get more line with log monitoring

[alescri]

hello,
i saw an ol post about regular expression and log monitoring,
i have some trouble with it.

actually my log file is something like that:

https://regex101.com/r/Zzcezn/1

i found a regular expression that catch more lines but i can't view it on zabbix latest data ,

the item is:
log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"(.*[[:space:]]GRAVE:.*)",,,,\1]

i tried to change the information type to log to text, but i still don't see anything in latest data,

where I'm wrong?

hope you can help me,
thanks

[dimir]

The Type of information of the item with key log must be set to Log (otherwise it won't work). If you want to catch the whole line you can just go with

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"[[:space:]]GRAVE:"]

or, if you want to catch all after "GRAVE":

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"[[:space:]](GRAVE:.*)",,,,"\1"]

It looks like your issue might be that the output is not double-quoted.

[alescri]

The Type of information of the item with key log must be set to Log (otherwise it won't work). If you want to catch the whole line you can just go with

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"[[:space:]]GRAVE:"]

or, if you want to catch all after "GRAVE":

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"[[:space:]](GRAVE:.*)",,,,"\1"]

It looks like your issue might be that the output is not double-quoted.

my idea is to havein latest data the complete log info like

lug 26, 2022 10:30:25 PM org.zkoss.zk.ui.http.WebManager <init>:179
GRAVE: File not found: file:///workarea/apache-tomcat/tomcatGA/confapps/GestioneAutorizzazioni/zk-production.xml

i tried your regexp but it doesn't work,
actually this one give me back a latest data but i loose some information

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,GRAVE,,,,]

in regex101 your regex works but zabbix's latest data are blank

we use zabbix version 5.2.7

any ideas?

[alescri]

(.*[[:alpha:]] [[:alnum:]].*\nGRAVE.*)
works on regexp101 but not on zabbix

[dimir]

And this one:

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"\sGRAVE:"]

?

[Markku]

Does using multiline option (https://www.pcre.org/current/doc/htm...tax.html#SEC16) (?m) change something? I mean, in regex101 it is set (the "m" in "gm").

Markku

[Hamardaban]

Multiline is not supported in log regex at zabbix.
Each line is processed separately!
As Markku wrote….

[alescri]

And this one:

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"\sGRAVE:"]

?

neither... as other member wrote probably multiline is not supported ....

[alescri]

Multiline is not supported in log regex at zabbix.
Each line is processed separately!
As Markku wrote….

thanks i hope it will be implemented

[dimir]

Oh man, you have endline there (\n), correct, line by line only, currently...

In your case I'd just go with the

log[/workarea/apache-tomcat/apache-tomcat-7.0.47_GA/logs/catalina.out,"^GRAVE:"]

Note, "^" means the beginning of the line.