Log Monitoring Trigger

[Mr.Pelovski]

Hello everyone i hope you are doing well

I tryto configure Recovery expression for my trigger without success.
This is my conf:

Can't make the trigger to go in OK status after of period of time.
There is a way to change trigger's status into OK, if there is no more this string in log in 300 seconds

???

Thanks a lot for help

[Mr.Pelovski]

Ok i find my mistake, now im wondering if it possible at all to make monitoring on Log file for string and when trigger appear to go in OK status after of period of time ?!?!?

https://support.zabbix.com/browse/ZBX-11444 "Recovery expression - OK events are generated if the problem expression evaluates to FALSE and the recovery expression evaluates to TRUE";

[Valinor]

Hi all,
It is quite old post, but the same question for me, how to resolve such triggers?

[johndoe2374]

Hi all,
It is quite old post, but the same question for me, how to resolve such triggers?

I've achieved it for Windows log monitoring:
1. Set up your log item with regexp, so it only obtain strings with errors you want to be warned about.
2. Use nodata() function for your trigger.

Example of my Windows log trigger:

nodata(/Check for error in Windows Eventlog/eventlog[System,,,,10541,,skip],1m)=0

In my case when bad thing happens, it starts spamming the Event log with event 10541 all the time (like 30 time per minute). So the item collects these errors. And nodata()=0 means, there's some data, so new errors are present. This expression also works for recovery - if there's no new item obtainings (no new events with ID 10541) during 1 minute, trigger is closing itself.