Check Log File size Has Changed

[syntax1127]

Hello,
I am using Zabbix for monitoring proccess , services etc.
I would like to monitor one of our application by monitoring the log file.
I wish to monitor the log file size and check if it has been changed or not.
If it has been changed - then probably everything is working and the application is OK.
If the file has not been changed for 1 min or more, I would like to get a notification with error message.

I have tried to accomplish that with log[c:\tmp\test.log] in the key but it looks for a pattern while I would like to check if the log file has been changed or not.
What key should use in order to accomplish that? Maybe vfs.file.time? vfs.file.cheksum? ?

Please help.
Thanks in advance.

[tchjts1]

vfs.file.size[file]

[syntax1127]

Hi

Can You be more specific please?
I have created an item :

key :
vfs.file.size[d:\\test\\test.log]

Type of information : Text ( should it be something else?? Maybe change to Log? )

What should I type in the Trigger? I have this:

{servername:vfs.file.size[d:\\tbc\\1.log].last(0)}=0

Is that Ok ? what else?

Just to remind, I would like to get a notification whenever the log does NOT Change. Meaning the application is down and therefore nothing is being write to the log.
Thank you so much !

[tchjts1]

Since you are checking the size of a file (instead of reading the file contents), the type of information would not be text. I would use Numeric unsigned/Decimal. Units would be "B".

For your key, no need to put double backslashes in the path, as far as I know.
Same with your trigger.

So you probably would need to do a time-based trigger with this. Reason being, logs get randomly written to in most cases. if you did a simple "last" comparison with one minute polling intervals, you would get flooded with alerts. To give you an example of what we do to alert on some logs that would indicate out of control growth in the log, which is basically the exact opposite of what you are looking to do, is this:

({Template Rotational log monitoring:vfs.file.size[O:\RM\log\{#FILENAME}].last(0)} - {Template Rotational log monitoring:vfs.file.size[O:\RM\log\{#FILENAME}].last(0,1h)})>60M

We are doing that at the template level as a discovery rule, hence the {#FILENAME} variable. But what that trigger does is a comparison of values in in the last 1 hour. If the log has grown more than 60M in the last hour, that is an alert.

You could adapt that trigger for your purposes with something like last(0,1h)})=0 instead of last(0,1h)})>60M and of course you would change {#FILENAME} to be your specific log name. That would be an alert if your log did not grow in the last 1 hour.

The last thing you would need to do is set up an action for the e-mail alert to be sent to you. Do you know how to do this?

[syntax1127]

Hello again

First of all Thank you for the explanation.
What I also need is to make the trigger with the specific name of the log.
The log is called CP141210.LOG and it changes everyday by the current date of the date to CP141211.LOG and so on. How do I accomplish that?
I have updated the item to look like this:


vfs.file.size[d:\\tbc\\CP+ `date +%y-%m-%d.log`]
But now I get Not supported in the status of the item....

What do you think ?
Thanks again