Logs monitoring

[Tatiana]

Hi,

I’m trying to configure log monitoring and working on a triggers setup. It seems to be working fine if I know what my regexp or str is, but I want to be notified about ANY new entries in my log file without specifying the string. Basically, I need a regexp for any string which will work with zabbix expression function. I tried to use (.*) and it doesn’t work as I expected.

{Log Server:log[/var/log/zabbixls/messages].regexp(.*)}=1

Thanks for any help…

[Semiadmin]

{Log Server:log[/var/log/zabbixls/messages].strlen()}>0

[Tatiana]

Thank you Semiadmin, but unfortunately .strlen()}>0 doesn't work for me either - the trigger doesn't change its state to "problem" with the new lines in the log file.
I have other two triggers configured:

{Log Server:log[/var/log/zabbixls/messages].regexp(Starting)}=1 {Log Server:log[/var/log/zabbixls/messages].str(error)}=1

...they both work as expected - they trigger the problems and I receive emails...

[colin88]

Do you still have the problem?
Try

{Log Server:log[/var/log/zabbixls/messages].regexp(\S+)}=1

\S looks for any non-white space character, + means "one or more of that". This should ignore new lines in your log file.


As a general tip for regex:
Have a look at http://regex101.com. You can test your regular expressions and there is also a quick reference.

[Tatiana]

Thank you colin88. I think I found what my problem was. In a trigger setup I set "PROBLEM event generation mode" to "Single" and it didn't really work properly in my case, with "Multiple" mode - it seems to be working fine so far. I just still don't understated why this two worked fine with a "Single" mode:

{Log Server:log[/var/log/zabbixls/messages].regexp(Starting)}=1
{Log Server:log[/var/log/zabbixls/messages].str(error)}=1

[dtalero798]

Hi

please a need help ,

i create monitory log for this key log[/var/www/zabbix/SE_SAPASE.log,"cpu"],

desire is that when the field is modified the action generates me for example, if the field cpu the file changes from 27 to 100, nowadays I have this launcher but I do not believe that it expires with the conditions that I need example "{192.168.50.180:log [/var/www/zabbix/SE_SAPASE.log, "cpu"] .diff (0)} <=20"