Key word filtering on Log files question

[cstackpole]

Hello,
I have a question on how log files are filtered.
I have a large log file. Large as in averaging 80-90 new lines every second. Way above what Zabbix sends (I believe it is capped at 10 lines/sec by the agent). If I want to capture the line whenever ERROR appears I know that I can use:
log[/path/to/my/file.log,ERROR]

However, I am not certain on how Zabbix will handle this. Is the keyword filtered on the Agent side sending only the line with ERROR or will the agent send the entire log file and the server pulls out ERROR? If it is on the agent side is it capable of sifting through 80 new lines every second or is it capped to 10 lines as well?

I believe I remember someone telling me once that it was filtered on the agent side but I can't remember where I heard/read/was told that and have not been able to confirm it. If someone could do so, I would be grateful.

Thanks,
cstackpole

[Alexei]

Yes, the filtering is performed on agent side.

[cstackpole]

Thanks Alexi!

[cstackpole]

I believe I also found the answer to the other question I had. The manual states:

ZABBIX Agent won’t send more than 10 lines of a log file per second. The limit
prevents overloading of network and CPU resources.

From what I can tell it looks like the agent only reads 10 lines. I have a log file that has several hundred lines in it and I am trying to pull in just a single line based on an expression( log[/path/to/my/file.log,ERROR] ). On the command line if I run: grep ERROR /path/to/my/file.log
it takes 6 seconds to output 12 lines. The log file is set to update every second and it takes about 5 minutes for them to appear on the history with the Agent.