Regarding LOG Monitoring.

[0226]

Regarding LOG Monitoring. I want a trigger to be active only if a error occurred "5 times in a log file in last 2 minutes". this was done using below trigger.
"{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0"
but question is if trigger set to active state once it will never go back to ok state.
how can i set if this process did't repeat in next 3-4 minutes then set it to normal OK state.

[kasik]

manual close

Regarding LOG Monitoring. I want a trigger to be active only if a error occurred "5 times in a log file in last 2 minutes". this was done using below trigger.
"{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0"
but question is if trigger set to active state once it will never go back to ok state.
how can i set if this process did't repeat in next 3-4 minutes then set it to normal OK state.

i'm not so sure if this will solve your problem but what about using manual close? because when you know about it and solve it then u can close it manualy.

[Semiadmin]

{Zabbix server:log["/opt/test.log","error text"].count(120,"error text")}>4
Or, may be
{Zabbix server:log["/opt/test.log","error text"].count(120,"error text")}=5
if you need exactly 5 errors in 2 minutes

[0226]

Regarding log monitoring

i'm not so sure if this will solve your problem but what about using manual close? because when you know about it and solve it then u can close it manualy.

Could you please help regarding my query.

trigger to be active only if a error occurred "10 times in a log file in last 10 minutes".

below was working fine only for this condition.
{Zabbix server:log["/opt/test.log","error text"].count(120,5)}=0


if i use condition .count(600,10) it is not working. when 5-6 alerts appeared it set alert in active mode.

in short my query is --> a trigger to be fired active only if "error text" occurred 10 times in last 10 minutes. and after some time it must set it to OK state.

please help.

[Semiadmin]

0226, just try to read about "count" function

https://www.zabbix.com/documentation/3.4/manual/appendix/triggers/functions

and you'll uderstand all thing

[0226]

Regarding log monitoring

0226, just try to read about "count" function

https://www.zabbix.com/documentation/3.4/manual/appendix/triggers/functions

and you'll uderstand all thing

we are able to get alert according to our need. see below trigger.

{Zabbix server:log["/opt/test.log","ERROR",,300].count(5m,"ERROR")}>9

alert will be active (Problem State) if we will received "Error" more than 9 in last 5 minutes.but we are not able to take back this alert to the OK state. please help.

Note: lets assume alert got active. and now "Error" keyword is not appearing in log file, then it will not set it to OK State.

Any help would be appreciated.