Linux Log monitor not triggering correctly

[pmurtey]

Hi All,
We have configured a log monitor on Linux to monitor a log and look for the Expression "ERROR" and trigger an alarm. Also the alarm was supposed to self clear after 10 minutes if no further "ERROR" messages were detected. Below is the monitor and the trigger setup. What is currently happening is the alarm is triggering when ever there is a new expression of any kind added to the log, not just the word "ERROR" . log[/data01/usr/Spectrum/Notifier/test2.log,ERROR] {v00uicaspec01r:log[/data01/usr/Spectrum/Notifier/test2.log,ERROR].nodata(10m)}=0 Can someone tell us what we are missing? TIA

[tim.mooney]

Is it configured as an "Active" check? That's required for log[].

See:

https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/zabbix_agent

[pmurtey]

Hi Tim, Yes it is set to ZABBIX agent(active)

[tim.mooney]

I'm not sure then what the problem is, but since you only care about whether the error has occurred or not, I would probably change my approach a little and either switch from log[] to log.count[] or stay with log[]/logrt[] and use str(ERROR,10m) instead of nodata(). Log with str() is a bit redundant, but it may give you better results. I would probably try log.count[] first.

[pmurtey]

Okay , we have a log file monitor working correctly. it is - {vmdou02p:log[/data01/application/logs/GatewayService.log,"5XX status code",,,skip,,].nodata(120m)}=0 This log monitor trigger detects the first occurrence of the expression and not clear until there are no further occurrences for 2 hours. This works, but how can we set the trigger to only alert if say 5 occurrences happen in 60 minutes? Then clear the alert if no further occurrences happen for 1 hour after that?

[cyber]

https://www.zabbix.com/documentation/current/manual/appendix/functions/history

count (/host/key,(sec|#num)<:time shift>,<operator>,<pattern>)

Number of values within the defined evaluation period.

combined with nodata(1h) you should be able to get your desired result.