Log trigger syntax

[Jackson_DKMG]

Hi,

Running 5.4.5 here, and trying to create triggers based on a log file content.

The log data is properly received from the zabbix active agent and shows in the server, in the format:

07/10/2021 07:44:29 : XXXX_IS_DOWN


My aim is to detect the 'DOWN' or 'UP' keywords for 'XXXX' (there are other things in that log, like YYYY or WWWW, which would be picked up by other items and triggers.

I don't understand how the trigger syntax works here, the documentation does not help and any tutorial even as recent as March 2021 is not applicable as the syntax seems to have changed since then.

for example :

last(/MY_HOSTNAME/log[/var/log/zabbix_checks.log, (?<=XXXX_IS_)DOWN,,,skip])="DOWN"

This syntax seems to be valid for this zabbix version, but is not working at all. Status of the item is "OK" always.


Any help or an example of how to implement this would be great.

[tim.mooney]

Zabbix 5.4.0 and later unified the trigger syntax for several different types of triggers:

What's new in Zabbix 5.4
Triggers, calculated and aggregated items in Zabbix 5.4


Because the change is very recent, all of the old documentation and tutorials prior to June 2021 are going to use the older syntax.

Regarding your specific issue, log[] is very powerful, but it's also complicated. Sometimes it's easier to use log.count() and trigger based on a numeric count. In your case, you really wouldn't be losing anything.

I haven't tested your issue (I'm not on 5.4.x yet), but I'm guessing your issue is because of this documented behavior for the log[] item:

If output is left empty - the whole line containing the matched text is returned. Note that all global regular expression types except 'Result is TRUE' always return the whole matched line and the output parameter is ignored.