Log file monitoring

[GemTTb]

Hello Zabbix Community,

I'm trying to monitor a log file using Zabbix log file monitoring functionality.

I'm using Zabbix 2.2.1 delivered on the zabbix appliance on suse.
Zabbix server is running OK and I'm already monitoring a Win-XP machine using the Windows server template

I added a new item for log file monitoring as below on the attached file


and added a trigger based on this item if it contains a string "error" as below:


Now my file does contain the error string and still, by checking Monitoring-Triggers view, the trigger does not get fired up!

Did I miss anything?

Please help.

Thanks & Regards,

Med

[aib]

[B]str 	[/B]1st - string, 2nd - sec or #num 	str, log, text
	Find string in last (most recent) value. 
	Parameter defines string to find. Case sensitive!
	Second optional parameter is number of seconds 
	or number of collected values to analyse. 
	In this case more than one value will be processed.
		Returns:
		1 - found
		0 - otherwise

From this description and you trigger expression I can say that you are looking for any line which NOT included word "error".
Correct?

[GemTTb]

Hi aib,

You are right it should be =1, and I modified it.

But I'm still having no event or trigger about it.

I tried the same thing (monitor a file on zabbix server side) and it worked fine.

Is this related to some priviledges issues?

Thanks for your help

[aib]

Did you check in Monitoring -> Latest Data if you have any data for this Item?

[GemTTb]

yeah,

what is wierd is that my item doesn't show up in there.

On the other side, on zabbix server it appears and gets the lines from the file!

Am I missing something?

[aib]

wait a sec.
I asked you if you have date on Zabbix Server frontend.

I cannot understand your word that:

my item doesn't show up in there.

On the other side, on zabbix server it appears and gets the lines from the file!

What did you talk about?

[GemTTb]

Sorry I didn't express it correctly.

No data on the Latest data front end related to the item I created for monitoring the log file on Win-XP host.

In fact the item do not figure among the latest data.

[aib]

it means that your agent cannot get any data from that file.
Did you check the permissions for directory/file?
Did you check zabbix agent log on DebugLevel=4?

First of all - you have to get the data on Latest Data screen.
Then - you can play with triggers...

[GemTTb]

I didn't check permissions so far, I tried to look for configuring it somewhere but unfortunately I didn't succeed yet.
My monitored host is win-xp machine so no permissions to configure on that side since the agentd is started with the Admin user.

On the zabbix-server side I didn't find user or permissions to configure on the config file, neither on the front end app.

Can you point me to what needs to be done on this?

About the agent logs using log level 4, no error appears related to the log file item.

[aib]

Well, so far I have nothing to say.
I checked some additional sources of information - no luck....

Last chance - try to use the Key

log["C:\test.log","error"]

[GemTTb]

Yeah I've tried it but no still no data.

I've checked again the agent log file, it seems that there is a failure to to send active checks:

2804:20140304:191034.696 In refresh_active_checks() host:'10.10.1.230' port:10051
  2804:20140304:191034.696 sending [{
	"request":"active checks",
	"host":"Windows host"}]
  2804:20140304:191034.696 before read
  2804:20140304:191034.696 got [{
	"response":"failed",
	"info":"host [Windows host] not found"}]
  2804:20140304:191034.696 In parse_list_of_checks()
  2804:20140304:191034.696 In disable_all_metrics()
  2804:20140304:191034.696 no active checks on server [10.10.1.230:10051]: host [Windows host] not found

Is it related to this issue? I really don't know.

[rcollier]

Did you configure the active checks in the zabbix_agentd.conf file? You would need to have the address/dns of your zabbix server attached to the serverActive parameter.

For example:
ServerActive=zabbixserver:10051

Make sure you restart the agent after making any changes.

[aib]

Yes, it is the source of problem.

Hostname on Zabbix Server AND Hostname (keyword) in zabbix_agent.conf has to be ABSOLUTELY the same.

As I can see you configured host with name host193 but in zabbix_agent.conf you have the line

hostname=Windows host

Because of mismatches your agent complains about it

	"info":"host [Windows host] not found"}]

Fix it, please.

[GemTTb]

You were absolutely right aib and rcollier.

The active server was configured correctly but the hostname on agentd.config was not matching with the one on zabbix server.

By modifying it I can get the log item data, and now I can start playing with the triggers.

However I'm still getting some errors on the agent log

1484:20140304:194807.071 Process listener error: ZBX_TCP_READ() failed: [0x00002746] An existing connection was forcibly closed by the remote host.

It is not causing any trouble for the moment, and I hope will not later :-)

Thank you guys very much

Regards,

Med

[steveboyson]

As far as I know items of type "log" can not be evaluated since the logpattern catches the string pattern as defined and throws the rest away. You may want to try to change the item type to "text".