Dynamic logs monitoring

[enzorik]

Dears,

I have one issue concerning logs monitoring on Zabbix.
There are log files at the server, that changing every day, for example:

/var/log/tomcat/access_log.2014-03-12.log
/var/log/tomcat/catalina.2014-03-12.log

I tried different methods (via logrt) using regular expressions for determining name of files, but still have no idea how to configure item for dynamic changing log name.

Hoping for your help.
Thanks in advance,
Petro

[tsalle]

Hi,

You can use zabbix agent (active) items with key:
logrt["/var/log/tomcat/access_log.[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].log"]
It should monitor all the logs with a name matching the regurlar expression.
Only new lines of log will be added to zabbix.

[enzorik]

Hi,
Thanks for reply.
Yes, this item key can be used, but in my case required to monitor only current log file (created today).

[tsalle]

if a new log file appear in the directory, Zabbix will found it and monitor it.
if no new lines are added to old files, no problem, zabbix will ignore it.

[enzorik]

After some tests I received in zabbix_agentd.log:

active check "logrt["/var/log/tomcat/access_log.[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].log","2change",,1000]" is not supported
active check "logrt["/var/log/tomcat/access_log.[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9].log","2change",,1000]" is not supported

Also I had some success (supported by agent) with this expression:
[0-9]{4}-(0[1-9]|1[012])-(0[1-9]|1[0-9]|2[0-9]|3[01])
but don't know if it's worked correctly.
Unfortunately I am not strong in regexp.