

And so:

{host: log[/var/log/messages,pattern1].somefunc()}=X

vs.

{host: log[/var/log/messages,pattern1|pattern2|pattern3].somefunc()}=X

TIA
tvtue

[BDiE8VNy]

The Zabbix agent loops through all items. Having several log items means dedicated cycles per item.
Because active checks aren't processed in parallel (afaik) there might be a slightly performance benefit in doing all pattern matching in one item.
In real-life I'd say it's not noticeable. The agent remembers the last read position per cycle in memory and persistent in database. That allows to continue reading a log file at exactly that position without reading the whole file.

This might not apply if there is a lot to read per cycle and won't for sure if additionally for any reason the once read data blocks are not cached in the file system buffer any more.
It could also make a difference if a very large file has to be initially inspected and the item's attribute 'mode' is not set to 'skip'

Summarized:
Putting all patterns in one item is the most efficient way.
However separating patterns in several items should be sufficient in most cases - and might sometimes be logically preferable.

[tvtue]

Thanks for your reply!

Regards
tvtue

[cyber_geek5]

Log file monitoring

how many log files per host does Zabbix 2.0 monitor .
Does it have any limit or it is just the amount of CPU and memory requried

[BDiE8VNy]

There is no hard coded limit.
But there is some kind of limitation due to the fact that log files have to be monitored actively and there is only one process per agent doing all active checks (sequentially).

See ZBXNEXT-691