zabbix log file monitor trigger value

[moshikoy]

Hi,
I'm using zabbix 3.4.1 and i have created some Log file item and trigger.
Now i'd like to create an action to send an email with the details,
My question is, How can I have the line that triggered the event in the email i'm sending due to this trigger

for Example:
Item:
log[/var/log/syslog,@Filter logs,,,skip]

Trigger
{HOST.NAME} - log watcher found an issue
{hostname.example.com:log[/var/log/syslog,@Filter logs,,,skip].iregexp(@Filter logs)}=1

How do I get the line that triggered the event in the email notification?

-Mosh

[kaspars.mednis]

Hello Mosh !

have you tried {ITEM.LASTVALUE} macro ?

https://www.zabbix.com/documentation/3.4/manual/appendix/macros/supported_by_location

best regards,
Kaspars

[moshikoy]

Thanks, that was exactly what i needed!
Now i'd like to mention the log it was found in the email as well

how do i extract only the log file path from the below item/trigger:
log[/var/log/syslog,@Filter logs,,,skip]
{hostname.example.com:log[/var/log/syslog,@Filter logs,,,skip].iregexp(@Filter logs)}=1

Tried item.key, but it returned the whole line.
where i want only /var/log/syslog in this example

-Moshe

[kaspars.mednis]

One fast workaround - add needed information to item description

Action operations support this macro {ITEM.DESCRIPTION}

echo {ITEM.LASTVALUE} {ITEM.DESCRIPTION}>> /tmp/zabbix.log will write to log file last value and description field contents, i used it for testing purposes

but this is not very "clean" solution
you can try other supported macros

regards,
Kaspars

[moshikoy]

Hi,
Thanks it seems that this will do the trick.

Can you explain how did you check the MACRO's values, so i can do it myself?

- Moshe