Zabbix trigger on log string

[tlacroix]

Hey everybody,

I had a dream that one day, i would be able to set triggers on specific words in monitored log files (such as "CRITICAL", "WARNING" -strange huh?-), in order to be mailed when critical things happends.

So i created the two following items

Type : Zabbix Agent (active)
Key : log[/here/is/my/zabbix/readable/log,CRITICAL]
Type : Log
Refresh : 30s
[stuff]

Type : Zabbix Agent (active)
Key : log[/here/is/my/zabbix/readable/log,WARNING]
Type : Log
Refresh : 30s
[stuff]

and the following triggers

{ZABBIX:log[/here/is/my/zabbix/readable/log,CRITICAL].nodata(600)}=0
{ZABBIX:log[/here/is/my/zabbix/readable/log,WARNING].nodata(600)}=0

(found this one on the WEB, and seems to work)

Edit : the log comes from a crontab, the cron overwrites the last log.
The log contains only one line telling me the status (OK, WARNING, CRITICAL, etc)

To be sure, i gave it a try, and opened my ESXI chassis
YAY, i receive a mail "PROBLEM - CRITICAL blahblahblah"
So i closed my chassis, and got the "OK" mail back.

But now, when i go to ZABBIX's last values, i still can see the item's last value to "CRITICAL blahblahblah" for the item created. Not "OK blahblah" as it is now written in the log file.

CRITICAL ESXI 05 Déc 2014 15:45:17 CRITICAL : System Board 1 Intrusion 0

When i write this, it's 16.15, the item seems not to be updated.
And i don't understand why.

If i edit the logfile, i can see "OK blablablabla" and no more "CRITICAL blahblahblah"

any hint?

Thanks!

[jan.garaj]

log[/here/is/my/zabbix/readable/log,CRITICAL]
log[/here/is/my/zabbix/readable/log,WARNING]

Second parameter of log item is <regexp> - regular expression describing the required pattern. So your zabbix agent care only about lines in your log file, which contain only strings "CRITICAL" or "WARNING", not "OK"

https://www.zabbix.com/documentation/2.4/manual/config/items/itemtypes/zabbix_agent

[tlacroix]

Thanks for the feedback, i'll try to set the trigger to match values different from *OK* instead of listing values like i've done.