Windows log file monitoring - recovery problem

[alientm]

Log fragment:
...
A response to the network message was received: 1814: 800
A response to the network message was received: 1814: 800
No response to the network message (time-out)
A response to the network message was received: 1814: 800
A response to the network message was received: 1814: 800
A response to the network message was received: 1814: 800
A response to the network message was received: 1814: 800
...

Zabbix agent: active

Key: log[D:\jHost\log\jHost.log,time-out]

Expression:

{SERVER:log[D:\jHost\log\jHost.log,time-out].str(time-out)}=1 and {SERVER:log[D:\jHost\log\jHost.log,time-out].nodata(10m)}=0

If zabbix finds the expression "time-out" in the log file, then since finding the expression, unfortunately, I have been reporting the problem all day and then OK, the problem and OK, and so until the next day when a new log file appears without the word "time-out".

[alientm]

Is it possible that the problem is probably that the log (xml) file is read every time by zabbix from the first lines and each time finds the "time-out" that occurred earlier?

[Hamardaban]

Try use maxlines \ mode \ maxdelay option of log key.

https://www.zabbix.com/documentation/4.2/manual/config/items/itemtypes/zabbix_agent

[alientm]

i try

log[D:\jHost\log\jHost.log,"time-out",,,skip,,]

but zabbix still collects log data as if from the beginning of the jhost.log file.

[Hamardaban]

skip - only for the newly created data item. Then only new lines are processed. Just start with an empty file! :-)

[alientm]

OK, I understand, I will wait until tomorrow, the application creates a new log file with the same name every day (the old one is packed).

[alientm]

However, it doesn't work as I would like.
I forced 2 errors after 7 and 9 o'clock. After the error at 7 o'clock correctly zabbix turned off warning, but after the error at 9 o'clock continuous finds an error in the log file - although the error has not occurred since 9 o'clock.