Hello
I need to monitor a log with log/logrt items (even enventlog).
The log can be filled very fast, then I keep the MaxLinesPerSecond default (20).
Item update interval is 5 secondes.
Agent can analyze 1000 lines each cycle (20*10*5).
How can I limit the number of values sent each cycle to Zabbix item to 5 without reducing the number of analyzed line in log ?
I would like to do this to avoid item values bombing, but continue to scan all logs lines.
By reading the doc, I don't find the way to do this.
log[/path/to/file/file_name,<regexp>,<encoding>,<maxlines>,<mode>,<o utput>,<maxdelay>]
Doc :
· Zabbix agent does not send more than maxlines of a log file per second. The limit prevents overloading of network and CPU resources and overrides the default value provided by MaxLinesPerSecond parameter in the agent configuration file.
-> ok, it is what I need, I can reduce the maxlines
Doc :
· To find the required string Zabbix will process 10 times more new lines than set in MaxLinesPerSecond. Thus, for example, if a log[] or logrt[] item has Update interval of 1 second, by default the agent will analyse no more than 200 log file records and will send no more than 20 matching records to Zabbix server in one check. By increasing MaxLinesPerSecond in the agent configuration file or setting maxlines parameter in the item key, the limit can be increased up to 10000 analysed log file records and 1000 matching records sent to Zabbix server in one check. If the Update interval is set to 2 seconds the limits for one check would be set 2 times higher than with Update interval of 1 second.
-> If I reduce the maxlines, I understand that all the lines of the log will no more analysed ...
· Additionally, log and log.count values are always limited to 50% of the agent send buffer size, even if there are no non-log values in it. So for the maxlines values to be sent in one connection (and not in several connections), the agent BufferSize parameter must be at least maxlines x 2.
I need to monitor a log with log/logrt items (even enventlog).
The log can be filled very fast, then I keep the MaxLinesPerSecond default (20).
Item update interval is 5 secondes.
Agent can analyze 1000 lines each cycle (20*10*5).
How can I limit the number of values sent each cycle to Zabbix item to 5 without reducing the number of analyzed line in log ?
I would like to do this to avoid item values bombing, but continue to scan all logs lines.
By reading the doc, I don't find the way to do this.
log[/path/to/file/file_name,<regexp>,<encoding>,<maxlines>,<mode>,<o utput>,<maxdelay>]
Doc :
· Zabbix agent does not send more than maxlines of a log file per second. The limit prevents overloading of network and CPU resources and overrides the default value provided by MaxLinesPerSecond parameter in the agent configuration file.
-> ok, it is what I need, I can reduce the maxlines
Doc :
· To find the required string Zabbix will process 10 times more new lines than set in MaxLinesPerSecond. Thus, for example, if a log[] or logrt[] item has Update interval of 1 second, by default the agent will analyse no more than 200 log file records and will send no more than 20 matching records to Zabbix server in one check. By increasing MaxLinesPerSecond in the agent configuration file or setting maxlines parameter in the item key, the limit can be increased up to 10000 analysed log file records and 1000 matching records sent to Zabbix server in one check. If the Update interval is set to 2 seconds the limits for one check would be set 2 times higher than with Update interval of 1 second.
-> If I reduce the maxlines, I understand that all the lines of the log will no more analysed ...
· Additionally, log and log.count values are always limited to 50% of the agent send buffer size, even if there are no non-log values in it. So for the maxlines values to be sent in one connection (and not in several connections), the agent BufferSize parameter must be at least maxlines x 2.