Monitoring if file modification time is recent

[Paardekooper]

Hi,

I have a Linux (Red Hat) server with the Zabbix agent installed. On this server a process is running which generates log files. When the process is not running the log file become out of time. Is it possible to monitor these files on their modification date and trigger when it is older than 20 minutes? If so, how can this be done?

[steveboyson]

Define an item:

vfs.file.time[/your/file]

then define a trigger:

{Template_XXX:vfs.file.time[/your/file].now(0)} - {Template_XXX:vfs.file.time[/your/file].last(0)}>300

which will fire if /your/file is older than 300 seconds.

[Paardekooper]

Hi Steveboyson,

Thanks for your reply.

I was able to create a new template with 4 items. This is one of the items I have created:

vfs.file.time[/disk1/raw/dbs/progress/dbslive/odisy.lg]

When I try to create a trigger it shows this error:

Incorrect trigger expression. Host "Template Afterimage" does not exist or you have no access to this host.

This is the expression I entered:

{Template Afterimage:vfs.file.time[/disk1/raw/dbs/progress/dbslive/odisy.lg].now(0)} - {Template Afterimage:vfs.file.time[/disk1/raw/dbs/progress/dbslive/odisy.lg].last(0)}>1200

[Paardekooper]

Okay now I definitely found the answer. It has nothing to do with zeros. It all has to do with case sensitivity. My trigger should be:

{Template After[B][U][COLOR="red"]I[/COLOR][/U][/B]mage:vfs.file.time[/disk1/raw/dbs/progress/dbslive/odisy.lg].now(0)}-{Template After[U][B][COLOR="Red"]I[/COLOR][/B][/U]mage:vfs.file.time[/disk1/raw/dbs/progress/dbslive/odisy.lg].last(0)}>1200

[Gunnar.Mann]

Slight improvements

Some thoughts on your proposal:

• Use fuzzytime in your triger expression - no need for calculation here. Example: fire problem event in case /your/file has not been changed for 1 day now:
  [CODE]{Template_XXX:vfs.file.time[/your/file,modifiy].fuzzytime(1d)=0}/CODE]
• It may be a good idea to have that "vfs.file.time" item configured with unit "unixtime" so modification time is getting displayed nicely under "Latest Data"

[Gunnar.Mann]

A simplified trigger expression using "fuzzytime" function would be

{Template_XXX:vfs.file.time[/your/file,modify].fuzzytime(7d)}=0

which fires a problem event in case "/your/file" has not been touched for 1 week. This trigger requires the same "vfs.file.time[..." item (Numeric/Decimal).
I set "Units" to unixtime so the modification time is displayed properly as date under "Latest Data"

[vigneshn]

A simplified trigger expression using "fuzzytime" function would be

{Template_XXX:vfs.file.time[/your/file,modify].fuzzytime(7d)}=0

which fires a problem event in case "/your/file" has not been touched for 1 week. This trigger requires the same "vfs.file.time[..." item (Numeric/Decimal).
I set "Units" to unixtime so the modification time is displayed properly as date under "Latest Data"

Great solution. Thank you.

[[email protected]]

Good morning, what if it was for files and not 1 file? How do I do ? The files would have the same extension.

[dstrickler]

If you'd like to see a similar way to do this, I've included a Zabbix Template in this post as well: https://dstrickler.com/monitoring-a-...chine-backups/