Monitor only the most recent lines in Windows logfiles in zabbix

[mskieszabbix]

Hi everyone,

I am fairly new to Zabbix and am trying to monitor my sqlserver database logfiles with zabbix. The logfiles are very large though and I would like zabbix to only scan the lines withs today's date.
I am using a discover rule to discover the logfiles and then I use logrt to check for lines with error or failed in it.
I only want zabbix to look at de lines of today in the error log. Is this possible? I have looked at the zabbix docs and searched on the Internet without any luck.
I created a trigger that looks like this:
{sqlserver_template:logrt[{#ERRORLOG},Error|Failed,"UTF-16",20].now(0)}>0
and {sqlserver_template:logrt[{#ERRORLOG},Error|Failed,"UTF-16",20].count(3600,error)}>1
But it scans the whole file.
Can someone please help me?
Thanks in advance.

[Hamardaban]

Maybe this will help you: logrt[file_regexp,<regexp>,<encoding>,<maxlines>,<mode>, <output>,<maxdelay>,<options>]
maxdelay - maximum delay in seconds. Type: float. Values: 0 - (default) never ignore log file lines; > 0.0 - ignore older lines in order to get the most recent lines analyzed within “maxdelay” seconds. Read the maxdelay notes before using it!

[mskieszabbix]

Thanks. I will try it

[andris]

Have you considered setting "mode" parameter to "skip"? It affects only newly created log[]/logrt[] items - to skip all existing records. Once the log file is started to monitor, it follows all newly appended records without skipping. It could be combined with maxdelay.