LLD external script JSON format for 1 item to multiple triggers

[jsolarin]

Hello,

I'm having some trouble designing a LLD script that will create a 1 item to multiple trigger relationship.

I'd like to discover a logfile for example, and apply multiple regular expressions against that item prototype via the JSON returned data.

Here is the output of the script so far...

{
	"data": [{
		"{#LOGFILE}": "/var/log/maillog",
		"{#REGEX}": "delivery temporarily suspended",
		"{#DESCRIPTION}": "Logfile : Mail : Delivery Suspended"
	}, {
		"{#LOGFILE}": "/var/log/maillog",
		"{#REGEX}": "chicha|gb31337|dvsowned",
		"{#DESCRIPTION}": "Logfile : Security : ramen/adore Worm Has Compromised System!"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "ftpd.*time out",
		"{#DESCRIPTION}": "Logfile : APP : FTP Timeout"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "logrotate: ALERT exited abnormally",
		"{#DESCRIPTION}": "Logfile : APP : Logrotate Exited Abnormally"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "rcron daemon failed over",
		"{#DESCRIPTION}": "Logfile : APP : rcron daemon Failed Over"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "corrupt label",
		"{#DESCRIPTION}": "Logfile : Disk : Error"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "[Dd]isk.*[Ee]rror",
		"{#DESCRIPTION}": "Logfile : Disk : Error Occurred"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "Failed to create a safe temporary directory",
		"{#DESCRIPTION}": "Logfile : Disk : Failed temp directory"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "([Ff]ile system full|No space left on device)",
		"{#DESCRIPTION}": "Logfile : Disk : Filesystem Full - Diskspace Error"
	}]
}

When this runs, it gives an error after the first item and trigger is created that a duplicate item already exists.

If I add an alias to each item, the log data is duplicated and would kill the connections between the server and the agent.

Is there a way to make a trigger prototype fire and ignore the duplicate error message, or maybe a way to create a second discovery agent to separate the log file discovery and the regular expression discovery by passing the item prototype to the discovery script?

Thank you for the help

[jsolarin]

I forgot to mention I'm on Zabbix 3.2.6 running on RHEL 6.8

I also tried to separate the logfile Item creation to a separate data element but I have no way of tying the Trigger Prototype regex back to the Item Prototype.

{
	"data": [{
                "{#LOGFILEPATH}": "/var/log/maillog"
	}, {
                "{#LOGFILEPATH}": "/var/log/messages"
	}, {
		"{#LOGFILE}": "/var/log/maillog",
		"{#REGEX}": "delivery temporarily suspended",
		"{#DESCRIPTION}": "Logfile : Mail : Delivery Suspended"
	}, {
		"{#LOGFILE}": "/var/log/maillog",
		"{#REGEX}": "chicha|gb31337|dvsowned",
		"{#DESCRIPTION}": "Logfile : Security : ramen/adore Worm Has Compromised System!"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "ftpd.*time out",
		"{#DESCRIPTION}": "Logfile : APP : FTP Timeout"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "logrotate: ALERT exited abnormally",
		"{#DESCRIPTION}": "Logfile : APP : Logrotate Exited Abnormally"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "rcron daemon failed over",
		"{#DESCRIPTION}": "Logfile : APP : rcron daemon Failed Over"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "corrupt label",
		"{#DESCRIPTION}": "Logfile : Disk : Error"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "[Dd]isk.*[Ee]rror",
		"{#DESCRIPTION}": "Logfile : Disk : Error Occurred"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "Failed to create a safe temporary directory",
		"{#DESCRIPTION}": "Logfile : Disk : Failed temp directory"
	}, {
		"{#LOGFILE}": "/var/log/messages",
		"{#REGEX}": "([Ff]ile system full|No space left on device)",
		"{#DESCRIPTION}": "Logfile : Disk : Filesystem Full - Diskspace Error"
	}]
}