AS400 Monitoring

[Maiky]

Hi,

I installed the Zabbix agent emulator for AS/400 platform. I want to retrieve all messages from QSYSOPR with specific eventid. It's like :

{server:eventlog[QSYSOPR,,50,,,100,all].nodata(1d)}<>1 and {server:eventlog[QSYSOPR,,50,,,100,all].regexp("^(CPA.*|CPP.*|RNQ.*|CPF.*). The trigger work's fine (see attachments)

My problem is when i remove the message in QSYSOPR, the alert stays there. i've no error in zabbix proxy/server logs. Do you have an idea to know why alert persists ?

[Maiky]

Ok it seems to be good, i've changed the nodata value.

[Karthick Balan]

Hi Maiky

We like to monitor a Specific Message ID'S in QSYSOPR for Eg. CPF2405. Can you provide me the syntax for the same.?.

[dave_t]

You can setup very basic triggers like this for any line that starts with CPPEA

There are more complex Triggers included with the template.

HTH

High

New critical message (CPPEA) in AS400 message queue

{Template AS400:eventlog[QSYSOPR,,70,,,100,skip].nodata(3d)}<>1 and {Template AS400:eventlog[QSYSOPR,,70,,,100,skip].regexp("^(CPPEA)")}=1

[dave_t]

Personally, I think this makes things a bit easier to manage

	High	New critical message (CPPEA) in AS400 message queue		{Template AS400:eventlog[QSYSOPR,,70,,,100,skip].nodata(3d)}<>1 and {Template AS400:eventlog[QSYSOPR,,70,,,100,skip].regexp("^(CPPEA)")}=1	Enabled
	High	New critical message (Attention) in AS400 message queue		{Template AS400:eventlog[QSYSOPR,,70,,,100,skip].nodata(3d)}<>1 and {Template AS400:eventlog[QSYSOPR,,70,,,100,skip].regexp("Attention")}=1	Enabled
	High	New critical message (abnormal) in AS400 message queue		{Template AS400:eventlog[QSYSOPR,,70,,,100,skip].nodata(3d)}<>1 and {Template AS400:eventlog[QSYSOPR,,70,,,100,skip].regexp("abnormal")}=1	Enabled
	High	New critical message (error) in AS400 message queue		{Template AS400:eventlog[QSYSOPR,,70,,,100,skip].nodata(3d)}<>1 and {Template AS400:eventlog[QSYSOPR,,70,,,100,skip].regexp(" error")}=1

[dave_t]

...but here's another way of triggering an event, using the "|" symbol as the "or" condition in the regex:

Warning

New error message in AS400 message queue

{Template AS400:eventlog[QSYSOPR,,70,,,100,skip].nodata(7)}<>1 and ({Template AS400:eventlog[QSYSOPR,,70,,,100,skip].regexp("^CPPEA33 ")}=1 or ({Template AS400:eventlog[QSYSOPR,,70,,,100,skip].logsource("^#OVERRIDE")}=0 and {Template AS400:eventlog[QSYSOPR,,70,,,100,skip].regexp("^(CPI2401|CPA5201|BRM1472|BRM1392|CPA7025|CPI096E |CPI5906|CPPEA33|CPF8198|CPF9E7E|CPF9E7D) ")}=0) )