Multiple triggers on same log item?

[SunF1re]

Hi,
I have a simple log item that should capture all lines with "Error" in it:

log[/var/log/freeradius/radius.log,Error]

Works fine. Now I would like to create a few triggers that are more granular in detecting what may be the error. Here are the requirements:

a) trigger should fire as soon as a string is matched in a log row
b) trigger should auto deactivate if there hasn't been a new row with the string matched for 10 minutes
c) trigger must not deactivate early when new log entries come in that don't contain the string
d) there should only be email notification when the trigger initially fires, not one per matching log row

So here is my first try:

{Template App FreeRADIUS:log[/var/log/freeradius/radius.log,Error].nodata(600)}=0 &
{Template App FreeRADIUS:log[/var/log/freeradius/radius.log,Error].str(rlm_jradius)}#0

At first this seemed to be meeting the requirements. When a log line was matched the trigger fired and went back to normal after 10 minutes. But the issue now was when I was when a log entry came in within the 10 minutes that did not match the string the trigger went back to normal early thus violating requiremtn c). It gets even worse when log lines alternated between a line with and a line without the match in quick succession...

So I thought that maybe extending the str() function with a time range would solve that:

{Template App FreeRADIUS:log[/var/log/freeradius/radius.log,Error].nodata(600)}=0 &
{Template App FreeRADIUS:log[/var/log/freeradius/radius.log,Error].str(rlm_jradius, 600)}#0

Again, at first this seemed to be working fine until for 10 minutes there was not log entry at all. Then Zabbix complained that the second expression would not compile.

Anybody has an idea on how to create a trigger that would satisfy my requirements?

I am using Zabbix 2.2.5.

Thanks

[filipp.sudanov]

Time specification in str() (and simular) function is tricky. The might be an error report or feature request on that at support.zabbix.com, you can try to search.

The error is, that str() looks through last 10 minutes and does not find any single value. It's getting sad out of it. This is happening, because there is nodata(600) function in trigger expression - it's a time-based function and it's forces trigger to recalculate every 30 sec. If there was no nodata() function, then the trigger would recalculate only when a new value comes in and str() function would work normally.
Just trying to expalin how it works.

You can look towards dependent triggers, may be there's a way to solve your task with them.

[SunF1re]

Time specification in str() (and simular) function is tricky. The might be an error report or feature request on that at support.zabbix.com, you can try to search.

The error is, that str() looks through last 10 minutes and does not find any single value. It's getting sad out of it. This is happening, because there is nodata(600) function in trigger expression - it's a time-based function and it's forces trigger to recalculate every 30 sec. If there was no nodata() function, then the trigger would recalculate only when a new value comes in and str() function would work normally.
Just trying to expalin how it works.

You can look towards dependent triggers, may be there's a way to solve your task with them.

Thanks for the explanatin but I needed the nodata() to do exactly that: reevaluate the expression every x seconds so that I can disable the trigger after 10 minutes if no further errors showed up in the log. I didn't see any other way to do that. Is there?

IMHO the problem is really that the time specification in the str() function (and also regexp() for that matter) is producing an compile error when there are not data points available in that time to work on. The more intuitive thing to do would be to evaluate the expression to false. Since after all there was not string that matched. It shouldn't matter if there were not strings at all to check against.