Zabbix Macros to get latest items from a log

[radu990]

Hi guys,

After upgrading to Zabbix 6.0 I cannot get in Actions the Macros with latest entries working (which worked ok on Zabbix 5.x) .

I have a trigger which checks for a specific keyword apearing in a log, and once triggered I was receiving the actual entry log {ITEM.VALUE1} and the previous 10 values before that (to see what happened before).

The below output from Actions - Operations returns ok the Item.Value1, but not the last values/10 logs before. Can anybody help and suggest what happened/changed in the new Zabbix and how to make it working back?
Thank you in advance!

Trigger:

find(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],30s,"like","Lock(Mode=")=1 and nodata(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],10s)<>1

The related Item and all the logs entries (current and previous ones; logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\co nsole.log"]) are being populated correctly and I can see them all in Latest Data

Actions - Operations

{ITEM.VALUE1}

Latest 10 entries in the log on the server:
{?last(//{ITEM.KEY},#1)}
{?last(//{ITEM.KEY},#2)}
{?last(//{ITEM.KEY},#3)}
{?last(//{ITEM.KEY},#4)}
{?last(//{ITEM.KEY},#5)}
{?last(//{ITEM.KEY},#6)}
{?last(//{ITEM.KEY},#7)}
{?last(//{ITEM.KEY},#8)}
{?last(//{ITEM.KEY},#9)}
{?last(//{ITEM.KEY},#10)}

Result I'm getting on mail:

[1438:00D4-0F3C] Lock(Mode=S * LockID(Open Collection DB=E:\IBM\Lotus\Domino\data\slist.nsf NoteID=486)) Waiters countNonIntentLocks = 1 countIntentLocks = 0, queuLength = 7

Latest 100 entries in the log on the server:
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*

[Markku]

My mistake: when I said "item name" (or itemname) I actually meant item key, sorry about that.

Markku

[Markku]

See the documentation: https://www.zabbix.com/documentation...eration/macros

The syntax looks strange in the documentation but please experiment and report back how it goes.

Markku

[radu990]

See the documentation: https://www.zabbix.com/documentation...eration/macros

The syntax looks strange in the documentation but please experiment and report back how it goes.

Markku

Thank you very much for your reply. Actually I forgot to mention that I tried the syntax from the documentation and it didn't work neither. See the screenshot below (under Test section). That's why I'm asking here, as I experimented already a lot and nothing works. It worked well like this in Zabbix 5.x



Also tried to change the trigger to add some additional values in the trigger and Actions -Operations to extract the needed values as {ITEM.VALUE2} , {ITEM.VALUE3} etc. but also didn't work

Trigger

find(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],30s,"like","Lock(Mode=")=1 and nodata(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],10s)<>1 and length(last(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],#1))>0 and length(last(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],#2))>0 and length(last(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],#3))>0 and length(last(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],#4))>0 and length(last(/Server/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\console.log"],#5))>0

Actions - Operations (Test Section)

Test
{ITEM.VALUE2}
{ITEM.VALUE3}
{ITEM.VALUE4}
{ITEM.VALUE5}
{ITEM.VALUE6}
{ITEM.VALUE7}

[Markku]

Actually it looks like you miss one slash in the first picture: should be last(/hostname/logrt[xxx]) instead of last(/logrt[xxx])

Or how did you configure the text in the action?

Markku

[cyber]

{?last(/{HOST.HOST}/{ITEM.KEY},#1)} maybe?

[Markku]

cyber where is that "{?xxx}" syntax (with the question mark) coming from? A genuine question, I have seen that somewhere but didn't now find it in the documentation.

Markku

[cyber]

Lookups...
I am struggling a bit now to find exact page.. But example here shows usage in event name... https://www.zabbix.com/documentation...ion#example-17

EDIT: ahh.. found it..
https://www.zabbix.com/documentation...ression-macros

[Markku]

Right, so that's the correct feature to use:

Thus, expression macros can be used in:

• problem notifications and commands

as long as the {HOST.HOST} is added, I guess.

Markku

[radu990]

Unfortunately that doesn't work as well. I think I'll simply give up and don't use it, I'm out of ideas already. Sad that I updated to Zabbix 6, as it was working fine on Zabbix 5 and I was happy with how it was working....

Actions - Operations

Original problem ID: {EVENT.ID}

{ITEM.VALUE1}

Test
last(/{HOST.HOST}/{ITEM.KEY},#1)
last(/{HOST.HOST}/{ITEM.KEY},#2)
last(/{HOST.HOST}/{ITEM.KEY},#3)
last(/{HOST.HOST}/{ITEM.KEY},#4)
last(/{HOST.HOST}/{ITEM.KEY},#5)

Test2
{?last(/{HOST.HOST}/{ITEM.KEY},#1)}
{?last(/{HOST.HOST}/{ITEM.KEY},#2)}
{?last(/{HOST.HOST}/{ITEM.KEY},#3)}
{?last(/{HOST.HOST}/{ITEM.KEY},#4)}
{?last(/{HOST.HOST}/{ITEM.KEY},#5)}

Test3
{?last(/host/key,#1)}
{?last(/host/key,#2)}
{?last(/host/key,#3)}

Latest 100 entries in the log on the server:
{?last(//{ITEM.KEY},#1)}
{?last(//{ITEM.KEY},#2)}
{?last(//{ITEM.KEY},#3)}
{?last(//{ITEM.KEY},#4)}
{?last(//{ITEM.KEY},#5)}

Result on mail:

Original problem ID: 42503

[1438:00D4-0F3C] Lock(Mode=S * LockID(Open Collection DB=E:\IBM\Lotus\Domino\data\exec.nsf NoteID=5110)) Waiters countNonIntentLocks = 1 countIntentLocks = 0, queuLength = 18

Test
last(/CHMD01HV-1/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\co nsole.log"],#1)
last(/CHMD01HV-1/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\co nsole.log"],#2)
last(/CHMD01HV-1/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\co nsole.log"],#3)
last(/CHMD01HV-1/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\co nsole.log"],#4)
last(/CHMD01HV-1/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPORT\co nsole.log"],#5)

Test2
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*

Test3
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*

Latest 100 entries in the log on the server:
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*
*UNKNOWN*

[Markku]

I suggest that you search or open a ticket in https://support.zabbix.com.

Markku

[Markku]

In my test in Zabbix 6.0.5 these formats work (hostname = the host name in Zabbix, itemkey = the item key in Zabbix):

# 1 {?last(/hostname/itemkey)}
# 2 {?last(//itemkey)}
# 3 {?last(/{HOST.HOST}/itemkey)}

but this doesn't:

# 4 {?last(/{HOST.HOST}/{ITEM.KEY})}

It looks like {HOST.HOST} evaluates here to an empty string and that's why #3 works. But #4 does not work because also {ITEM.KEY} is empty within the expression macro, so the expression is "last(//)", which doesn't work.

Markku

[radu990]

In my test in Zabbix 6.0.5 these formats work (hostname = the host name in Zabbix, itemname = the item name in Zabbix):

# 1 {?last(/hostname/itemname)}
# 2 {?last(//itemname)}
# 3 {?last(/{HOST.HOST}/itemname)}

but this doesn't:

# 4 {?last(/{HOST.HOST}/{ITEM.KEY})}

It looks like {HOST.HOST} evaluates here to an empty string and that's why #3 works. But #4 does not work because also {ITEM.KEY} is empty within the expression macro, so the expression is "last(//)", which doesn't work.

Markku

Thank you very much for your reply. I've set the same on my side and it didn't work neither. Maybe something is corrupted on my side? Have the same Zabbix 6.0.5 version

Actions - Operations

Original problem ID: {EVENT.ID}

{ITEM.VALUE1}

{?last(/hostname/Domino Lock),#1}
{?last(/hostname/Domino Lock),#2}
{?last(/hostname/Domino Lock),#3}

Test 2
{?last(//Domino Lock,#1)}
{?last(//Domino Lock,#2)}
{?last(//Domino Lock,#3)}

Test 3
{?last(/{HOST.HOST}/Domino Lock,#1)}
{?last(/{HOST.HOST}/Domino Lock,#2)}
{?last(/{HOST.HOST}/Domino Lock,#3)}

Item:



Result:

[Markku]

My mistake: when I said "item name" (or itemname) I actually meant item key, sorry about that.

Markku

[radu990]

My mistake: when I said "item name" (or itemname) I actually meant item key, sorry about that.

Markku

You mean to set it like this?


Test 1
{?last(/hostname/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"]),#1}
{?last(/hostname/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"]),#2}
{?last(/hostname/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"]),#3}

Test 2
{?last(//logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"],#1)}
{?last(//logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"],#2)}
{?last(//logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"],#3)}

Test 3
{?last(/{HOST.HOST}/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"],#1)}
{?last(/{HOST.HOST}/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"],#2)}
{?last(/{HOST.HOST}/logrt["E:\IBM\Lotus\Domino\data\IBM_TECHNICAL_SUPPOR T\console.log"],#3)}

[Markku]

Yes, but your Test 1 has incorrect order in parenthesis, and instead of "hostname" you should use the actual host name in Zabbix.

(Also I don't know where the suspicious spaces are coming from but beware of them)

Markku