Log file rotation based on time

[Jarne St]

Hello

I want to monitor log files where the filename contains a date.
These are the files I want to monitor:

e:\LOGS\PVCCPlus\...\20191029\20191029_PS.txt (29/10/2019)
e:\LOGS\PVCCPlus\...\20191028\20191028_PS.txt (28/10/2019)
e:\LOGS\PVCCPlus\...\20191027\20191027_PS.txt ...
e:\LOGS\PVCCPlus\...\20191026\20191026_PS.txt

What are the possibilities to monitor such files?
Can I use a macro in my regular expression to match that date? Or how should the regular expression look?
Can I use the logrt item key for that?

I am using Zabbix version 4.0.13 on a Ubuntu VM (18.04.3).

Thanks for any help!

[Atsushi]

You can use logrt[] if there are multiple files in the same directory, but you cannot use logrt[] if the directories are different. In other words, regular expression cannot be used in the directory path in logrt[].
Since the file to be monitored seems to be a log file on the Windows platform, it may be possible to monitor by creating a link from the specific file name monitored by Zabbix to the latest log file using the mklink command.

[Jarne St]

Yes, the log files are stored on a Windows Server 2012 R2.
But how can I retrieve the date of my Windows Server?

I probably have to write a UserParamater to get the latest log file? (can I use the mklink command in a UserParameter)

[andris]

Two points: 1) logrt[] uses a fixed directory but filename is matched by regexp. So, you can write regexp matching the changing filename. 2) workaround for changing directory as already suggested might be creating a link. Try to make creating of this link to be a part of file rotation process.

There might be problems (missed records) if the log file is fast growing and its analysis is lagging due to MaxLinesPerSecond restriction ... and the log file goes away because of rotation (the new link points to a new log file and the previous, not-completely-analyzed file is not visible for logrt[] any more). You can raise 'maxproclines' parameter in logrt[] item key to mitigate it.

[Jarne St]

Hello,
After a lot off testing I found that I can't use the mklink command, because these directories are generated per day and if something is linked wrongly it means that the logging of my production server is broken.

I have another idea: can I resolve the date on my zabbix server, and use it in the log item key.
Item key:

log[e:\LOGS\PVCCPlus\Primary Server\{$MYDATE}\{$MYDATE}_PS.txt,,,,all,]

and resolve the date in {$MYDATE} macro.

But how can I resolve the date on my zabbix_server?