Issue with monitoring log files

[Lbn]

Hello,

I'm encountering issues with the monitoring of log files.

Zabbix Server
Version: 1.8.1

Type: Zabbix agent (active)
Key: log[/tmp/cacti.log,ERROR]
Type of information: Log

Zabbix Client
Version: 1.8.1

For this configuration:
In /etc/zabbix/zabbix_agentd.conf:
UserParameter=log[*],more /tmp/cacti.log|grep ERROR

I have this in zabbix_agentd.log:

9141:20100216:151119.217 Sending back [1419513856]
9144:20100216:151119.228 Got [{
"response":"success",
"data":[
{
"key":"log[\/tmp\/cacti.log,ERROR]",
"delay":"60",
"lastlogsize":"0",
"mtime":"0"}]}]
9144:20100216:151119.228 In parse_list_of_checks()
9144:20100216:151119.228 In disable_all_metrics()
9144:20100216:151119.228 In add_check('log[/tmp/cacti.log,ERROR]', 60, 0, 0)

=> But nothing is catched by Zabbix Server.

For this configuration:
In /etc/zabbix/zabbix_agentd.conf:
UserParameter=log[*],$1 $2

I have this in zabbix_agentd.log:

10979:20100216:151600.939 In send_buffer('172.30.10.219','10051')
10979:20100216:151600.939 Values in the buffer 54 Max 100
10979:20100216:151600.939 Will not send now. Now 1266329760 lastsent 1266329757 < 5
10979:20100216:151600.939 Sleeping for 1 seconds
10979:20100216:151601.947 In send_buffer('172.30.10.219','10051')
10979:20100216:151601.947 Values in the buffer 54 Max 100
10979:20100216:151601.947 Will not send now. Now 1266329761 lastsent 1266329757 < 5
10979:20100216:151601.947 Sleeping for 1 seconds
10979:20100216:151602.955 In send_buffer('172.30.10.219','10051')
10979:20100216:151602.955 Values in the buffer 54 Max 100
10979:20100216:151602.956 JSON before sending [{
"request":"agent data",
"data":[
{
"host":"cacti-dev",
"key":"log[\/tmp\/cacti.log,ERROR]",
"value":"02\/12\/2010 03:11:24 PM - SPINE: Poller[0] Host[37] ERROR: The POPEN timed out",
"lastlogsize":243050,
"clock":1266329757},
{
"host":"cacti-dev",
"key":"log[\/tmp\/cacti.log,ERROR]",
"value":"02\/12\/2010 03:11:25 PM - SPINE: Poller[0] Host[39] ERROR: The POPEN timed out",
"lastlogsize":243128,
"clock":1266329757},

...... (Cut) ......

{
"host":"cacti-dev",
"key":"log[\/tmp\/cacti.log,ERROR]",
"value":"02\/12\/2010 03:34:07 PM - SPINE: Poller[0] Host[37] ERROR: The POPEN timed out",
"lastlogsize":249356,
"clock":1266329757}],
"clock":1266329762}]
10979:20100216:151602.960 JSON back [{
"response":"success",
"info":"Processed 0 Failed 54 Total 54 Seconds spent 0.001090"}]
10979:20100216:151602.960 In check_response({
"response":"success",
"info":"Processed 0 Failed 54 Total 54 Seconds spent 0.001090"})
10979:20100216:151602.960 Info from server: Processed 0 Failed 54 Total 54 Seconds spent 0.001090
10979:20100216:151602.960 OK
10979:20100216:151602.960 Sleeping for 1 seconds
10977:20100216:151603.073 Processing request.
10977:20100216:151603.074 Requested [vfs.fs.size[/tmp,used]]
10977:20100216:151603.074 Sending back [2983522304]
10979:20100216:151603.967 In send_buffer('172.30.10.219','10051')
10979:20100216:151603.967 Values in the buffer 0 Max 100
10979:20100216:151603.967 Will not send now. Now 1266329763 lastsent 1266329762 < 5
10979:20100216:151603.967 Sleeping for 1 seconds

=> Here the log is parsed, all the "value" are ok, but they aren't send to the Zabbix server.

Can you help me?

Thanks,

Kind regards,

Lbn

[Lbn]

Problem resolved!

Thanks to Richlv on IRC channel who have found the problem!

Here the solution:

- UserParameter is useless for parsing log, I have suppress it.
- The parameter "Hostname" in zabbix_agentd.conf is Case Sensitive.
It must match with the hostname recorded in Zabbix Interface.