Log-file Monitoring

[Enes]

Hello everyone, is there any way to track the archived log-file. I think that such a file has no difference from an ordinary text file. I actually only need that to make a test to see if the zabbix agent finds "Error" in the log-file, and then after that I would create a item with a real log-file and a trigger.

Thanks in advance

[kyus]

Hey!

Yes, there's an item to monitor log files, you'll need zabbix agent in the active mode. A basic syntax would be like:
log[path/to/file,Error]

Here's detailed information on how to do it:

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/log_items

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#log

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#logrt

[Enes]

Hey Kyus, thanks for your comment. I am actually interested in whether it is possible to monitor the "old" logfile which is no longer active, so that I can test how it all works before I create a trigger and an item to monitor the "real" logfile. I've only recently been using Zabbix, so I'm not familiar with all the possibilities.

[kyus]

If the old logfile isn't compressed I believe you can use it's path in the item configuration to monitor it. You can also create a file yourself if you want to learn how it works

[Enes]

I created the file myself on the test server to make the test (the same file as the original). This should be my key: log[F:\Archive\RS2_PROD\b2c-api.log,HasErrors]
But something doesn't work and the info says "Unsupported item key". I tried all the ways I found online to change the key or upgrade, but it still does the same thing.

[Brambo]

Enes If you monitor a folder with log file monitoring e.g. logrt with regex on file name. The first time the item becomes active it will scan the files which are in that folder and based on inodes remember which file is processed.
You can fool the agent by copying a duplicate file / file with different name in the same folder to trigger that log monitoring again. Editing an existing file will only proces the new lines at the end of the file.

[kyus]

Did you setup the item type as Zabbix agent active?
Also, have you defined the ServerActive parameter in the config file?


Log items only work in agent active mode, so make sure that's what you're using

[Enes]

Item is set to Zabbix agent (active). However, I have not defined anything in the config file. My current version of Zabbix is 7.0.9 so I thought everything was automatically set up already.

[kyus]

In the Zabbix agent config file, you need to set ServerActive to the IP of your Zabbix server. And make sure that zabbix has access premissions to the log file

[Enes]

thank you very much, I appreciate your help