Logfile monitoring help

[tritsako]

Dear experts,
I am trying to monitor (with Zabbix 3.2) a log file and when I have the word “Exception Error 99” on a linux host, fire a trigger for problem. And When the problem is resolved and the word “Exception Error 99” is away, fire a trigger that the problem is resolved.

I have created the following item to get the word “Exception Error 99” as soon as it appears in the log file (Attached file):

And create the following trigger to create an alert:


My problem is that the trigger is fired all the time and the word “Exception Error 99” do not exist in the log file (Attached file):

What Am I doing wrong:

Thank you in advance.
Costas

[LenR]

This doesn't really sound like a log file if you actually remove the "Exception Error 99" from the file. Key vfs.file.regmatch should work perfectly, instead of the log key.

[tritsako]

Hi LenR,

Thank you for your reply. I will try it.

But actually the "Exception Error 99" is not delete / removed from the log file, but, it is not in the last 10 last line of the log. That's why I have defined 10 lines in my example.

[LenR]

In that case, it probably needs to remain a log key. I think you may be misinterpreting the number of lines processed, not finding that value in the 10 lines won't reset the trigger. Log triggers are problematic, if getting an alert when it happens is sufficient, nodata() can be used to reset the trigger if the message doesn't reoccur within the specified time value.

[tritsako]

I understand the flow you are saying, but how can I do this? Do I have to create two triggers for the same item having dependencies? Or two items for the same log file, using the same trigger?
Is the below correct :

{hostname:log[/home/mypath/log/messages.log,"Exception Error 99"].nodata(10m)}=0

Thank you!

Costas

[LenR]

Just "and" the log match (to alert) and the nodata (to clear) in the same trigger.

See https://www.zabbix.com/forum/showthread.php?t=23402

[tritsako]

Thank you very much LenR.

Its working fine now !

Costas

[tritsako]

Hi LenR,


I have a question on log file names that I cannot see zabbix documentation for this.

Does the log file name that I monitor must be with extension .log ?
Or it can be with no extension, for example . (no extension) ?

Is their any URL that for this?

Thank you very much.

Costas

[Atsushi]

Extension of the file is not needed.

In both of the file name, you can be monitored by specifying the key of the item.
ex.

log[/home/mypath/log/messages.log,"Exception Error 99"]
log[/home/mypath/log/messages,"Exception Error 99"]

There is no extension of the file is a sample of the manual.

https://www.zabbix.com/documentation/3.2/manual/config/items/itemtypes/log_items

[LenR]

File extensions are a weakness that has infiltrated Linux from weaker OS'es :-)

Also see the logrt item type. Some logs use a fixed file name while they are active, then are renamed to an archive with a date and sequence suffix. Some logs collect into the latest suffexed file. The logrt key handles the latter.