Problem with log monitoring using logrt

[allexpetrov]

Hey, so i came to same problem and I'm wondering if there is any chance of using auto discover? because i have like 20 different logs in one folder and make it manualy would be ***** so can you guys help ?

I think this is what you are looking for -> ZBXNEXT-1699

Regards,
Alex!

[n3o]

Hello all,

I need your help as well with logrt.

So I have updated my zabbix agents on 2 of my servers to v3.4 and now my logrt is not working on them. On the rest servers which I have v3.2 its working fine.

see below screenshots of my Item and Trigger... Please note that the log files I am monitoring have this format: 20170911.log and every day it changes to the next day 20170912.log ...20170913.log etc etc.

The error I get is:

3752:20170911:093116.157 active check "logrt[C:\Program Files (x86)\MetaTrader Data Center Demo1\logs\*.*,,,,skip,]" is not supported: Cannot compile a regular expression describing filename pattern: ? * + invalid at offset 0

If there is a different way on which I can monitor these kind of files (20170912.log ...20170913.log etc etc.) I will appreciate it if you share it with me.

[Atsushi]

Hi n3o,

In Zabbix 3.4, the processing of regular expressions has been changed.
However, I think the regular expression that was originally set up is not appropriate.

In regular expressions, "*" means to repeat the character specified before.
"." Indicates an arbitrary character. It does not indicate "."(period) Itself.
The previous settings just happened to match the filenames you wanted to monitor.

Please correct the file name of the argument of logrt[] to a more correct regular expression.

ex.

logrt[C:\Program Files (x86)\MetaTrader Data Center Demo1\logs\[0-9].*.*,,,,skip,]
logrt[C:\Program Files (x86)\MetaTrader Data Center Demo1\logs\[0-9].*.log,,,,skip,]

Adjust the setting according to the file name of the output log.

Manual:

https://www.zabbix.com/documentation/3.4/manual/installation/upgrade_notes_340#pcre_library_for_regular_expressions

[n3o]

Hi n3o,

In Zabbix 3.4, the processing of regular expressions has been changed.
However, I think the regular expression that was originally set up is not appropriate.

In regular expressions, "*" means to repeat the character specified before.
"." Indicates an arbitrary character. It does not indicate "."(period) Itself.
The previous settings just happened to match the filenames you wanted to monitor.

Please correct the file name of the argument of logrt[] to a more correct regular expression.

ex.

logrt[C:\Program Files (x86)\MetaTrader Data Center Demo1\logs\[0-9].*.*,,,,skip,]
logrt[C:\Program Files (x86)\MetaTrader Data Center Demo1\logs\[0-9].*.log,,,,skip,]

Adjust the setting according to the file name of the output log.

Manual:
https://www.zabbix.com/documentation...ar_expressions

Hello mate and thanks for the info it was very helpful!

My log file name are like this: 20170912.log

You gave me 2 examples above which one do you believe it will be more appropriate for my log?

Thanks again

[0226]

i have a question related to log monitoring. apologize if posting in wrong window

It is not possible to monitor log files of different types and contents simultaneously with one item.
It will not be possible even in 3.4.
It is not listed in the new function list.

https://www.zabbix.com/documentation/3.4/manual/introduction/whatsnew340

In order to prevent rereading of the file, Zabbix manages how far it reads in the file, but that information can only have one data with one item.
Zabbix agent lists candidates to read updated files at the file update date, but if it becomes a different file from what was previously loaded, in the worst case, it reads from the beginning of the log file.

=====================================
Regarding LOG Monitoring. I want a trigger to be active only if a error occurred "5 times in a log file in last 2 minutes". this was done using below trigger.
"{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0"
but question is if trigger set to active state once it will never go back to ok state.
how can i set if this process did't repeat in next 3-4 minutes then set it to normal state.

[vigneshn]

i have a question related to log monitoring. apologize if posting in wrong window



=====================================
Regarding LOG Monitoring. I want a trigger to be active only if a error occurred "5 times in a log file in last 2 minutes". this was done using below trigger.
"{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0"
but question is if trigger set to active state once it will never go back to ok state.
how can i set if this process did't repeat in next 3-4 minutes then set it to normal state.

I had a similar requirement and achieved it with "nodata(3m)}=0". In your case, it will be:

{Zabbix server:log["/opt/test.log","error text"].count(120,5)}>0 and {Zabbix server:log["/opt/test.log","error text"].nodata(3m)}=0