zabbix log monitoring issue

[batchen_regev]

hey,

im using zabbix 3.4 on docker

i have an issue where the i try to log monitor but theres an issue because the log file changes every day,
it looks like that :

/var/log/logfile.log.5456454

now i have tried * at the end or [0-9] but it doesnt work.
so what i did is to build another item that this item value is the log file name -

like this :
ITEM1 = system.run[cd /var/ldt/log/ ; ls -trA1 |grep 'logfilename'| awk 'END{print}'] - so it gives me the newest log file - value will look like this = /var/log/logfile.log.456456

now is there a way to make item2 use item1 value ? like : log[$ITEM1VALUE, problem] ?

thanks

[Atsushi]

Regular expressions can not be used for file names in item key log[].
If it is output to a new file name on a daily basis, why not try using logrt[]?

logrt[/var/log/^logfile.log,problem]
or
logrt[/var/log/^logfile.log.[0-9].*$,problem]

[batchen_regev]

Regular expressions can not be used for file names in item key log[].
If it is output to a new file name on a daily basis, why not try using logrt[]?

logrt[/var/log/^logfile.log,problem]
or
logrt[/var/log/^logfile.log.[0-9].*$,problem]

doesnt let me :

red error

• Invalid key "logrt[/var/ldt/log/^install-security-g.log.[0-9].*$,problem]" for item "security log" on "HOSTNAME": incorrect syntax near ".*$,problem]".

[Atsushi]

Sorry.

logrt[/var/ldt/log/^install-security-g.log,problem]
or
logrt["/var/ldt/log/^install-security-g.log.[0-9].*$",problem]

When specifying a file name including a special symbol, it was necessary to enclose it with a quote.

[batchen_regev]

doesnt let me :

red error

• Invalid key "logrt[/var/ldt/log/^install-security-g.log.[0-9].*$,problem]" for item "security log" on "HOSTNAME": incorrect syntax near ".*$,problem]".

the first one works but also - i want it to be the last newset log,
the /var/log/ has a few files lokking like that

/var/log/logfile.log.456456
/var/log/logfile.log.456457
/var/log/logfile.log.456458

thats why the command
system.run[cd /var/ldt/log/ ; ls -trA1 |grep 'logfilename'| awk 'END{print}']

gives me the latest one

[Atsushi]

When logrt[] is used, only the latest file is eligible.
However, since it may be necessary to read past files at the time of setting the first time, it may be better to add the skip option.

[batchen_regev]

thanks! works

[batchen_regev]

ok so im having issues, the item works but the problem is this :
the log im reading from is a log that is created by some script - and then nothing else is writen to the log.
so im added to the log i have the word "problem" manually - it has set a trigger

then i run the script again - creates a new log without the word problem - but the zabbix not collecting anymore \ not updating and still shows problem
it suppused to read the latest log right ? so why isnt it updating ?

i understand that logrt is for log files that grow over time , my log is created one time and thats it.
should i use key vfs.file ? if so, how ? does it going to find the newest and latest file ?

edit:
also when i check i insert the word "problem" on an older log and still get the trigger, i really need it to be on the latest log..

thanks

[Atsushi]

When logrt[] is used, it reads from the latest file matching the condition of the file name specified by the argument.
If you can not get the log, please check the item key setting.

[batchen_regev]

this is the item, again it works but i have this issue:
1. if i manually change old log to have "problem" in it - it fire trigger
2. if i make new clean log after the problem one - still item is not cleaned and shows problem

see atteched

[Atsushi]

If you edit a past log file that matches a regular expression, it is judged that it is the latest log file, and it will read the past log file from the beginning again.
If you want to edit past log files, please move to a different directory before doing.

I think that it is a trigger setting problem that the trigger remains obstructed.
If filtering is not done at the time of log acquisition and the character string "problem" is included in the trigger, it may be easy to set it as a failure.
However, if you do not want to filter it, pay attention to the size of the log to be saved.

[batchen_regev]

hey,

thanks for the fast replay.
but i still dont get it

if i edited a past file with "problem" ok so it triggerd but! then i ran a whole new log after the editing and everything
why isnt it takes the last clean log and stop the trigger ? as it is the last updated log

here is the trigger:
{hostname:logrt["/var/log/^install-only.log.[0-9].*$","problem"].str(problem)}=1

what should i do different?
thanks