Ad Widget

Collapse

Logfile Monitoring find text in last row

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • WrongError
    Junior Member
    • Jan 2025
    • 2

    #1

    Logfile Monitoring find text in last row

    Hello everybody,

    I want to monitor a logfile. It should search after the word "ERROR" in the very last row. Also it should ONLY monitor new entries all old entries should be ignored. I set up an item with Zabbix Agent (Active) with this exact key: log[C:\xxx\wildfly\standalone\log\server.log,ERROR,,,s kip]. Type of information is of course "log".

    In the Trigger section i tried a few things like:

    change(/xxx/log[C:\xxx\wildfly\standalone\log\server.log,ERROR,,,s kip])<>0

    also

    last(/xxx/log[C:\xxx\wildfly\standalone\log\server.log,ERROR,,,s kip])<>0

    also

    find(/xxx/log[C:\xxx\wildfly\standalone\log\server.log,ERROR,,,s kip],,"like","ERROR")=1

    it works almost...everytime when he printed the very last value of the last row with the word ERROR in it he goes into a loop and starts all over again with the very first founded line with the word ERROR in it. As if the skip mode is in ignored state. What am i doing wrong ?
  • cyber
    Senior Member
    Zabbix Certified SpecialistZabbix Certified Professional
    • Dec 2006
    • 4807

    #2
    Its not the trigger config issue, its the item, that in some reason re-reads the file... (look for latest data, you will probably see repeats there)...
    "skip" works only at very first installing of the template, so the item would not read whole log but starts from the current position of logfile.
    If that log is rotated or overwritten, you should use logrt instead. There are several cases (described in docs), when reading of the log is started from the beginning again. Maybe some of those apply to your case?

    Comment

    Working...