Log Item

[sby]

Hi,

Can someone help me to understand how i can create a log item and trigger in Zabbix.

I try to understand everything what i try is not working.

[jusavard]

Can you define what tou mean by "log item" ?

If you mean to create a "standard" item and a trigger linked to it you might want to see zabbix keys first :

https://www.zabbix.com/documentation/2.0/manual/config/items/item/key

https://www.zabbix.com/documentation/2.0/manual/config/items/itemtypes/zabbix_agent

https://www.zabbix.com/documentation/3.0/manual/config/items/itemtypes/zabbix_agent

You can try zabbix key with zabbix_get. For instance :

[zabbix@zabbix-server ~]# zabbix_get -s hostname-target -k system.uptime
1819876
[zabbix@zabbix-server ~]# zabbix_get -s hostname-target-k system.cpu.load[,avg1]
0.000000
[zabbix@zabbix-server ~]# zabbix_get -s hostname-target-k system.cpu.load[,avg5]
0.000000

Trigger can be a little bit more tricky. I'd suggest you read this first :

https://www.zabbix.com/documentation/3.2/manual/config/triggers/expression

Trigger are a combinaison off zabbix keys and (regular/arithmetic) expression. You might want to see some that are included with you installation by going to "Configuration/Hosts/Triggers"

Hope it helps

[sby]

What i need is the follow.
I have one file on my server called global.log in the log will be write logs and failures.

I want to get a alert when the failure is in the log file.
And also i want that zabbix can read that log file.

And that is what i not understand how can i get that works.

[allexpetrov]

Hello, sby!

Am I correct that You are trying to parse the specific log file on your server and make zabbix to store only specific error ?

Zabbix can do it, you need to create an item, where the Type of Information is log and the item specific key is log[]. Then you need to specify where the log file is and which message you want to read.

Then based on this item you need to create the Trigger.

More about log file reading: https://www.zabbix.com/documentation...ypes/log_items

More about triggers:

https://www.zabbix.com/documentation/3.2/manual/config/triggers

Regards,
Alex

[sby]

Hello Alex,

Thank you i have try this and see then Not supported what is wrong??

[allexpetrov]

Is there any error when you hover that Not supported icon ?

Also check server/agent logs ( /var/log/zabbix/zabbix_<server\agentd>.log )

[sby]

I get the messages: Accessible only as active check.

The error log is empty:

-rw-r----- 1 zabbix zabbix 0 Aug 8 06:25 /var/log/zabbix/zabbix_agentd.log

[allexpetrov]

I get the messages: Accessible only as active check.

The error log is empty:

-rw-r----- 1 zabbix zabbix 0 Aug 8 06:25 /var/log/zabbix/zabbix_agentd.log

Please, check the ServerActive and the Hostname part of your agents config (/etc/zabbix/zabbix_agentd.conf)


Your hostname sting should be exactly the same as you've configured in Zabbix Front End ( Hostname , not the Visible name).

If your log file is emtpy - double check that your zabbix agent is running ( ps -aux | grep zabbix_agentd )

Regards,
Alex

[sby]

I have change the hostname and it is not works.



Zabbix agent is running.
root@data-a:/etc/zabbix# ps -aux | grep zabbix_agentd
root 4229 0.0 0.0 87188 1436 ? S 13:01 0:00 /usr/sbin/zabbix_agentd
root 4230 0.0 0.0 87188 1640 ? S 13:01 0:00 /usr/sbin/zabbix_agentd: collector [idle 1 sec]
root 4231 0.0 0.0 87188 1816 ? S 13:01 0:00 /usr/sbin/zabbix_agentd: listener #1 [waiting for connection]
root 4232 0.0 0.0 87188 1816 ? S 13:01 0:00 /usr/sbin/zabbix_agentd: listener #2 [waiting for connection]
root 4233 0.0 0.0 87188 1816 ? S 13:01 0:00 /usr/sbin/zabbix_agentd: listener #3 [waiting for connection]
root 4234 0.0 0.0 87188 2036 ? S 13:01 0:00 /usr/sbin/zabbix_agentd: active checks #1 [idle 1 sec]
root 4235 0.0 0.0 91476 2540 ? S 13:01 0:00 /usr/sbin/zabbix_agentd: active checks #2 [idle 1 sec]

[allexpetrov]

I have change the hostname and it is not works.

Restart the agent, wait for some time and then look again, please!

[sby]

After 15 minutes it is not working so is my key maybe wrong.
Or what is there wrong

[allexpetrov]

Who is monitoring the host - proxy or server ?

[sby]

Server i have no proxy setup.

Version Zabbix 3.2.7

[allexpetrov]

Can you please post the log of Zabbix Server, try to find the info about the specific host?

Use command (sudo) tail -f /var/log/zabbix/zabbix_server.log

Regards,
Alex

[sby]

What for info do you need i can give more info.

[root@localhost ~]# tail -f /var/log/zabbix/zabbix_server.log
25417:20170809:150838.576 housekeeper [deleted 206832 hist/trends, 0 items, 26 events, 58 problems, 0 sessions, 0 alarms, 0 audit items in 33.143249 sec, idle for 1 hour(s)]
25300:20170809:151018.917 SNMP agent item "hrProcessorLoad[1]" on host "svr550.x" failed: first network error, wait for 15 seconds
25304:20170809:151033.553 resuming SNMP agent checks on host "svr550.x": connection restored
25298:20170809:151118.710 SNMP agent item "hrProcessorLoad[1]" on host "svr550.x" failed: first network error, wait for 15 seconds
25304:20170809:151133.561 resuming SNMP agent checks on host "svr550.x": connection restored
25298:20170809:151318.145 SNMP agent item "hrProcessorLoad[1]" on host "svr550.x" failed: first network error, wait for 15 seconds
25304:20170809:151340.540 resuming SNMP agent checks on host "svr550.x": connection restored
25419:20170809:151617.104 slow query: 3.784229 sec, "update httptest set nextcheck=1502284573+delay where httptestid=21"
25475:20170809:151617.104 slow query: 3.853435 sec, "commit;"
25478:20170809:151618.825 slow query: 3.605651 sec, "commit;"