Trigger configuration for log file counts

[Micha2222]

Hello Zabbix community. I am searching for a configuration of the following scenario:
I am searching logs for keywords and want to fire the trigger if the keyword was found for example 10 times in a timerange of 5 minutes.
All my configuration failed in past, thank you for support.

[Micha2222]

I thought it was easy but since noone replies it might be not even possible :-D

[dimir]

The suspicious part here is “logs”. If that’s a single log file, that’s single item and that’s easy, otherwise it’s hard to imagine what exactly is the task here.

[Micha2222]

Thanks for your reply, Dimir. Easy sounds pretty awesome. I am checking bind9 querylog for any resquests. The trigger fires at any ANY request so I would like it set up that it will fire when it is found 10 times in the past 5 minutes. The log is checked every second with skip command.

[dimir]

Looks like you could use trigger function count() in your trigger expression:

count(/host/key,5m,"like","error")>9

Which translates to: fire a trigger if the item with key key on the host host will contain more than 9 values that match the word "error" in the last 5 minutes.

[Micha2222]

Man thank you so much, this works! :-)