Log Monitoring with multiple Lines

[dagee]

Hi there!
I do try to get an Logfile analysed, with a tricky format (see below)
Does anyone know how to extract the different Infos to trigger an alarm

The variable here could be
com.lirumlarum.ajax.login=unsuccessful


Apr 15, 2014 12:30:22 PM com.lirumlarum.mail.structure.handler.MIMEStructur eHandler.getCharset(MIMEStructureHandler.java:1035 )
WARN: Illegal or unsupported encoding "null". Using auto-detected encoding: "ISO-8859-1"
com.lirumlarum.ajax.action=get_structure
com.lirumlarum.ajax.module=mail
com.lirumlarum.ajax.requestNumber=105689
com.lirumlarum.ajpv13.remoteAddress=127.0.0.1
com.lirumlarum.ajpv13.remotePort=43210
com.lirumlarum.ajpv13.requestIp=127.0.0.1
com.lirumlarum.ajpv13.requestURI=/ajax/
com.lirumlarum.ajpv13.serverName=localhost
com.lirumlarum.ajpv13.servletPath=/ajax/
com.lirumlarum.ajpv13.threadName=AJP-Processor-0009064
com.lirumlarum.grizzly.userAgent=Lirum-Larum USM HTTP Client
com.lirumlarum.session.authId=de16ef73-8d8a-47bc-82bf-ce46caa6f199
com.lirumlarum.login.authId=monstera-test210671
com.lirumlarum.login.client=dcom.lirumlarum.ox.gui .dhtml
com.lirumlarum.login.clientIp=192.168.97.246
com.lirumlarum.login.login=Testuser
com.lirumlarum.login.userAgent=Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Apr 15, 2014 12:31:56 PM com.lirumlarum.usm.session.impl.USMSessionCacheCle anupLogInfoTask.run(USMSessionCacheCleanupLogInfoT ask.java:76)
INFO: 0 USM sessions (and 1 by JVM) and 3 SyncStates have been removed from memory cache since the last cleanup task.
Apr 15, 2014 12:31:56 PM com.lirumlarum.usm.session.impl.USMSessionCacheCle anupLogInfoTask.run(USMSessionCacheCleanupLogInfoT ask.java:76)
INFO: 0 USM sessions (and 0 by JVM) and 0 SyncStates have been removed from memory cache since the last cleanup task.

[dagee]

Just for better understanding:
as you can see, in the sample log, there are three events
1 big entry with a warning and some Details
and two short entries with info in an extra line

the problem is, that i just know how zabbix reads syslogs, but not this format

is there any idea?

[dirckcopeland]

Dagee,
You would want to user a UserParameter, something like:

All one line:

UserParameter=search.log, grep com.lirumlarum.ajax.login=unsuccessful /var/log/my-log-file

Add that to your zabbix_agentd.conf file and create your item with the key:

search.log