Ad Widget

Collapse

problem with log file monitoring syntax

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • gregtompkins
    Junior Member
    • Sep 2011
    • 23

    #1

    problem with log file monitoring syntax

    Hello Zabbix Community from soggy Oregon!

    So far I am loving this product. I come from a background of data center and using super expensive products like HP OpenView. So I am getting my hands "dirty" putting it to use on a project for our family business. I want to monitor a text file on the server that the zabbix agent is running.

    log["C:\Windows\System32\LogFiles\Firewall\pfirewall.l og","DROP","ANSI",1000]

    Here is a snippet from the file I am trying to monitor:

    2013-03-05 20:34:14 ALLOW UDP 192.168.1.111 208.67.222.222 58198 53 0 - - - - - - - SEND
    2013-03-05 20:34:14 ALLOW UDP 192.168.1.47 192.168.1.111 61057 53 0 - - - - - - - RECEIVE
    2013-03-05 20:34:14 ALLOW UDP 192.168.1.47 192.168.1.111 57605 53 0 - - - - - - - RECEIVE
    2013-03-05 20:34:14 ALLOW UDP 192.168.1.111 208.67.222.222 56968 53 0 - - - - - - - SEND
    2013-03-05 20:34:14 ALLOW UDP 192.168.1.111 208.67.222.222 58993 53 0 - - - - - - - SEND
    2013-03-05 20:34:16 ALLOW UDP 192.168.1.71 192.168.1.111 9732 53 0 - - - - - - - RECEIVE

    but when I try to start up the item it goes to "Status Unsupported"

    So my question is the agent incapable of monitoring that specific log file or do I (more likely) have an error in the syntax?

    Thanks for the help, this is looking like a really cool thing to learn!

    --GREG--
    Last edited by gregtompkins; 21-10-2013, 21:44.
  • heaje
    Senior Member
    Zabbix Certified Specialist
    • Sep 2009
    • 325

    #2
    Based off of what you posted, it looks like you have a typo in your key. You have a space between "l" and "o" in the log file extension. That would cause it to go unsupported.

    Comment

    • ejames
      Junior Member
      • Aug 2011
      • 2

      #3
      Also, it should be an active check.

      Type: Zabbix Agent (Active)

      Comment

      Working...