Trigger function for log monitoring

[abiswas]

I am new to zabbix. I have a basic requirement of monitoring occurrence of different log messages using zabbix. Say, when there is a log message "server starting", zabbix should show that alert. The idea is that if the server (re)starts 10 times in last 10 minutes, the zabbix dashboard (or at any other place) should display that 10 times.

I have done the following for that :

1. Created an item under template MyTemplate:

Type : Zabbix Agent (Active)
key : log[/opt/mylog/logs/abc.log,server starting]
Type of information : Log
Update Interval (in sec) : 30

2. Created a trigger with expression :

{MyTemplate:log[/opt/mylog/logs/abc.log,server starting].logeventid(1)}=0

With logeventid(1), I am seeing that the alert (trigger) is getting generated only once. It appears only once in the Dashboard --> Last 20 issues. If I go to Monitoring --> Trigger, I see the alert only once, although the log files have 10 entries of the message "server starting" (server restarted 10 times).

Then I set the trigger to following :

{MyTemplate:log[/opt/mylog/logs/abc.log,server starting].nodata(300)}=0

Now, at Monitoring --> Trigger, I see the alert (trigger) 10 times, but, from the Dashboard "Last 20 issues" it vanishes just after 300 seconds.

My questions are :

1. What should be the trigger function, I should use? I want to see 10 alerts in zabbix if the same message appears 10 times in the log file within a period of time.
2. With nodata(300), why does the alert vanish after 300 sec?
3. Is it ok if I use 30 minutes instead of 300 seconds as an argument of nodata()?

[abiswas]

I posted the question to stack overflow as well. The suggestion worked for me :

http://stackoverflow.com/questions/2...92292#29692292

================================================
Function logeventid() is normally used for Windows and VMware event logs. In this case, it should probably not be used and it is suspicious that it fires, which might indicate a bug in Zabbix.

Anyway, you can check "Multiple PROBLEM events generation" box in trigger configuration and the trigger will generate a new PROBLEM event every time the condition is true, regardless of its previous value. Instead of logeventid(), you can try using a function that is always true, for instance, strlen()>0.

If you wish the trigger to go into OK state after some time, say, 10 minutes, you can add nodata(10m). Then your trigger will look like this:

{MyTemplate:log[/opt/mylog/logs/abc.log,server starting].strlen()}>0 and
{MyTemplate:log[/opt/mylog/logs/abc.log,server starting].nodata(10m)}=0
================================================