Zabbix 3.4 log item with trigger expressions

[lpossamai]

Hi,

I have a PostgreSQL log file that I want to monitor a specific string with Zabbix 3.4. If zabbix ever sees archive command failed with exit code 1 in /var/lib/zabbix/postgresql-10.log, then triggers an alert.

For that, I have created the following:

Item PostgreSQL Wal files logs ERROR:

Type: Zabbix agent (active)
key: log[/var/lib/zabbix/postgresql-10.log,"archive command failed with exit code 1"]
Type of information: Log

Trigger ERROR: Sending PostgreSQL wal files on host {HOST.NAME}:
Problem expression:

{Template App PostgreSQL Wal Files:log[/var/lib/zabbix/postgresql-10.log,"archive command failed with exit code 1"].count(10m,"archive command failed with exit code 1",like)}>2

Recovery expression:

{Template App PostgreSQL Wal Files:log[/var/lib/zabbix/postgresql-10.log,"archive command failed with exit code 1"].count(10m,"archive command failed with exit code 1",like)}=0

The issue is that the trigger gets triggered even if there isn't any more new archive command failed with exit code 1 entry in the log file. However, I keep seeing duplicated values being captured by Zabbix.

If there are new entries like archive command failed with exit code 1 in the log file, then triggers an alert. Otherwise, it should be resolved. How can I get this working?

[ar90498]

Please also subsribe to my post "Log file monitor repeatedly sends old messages", It looks like we reported the same issue.

Hopefully someone can solve both our issues.