Create a trigger for files bigger than "x" MB

[Fabrizio We BiNar]

Hi everyone, I need help creating a trigger that signals me every time there is a file with the "_jpeg.zip" extension in the "c:\test\dicom" folder that is larger than 620 MB, Zabbix version is 5.0.17
I created an item with this key: vfs.file.size[C:\test\dicom\*_jpeg.zip]
and this trigger: {hostname:vfs.file.size[C:\test\dicom\*_jpeg.zip].last()} > 260000000

but this doesn't seems to work, because i recive this message from the logs:
"vfs.file.size[C:\test\dicom\*.zip]" is not supported: Cannot obtain file information: [2] No such file or directory"
any suggestion?

[cyber]

vfs.file.size requires full path to and name of a file.. you cannot use wildcards.

you can try to work with vfs.dir.size item.

vfs.dir.size[dir,<regex_incl>,<regex_excl>,<mode>,<max_depth>,< regex_excl_dir>]
Directory size (in bytes).	Integer	dir - absolute path to directory regex_incl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to include; include all if empty (default value) regex_excl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to exclude; don't exclude any if empty (default value) mode - possible values: apparent (default) - gets apparent file sizes rather than disk usage (acts as du -sb dir), disk - gets disk usage (acts as du -s -B1 dir). Unlike du command, vfs.dir.size item takes hidden files in account when calculating directory size (acts as du -sb .[^.]* * within dir). max_depth - maximum depth of subdirectories to traverse. -1 (default) - unlimited, 0 - no descending into subdirectories. regex_excl_dir - regular expression describing the name pattern of the directory to exclude. All content of the directory will be excluded (in contrast to regex_excl)	Only directories with at least read permission for zabbix user are calculated. On Windows any symlink is skipped and hard links are taken into account only once. With large directories or slow drives this item may time out due to the Timeout setting in agent and server/proxy configuration files. Increase the timeout values as necessary. Examples: ⇒ vfs.dir.size[/tmp,log] - calculates size of all files in /tmp which contain 'log' ⇒ vfs.dir.size[/tmp,log,^.+\.old$] - calculates size of all files in /tmp which contain 'log' in their names, excluding files with names ending with '.old' The file size limit depends on large file support. Supported since Zabbix 3.4.0.

[Fabrizio We BiNar]

Hi, thanks for the reply. I think that solution doesn't fit with my necessity, i need to monitor the single file that ends with "jpeg.zip" because every file is unic like the name and the size. Those file are created by a process, and everytime the process create the file in the folder "c:\test\dicom", i need to recive an alert if that file size is bigger than 260 MB. Could you suggest me some alternative solutions? Thanks a lot

[Semiadmin]

Zabbix server 5.0 works well with the agent 6.0, wich has the key vfs.dir.get.

[Fabrizio We BiNar]

sorry, I'm new to the zabbix world, could you give me some examples on how to use it?

the files all end in "_jpeg.zip" and are always saved in the same folder.

Thank you in advice

[cyber]

Use it to create a discovery of all "_jpeg.zip" files and then monitor all of them with vfs.file.size item (prototype).
But as said, you need to use v6 agent, which knows about that vfs.dir.get item.

[Semiadmin]

Even better: the key

vfs.dir.count["c:\test\dicom",".*_jpeg\.zip",,file,,0,620M]

will give you the number of such files

[Fabrizio We BiNar]

so, i created an item with this characteristics:

Name "count jpeg file"
Type: Zabbix Agent active)
Key: vfs.dir.count["C:\test\dicom,.*_jpeg\.zip",,file,,0,620M]
Type of information: Numeric (unsigned)
Units: B (byte)

then this trigger:

Name: "file bigger than 260MB"
Expression: {hostname:vfs.dir.count["C:\test\dicom,.*_jpeg\.zip",,file,,0,620M].last()} > 0

but i recive this message from the host, by the item: Invalid Type "0"
Zabbix server 5.0.17
Agent: 6.4.8

what am i missing?

[Semiadmin]

You've lost the quotes. And why do you need bytes as a unit of quantity? By the way, agent 6.4, unlike 6.0, is not fully compatible with server 5.0 with default settings

[Fabrizio We BiNar]

Ok, i upgraded the item key : vfs.dir.count["C:\test\dicom",".*_jpeg\.zip",,file,,0,620M]
and then removed the Type of information.
I also disinstalled and reinstalled zabbix agent, now is 6.0.23.

Right now the item and the trigger is active, but i still recive no alert even if there are some "_jpeg.zip" files that are bigger then 260MB.
This is the trigger i composed: {hostname:vfs.dir.count["C:\test\dicom",".*_jpeg\.zip",,file,,0,620M].last()} > 0.

Is it wrong? how can i make it to alert me if there is a file with size > 260mb?

thousand thanks, i'm sorry for making a lot of questions but i'm really new with it

[Semiadmin]

What do you mean by "i still receive no alert"?
Is the trigger in Problem state? What is the item last value?

[Fabrizio We BiNar]

the trigger isn't in "problem state" but it should, because where i installed the agent, the folder "c:\test\dicom" contains some "_jpeg.zip" file that are bigger than 260MB, but i don't recive any alert in the dashboard.
The item is enabled, the last value is "0"...

[Semiadmin]

what is the exact file name?

[Fabrizio We BiNar]

the file name changes everytime. Those are file ".zip" created by a process.
all of those file name, end with "_jpeg.zip"

[Semiadmin]

And those fies are in c:\test\dicom, not in subdirectories?