Log file monitoring recovery state

[Manish]

Hello,

I am monitoring log file and its working great, however I have problem in recovery state. I am searching specific string from log file and if its count greater than 50 in last 5 min then I get email alert however even though that error goes alert does not go untill next occurance of same string comes and its count less than 50. I want some solution on this.

My trigger look like this:

{Template Tkc:log[/path/to/logfile,string1 | string2 ,skip].count(300,string1)}>50 or {Template Tkc:log[/path/to/logfile,string1 | string2 ,skip].count(300,string2)}>50

[Firm]

I think this happens because no data is received until new entries of string emerge. Try to divide your item into 2:

log[/path/to/logfile,(string1),,,,\1]
log[/path/to/logfile,(string2),,,,\1]

These items return number of corrsponding string entries. Next create trigger like:

{host:log[/path/to/logfile,(string1),,,,\1].sum(300)} > 50 or {host:log[/path/to/logfile,(string2),,,,\1].sum(300)} > 50

[Manish]

Thanks for your reply.

However I dont understand your statement "Try to divide your item into 2". You mean shall I create 2 items??

[Firm]

Exactly. Check item parameters I wrote.

[Manish]

Ok, but dont you think it will put extra load on zabbix server, since agent has to send same log file data for multiple string.

The reason why I am telling this is I am searching total 10 string from same log file, so if I create 10 items I think it will put load on zabbix server.

[Firm]

Oops, forget all I wrote above. \1 returns pattern matches not number of them. Count() functionality is not available on agent's side. You may need to write your own script to count matched strings.

[Manish]

Hello there,

I am still waiting for best answer on this issue. If you are saying count function is not available then with count function used I would have not got alert but I am getting alert.