Log file monitoring (trigger if >4 occurrences in 10min), Zabbix 2.2

[mobu]

Hello all,

I've been trying to create trigger to react if there is for example >4 ERROR occurrences in log file within 10 minutes.

https://www.zabbix.com/documentation/2.2/manual/appendix/triggers/functions

Following trigger does not work:

{hostA:log[c:\path\to\log.log, ERROR].count(#600,4,"gt")

Is the calculated items way to go? For example like this

count("logrt[\"c:\path\to\log.log\",\" ERROR\"]",#600,4,"gt") and then create trigger? I can't really get my head around this.

[BDiE8VNy]

The parameter '#600' means within the last 600 values. What you actually want is '10m'.
Be aware that triggers having no time function are only checked for new values. So when this trigger is in PROBLEM state and no new values are send/received, then the trigger keeps in this state.

Edit:
I was to quick in answering
So, when applying the count() trigger function on a text based item, then one has to pass a string which occurrence or absence is count for the specified values/period.

{hostA:log[c:\path\to\log.log, ERROR].count(10m,"sub string","like")}>4
{hostA:log[c:\path\to\log.log, ERROR].count(10m,"exact string","eq")}>4
{hostA:log[c:\path\to\log.log, ERROR].count(10m,"exact string","ne")}>4

Anyhow, since you want to count just every value, this doesn't help in your case.

Edit2:
And overlooked something again
According to your item you have indeed a fixed string to count. Try this:

{hostA:log[c:\path\to\log.log, ERROR].count(10m, ERROR)}>4&{hostA:log[c:\path\to\log.log, ERROR].nodata(10m)}=0

[mobu]

Looks promising and thanks for the help. Anyway I'm struggling to get it work. All I am getting is an error "Incorrect item key "log[c:\path\to\log.log, ERROR]" provided for trigger expression on "hostA"."

I also tried vfs.file.regmatch item which also fails :\

[BDiE8VNy]

The item key has to match exactly.

So just hit 'Add' right next to the trigger expression input field and select the respective item.
Ignore the rest of the settings on the pop-up for adding an item, and add it.
Finally replace the trigger function (usually last()) and the expression in general to suit you needs.