Monitoring LOG file, not returning OK

[gieter]

Dear all,

I've been fighting with this issue for a while, so hopefully someone can help me.
The situation is as follows:
I have two Linux servers which to synchronize some folders every night. The sync information is written to a log file: sync.log. That's all working fine.
Whenever the word "Unable" shows up in the log file, Zabbix will notice that and sends me a "Problem" by email. That's also working fine. The expression I use is: {App SYNC:log[/opt/sync/sync.log,Unable].str(Unable)}=1.
Can someone please tell me which expression I have to use (or add with &) to make Zabbix to return OK whenever the word "Unable" is not existing anymore in the log file?
Right now I use: {App SYNC:log[/opt/sync/sync.log,Unable].str(Unable)}=1&{App SYNC:log[/opt/sync/sync.log,Unable].nodata(30)}#1. So after 30 seconds Zabbix sends me an OK automatically.. It doesn't matter whether the problem is solved or not.

To make things clear, I will add some extra info:
If the sync fails, "Unable to sync" will appear in the log file. Zabbix will report a Problem.
If I sync manually, the log file will only log the files that were synchronized. The word Unable does not exist in the log file anymore. Zabbix should report an OK on this trigger.

Thanks for all the help!

[gieter]

A little step further

Removing Unable in log[/opt/sync/sync.log,Unable] worked a little bit. But now Zabbix is scanning all the lines in the log file, which is OK for me, but I get a report from Zabbix of every line as well. Whenever Unable is found in the log file, I get an OK or Problem on every line.
Anyway, I get the feeling that I'm getting closer to solution. Hopefully someone else can help me out to really solve my issue:-)

Thanks

[gieter]

Fixed

Hi All,

Unfortunately nobody helped be out, so I kept trying myself. (Which is not always a bad thing)

I have changed the Item to: log[/opt/sync/sync.log,starting|Unable].
Zabbix is checking this log once in a while and a string with Starting is always there. If "Unable to connect" shows up in a string, there is a problem, which is defined in the trigger expression: log[/opt/sync/sync.log,starting|Unable].str(connect)}=1

If Zabbix is only looking for a string that contains the word Unable (Like I did in my previous try) it only works whenever the word Unable shows up in the log file. Whenever there is NO string in the log that contains the word Unable, the values are not updated in Latest Data and Zabbix will never update the problem to OK.....
If someone wants more specific info about this issue, please PM me:-) I'm willing to help...I know how frustrating this can be:-)

[alientm]

My Item:

Type: Zabbix agent (active)
Key: log[D:\apl\log\apl.log,time-out]

Trigger:
{PC:log[D:\apl\log\apl.log,time-out].strlen()}>0 and {PC:log[D:\apl\log\apl.log,time-out].nodata(10m)}=0


work ok for me