Logrt and logrt.count of errors repeat past errors
Hi,
My log files are rotating per day. the file names are always like `logfile-2022-12-02.log`. Only the date part differs.
I am trying to use logrt to show errors from a log file only once since the previous measure time.
Same for logrt.count, I am trying to count the number of errors which happened since the last measure time.
Item type is `Zabbix agent (active).
Key is `logrt[/var/logs/logfile*,ERROR,,,skip]`.
It seems to work fine. I see
Then when another error happens, I see the new error but also the old error.
When the 3d error happens, I see the same 2 lines + the new error, etc.
What I expected was to see each line only once.
What actually happens is that on every file change, all error message are sent again, which results in a lot of duplicate messages.
Can anyone explain this behaviour?
For logrt.count it is similar.
Key is `logrt.count[/var/logs/logfile*,ERROR,,,skip]`
I see the following.
According to the graph, At 06:00 there are 8 new errors. At 07:00 there are 8 new errors; at 07:30 again 8 new errors etc.
What actually happened, is that during the night, there were 8 errors, but at the times where the peaks are visible in the graph, simply some `debug` line was written in the log so the file changed.
Apparently each time anything is written to the log file, `DEBUG` info in this case, the the Zabbix item sends the complete count of `error` occurences in the whole file.
When no the file does not change, then it sends `0`.
What I expected would be that Zabbix sends how many errors happened between each measure time.
Meaning if the update interval is 1 minute, then I would expect to receive the number of `error` occurences of the past minute; not the accumulation of errors today.
Thanks a lot.
My log files are rotating per day. the file names are always like `logfile-2022-12-02.log`. Only the date part differs.
I am trying to use logrt to show errors from a log file only once since the previous measure time.
Same for logrt.count, I am trying to count the number of errors which happened since the last measure time.
Item type is `Zabbix agent (active).
Key is `logrt[/var/logs/logfile*,ERROR,,,skip]`.
It seems to work fine. I see
Then when another error happens, I see the new error but also the old error.
When the 3d error happens, I see the same 2 lines + the new error, etc.
What I expected was to see each line only once.
What actually happens is that on every file change, all error message are sent again, which results in a lot of duplicate messages.
Can anyone explain this behaviour?
For logrt.count it is similar.
Key is `logrt.count[/var/logs/logfile*,ERROR,,,skip]`
I see the following.
According to the graph, At 06:00 there are 8 new errors. At 07:00 there are 8 new errors; at 07:30 again 8 new errors etc.
What actually happened, is that during the night, there were 8 errors, but at the times where the peaks are visible in the graph, simply some `debug` line was written in the log so the file changed.
Apparently each time anything is written to the log file, `DEBUG` info in this case, the the Zabbix item sends the complete count of `error` occurences in the whole file.
When no the file does not change, then it sends `0`.
What I expected would be that Zabbix sends how many errors happened between each measure time.
Meaning if the update interval is 1 minute, then I would expect to receive the number of `error` occurences of the past minute; not the accumulation of errors today.
Thanks a lot.
Attached Files
Comment