Log Monitoring not working

[bkimura]

Hello,
I'm trying to setup some basic log monitoring. (i.e., scrape for error string in /var/log/syslog) I've created the item as follows:
log[/var/log/syslog,error]
Type = Zabbix agent (active)

I've created the trigger as follows:
{dal1vwebmin03d.core.drs.master:log[/var/log/syslog,error].str(error)}=1

I then running "logger error" on the server in question and confirm that the error string makes it to /var/log/syslog. I've also confirmed that the zabbix account has read access to /var/log/syslog. (Added account to adm group on Ubuntu which has read access to the file)

Alerts are not being generated. What am I doing wrong? I've tried creating the trigger several different ways all to no avail.
root@dal1vzabbix01d:~# zabbix_server -V |head -1
zabbix_server (Zabbix) 4.0.5

Thanks,
- Bill

[bkimura]

I'm finally receiving alerts but there's no content. Is there a way that I can configure the item and/or trigger such that when it fires, the email I receive actually displays the line contained in the log file? Right now, I'm only receving a generic email that contains the following: (I'd like to see the entire line from the logfile that contains "error" for example) Thanks.

Problem started at 16:51:11 on 2019.03.18 Problem name: Syslog Error
Host: dal1vubudck01d
Severity: Warning

Original problem ID: 137

[bkimura]

Can someone please post one of their items and trigger for monitoring a log file for a particular string in which the notification actually contains the entire line from the log file? Thank you!

[burakkiymaz]

I'm finally receiving alerts but there's no content. Is there a way that I can configure the item and/or trigger such that when it fires, the email I receive actually displays the line contained in the log file? Right now, I'm only receving a generic email that contains the following: (I'd like to see the entire line from the logfile that contains "error" for example) Thanks.

Problem started at 16:51:11 on 2019.03.18 Problem name: Syslog Error
Host: dal1vubudck01d
Severity: Warning

Original problem ID: 137

How did you resolved your alert problem? Can you share configuration?