Log Monitoring help

[n3o]

Hello all,

I am monitoring a log file and whenever "no connection" appears it gets triggered and sends me an email but the issue is when it changes line in the file I get a recovery email and again when the word "no connection appears" I get an email and so on until the problem is fixed.

an example of the log file:

0 15:33:42.182 Datafeed: closed due close command
0 15:33:42.182 Datafeed: waiting for 0 sec
1 15:33:42.182 Datafeed: connecting to 'x.x.x.x'
1 15:33:50.544 Datafeed: no connection to 'x.x.x.x' [I get an email]
1 15:33:50.544 Datafeed: no connection to the server
0 15:33:50.544 Datafeed: waiting for 0 sec [I get recovery]
1 15:33:50.544 Datafeed: connecting to 'x.x.x.x'
1 15:33:50.544 Datafeed: closed due timeout
1 15:33:59.576 Datafeed: no connection to the server [I get an email]
0 15:33:59.576 Datafeed: waiting for 0 sec [I get a recovery]
1 15:33:59.576 Datafeed: connecting to 'x.x.x.x'



Is there a way to avoid sending a recovery email when changing line and to send ONE email only when seeing the "no connection" words ?



I have the below Key and Trigger:

Key:
logrt[Path\*.*,,,,skip,]

Trigger:
{Host:logrt[Path\*.*,,,,skip,].str(no connection )}=1

Type:Zabbix Agent (active)
Type Of Information: Character


Thanks

[n3o]

Someone suggested to use the below in my trigger:

{Host:logrt[Path\*.*,,,,skip,].count(1m,"no connection ",like)}>0

can someone explain what it does?

[andresf]

Delete the default recovery action for that action. I think it should work for that ( on recovery "do nothing"). I thinkg you have to create a specific action for that kind of "trigger action".

Tell us if it works.