Zabbix 2.0 Log Monitoring - Duplicate alerts.

[arunssasidhar]

Hi,

I am configured Zabbix to monitor my Jboss Server logs for Erros and exclude some know errors. This setup is working with one issue. Zabbix will send me alerts when there is a new "ERROR" entry in the log file. But sometimes I get multiple alerts for the same event. For example, I got 5 alerts with the same time stamp "2012-06-25 07:55:56,864 ERROR". The duplicate alerts count is not constant, sometimes I get 2 sometimes 5 or 11.

I checked the Monitoring > Latest data in the GUI, and found that there is no duplicate entries.

I have given my configuration of the log monitoring below. I am using latest version of zabbix server(2.0)

Item configuration:
- Description: Server Error Monitoring.
- Key: log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip]
- Type: Zabbix Agent (Active)
- Type of information: Log
- Interval :30

Trigger configuration:
- Descriptopn: Found Error in Server Log.
- Expression: (({SERVER Error Monitoring - PS:log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip].regexp("can not execute")})=0) & (({SERVER Error Monitoring - PS:log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip].regexp("Unexpected redirect")})=0)
- Event generation: Normal + Multiple TRUE events

Action configuration:
- Name: alert mail
- Event source: Trigger
- Enable escalations: Uncheck
- Default subject/message: Default
- Recovery message: Uncheck
- Action conditions: Trigger value = PROBLEM
- Action operations: Send message to User "Admin"

Please help me fixing this issue,

Thanks,
Arun S

[arunssasidhar]

The issue is fixed.

Hi all,

I have fixed this issue.

The reason for this issue was, I was using {ITEM.LASTVALUE} in my action, which caused this problem. I have changed this to {ITEM.VALUE}. Which fixed the issue.

{ITEM.VALUE} is faster than {ITEM.LASTVALUE}

If you want to know more about this fix, please see the detailed explanation in zabbix bug tracker.

https://support.zabbix.com/browse/ZBX-5239?focusedCommentId=61339&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-61339

Thanks,
Arun Sasidharan

[learner]

Duplicate Alerts in monitoring log file

I have configured to monitor a log file and sending an alert on finding a string. And i have multiple triggers for the same item. the log is very much frequent, Zabbix sometimes failing to send the alerts, and sometimes we are getting duplicate alerts which is making the monitoring team confusing to take any action on that event .

The issue is related to the below jira:

https://support.zabbix.com/browse/ZBX-5239

Please provide some guidelines to resolve the issue.

Thank you,