logrt.count Usage example

[moshikoy]

Hi,
I'd like to catch "nfs: server * not responding, still trying" in /var/log/syslog using zabbix logrt.count function, only if it appeared more than 5 times in the past 10 minutes.

I tried 2 different items:
1. logrt[/var/log/syslog,"not responding, still trying",,,skip]
2. logrt.count[/var/log/syslog,"not responding, still trying",,,skip]

and their triggers:
1. {Log File monitor Template:logrt[/var/log/syslog,@log_filter_syslog,,,skip].count(1m,"not responding, still trying",like)}>2

2. {Log File monitor Template:logrt.count[/var/log/syslog,"not responding, still trying",,,skip].last()}>2

But none of these is working, getting "NOT SUPPORTED" from zabbix
checking the logs i saw "can't evaluate function" so this is an issue with my syntax

Can anyone provide a working example for catching lines that appear more than once by counting them in log files.

Thanks
- Moshe

[kaspars.mednis]

Hi !
first question- are you sure zabbix user can read syslog log files ? Zabbix agent usually is running from its own zabbix user.

cd /var/log
ls -la syslog

here is similar issue

https://www.zabbix.com/forum/showthread.php?p=205407

Regards
Kaspars

[moshikoy]

Yes.
Im already monitoring syslog.
Im just having issues counting

Btw
I changed /etc/rsyslog.conf default log file permissions from 0640 to 0644 so that zabbix can read it

-Mosh

[moshikoy]

Hi,
Can you someone provide a working example for the usage of log file monitoring count ability
This should also exist in "Zabbix Docs"

Cheers,
- Moshe

[JulioZ]

Hi moshikoy

If you still need it, please have a look at: https://www.zabbix.com/forum/zabbix-...353#post234353

Cheers
JulioZ