Ad Widget

Collapse

last() function in log monitoring

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • pioterus
    Junior Member
    • Jul 2020
    • 9

    #1

    last() function in log monitoring

    I use item type 'log' to monitor file where many scripts writes their end status result.
    I have Action with this expression in message in email body:


    Script id: {{HOST.HOST}:scripts.script_id.last()}

    So the goal is to send in email information from log. item: scripts.script_id is 'dependent' type and depends on item type 'log' which has full line from log.

    There are many triggers which can react on the log entries. Every trigger searches for different string.

    It works fine but only when there is only one entry in log file at a time (I guess in one minute period). When two (or more) entries appear in log at the same time in email body I can see only the last entry. It sounds logical, but email is send twice (in this example lets assume both entries raised corresponding triggers). One email is with good subject/body pair (trigger name and its corresponding entry in the log are related), and one with good subject (with the trigger which raised the problem) but with wrong script_id - the same was used as from previous mail - here the last function actually returned the last value from log, not the one related to this trigger.

    How can I fix this? How to make sure, that in Action I reference to the value which actually woke up the trigger not the last() one?
    P.
  • cyber
    Senior Member
    Zabbix Certified SpecialistZabbix Certified Professional
    • Dec 2006
    • 4807

    #2
    I have a feeling that you would get better results, if you have multiple items reading same logfile, but searching for different patterns, that with one item and multiple triggers...
    If your single item returns some rows, each new value forces recalculation of all those triggers, where this item s used. By the time it reaches action, your last value can be already changed to a new value. So if you have some {ITEM.LASTVALUE} macros in action, they will just return wrong value, because it has been updated already.

    Comment

    Working...