Multiple alerts for same line in log

[bkimura]

Hello,
I'm trying to configure a trigger that'll send me an email notification if the string "error" is found in /var/log/messages. I would like to be alerted on every NEW line in the log file that contains the string. Here is my configuration:

ITEM:
log[/var/log/messages,"error"]
TRIGGER:
{davms120022:log[/var/log/messages,"error"].nodata(300)}=0
* PROBLEM event generation mode = Multiple

With this configuration, if I echo "error" to the logfile once, a new problem will be created every 30 seconds (item update interval) and I'll get bombarded with email.
I am looking to only generate a new problem if the value is NEW. (i.e., a new line) Can someone please enlighten me as to how I need to modify the trigger to accomplish this?

Thanks,
- Bill

[brunohl]

I don't use much this Item key, but reading the docs, I guess you coud use "mode" parameters, to skip, so it will ignore new data log[file,<regexp>,<encoding>,<maxlines>,<mode>,<output >].

[bkimura]

Thanks brunohl for the reply. I'm presently using trigger the following trigger and it's working as expected. (1 problem per new line)
{davms120022:log[/var/log/messages,"ERROR|error"].regexp()}=1

However, I've tried several different things and I can't get this to auto-close after 10 minues. I even tried adding the following as a recovery expression but it just doens't work.
{davms120022:log[/var/log/messages,"ERROR|error"].nodata(600)}=0

Any ideas on how I can get these problems to auto close based on the problem expression above? Thanks!

[brunohl]

Have you tried to set your recovery expression to {davms120022:log[/var/log/messages,"ERROR|error"].regexp()}=0 ?

[bkimura]

Just tried it, no luck. I guess for now, I'll just plan on closing out the tickets manually. Not that big of a deal. Just would have been nice to automate the closing. Thank you for the follow-up.

[brunohl]

You could always use the Zabbix API to "manually" close it