Log file item "not supported"

[ben.bressler]

I have a linux log file monitored with the following item:

log["/opt/log/error.log","CRITICAL event=",,1000]

No matter what I do it shows up in the zabbix front end as "not supported".

I enabled detailed monitoring on the agent and I see this in the agent's log file:

1160:20130217:015110.597 Sleeping for 1 second(s)
1155:20130217:015111.567 In update_cpustats()
1155:20130217:015111.567 End of update_cpustats()
1160:20130217:015111.597 In send_buffer() host:'10.72.126.220' port:10051 values:0/100
1160:20130217:015111.597 End of send_buffer():SUCCEED
1160:20130217:015111.597 In process_active_checks('10.72.126.220',10051)
1160:20130217:015111.597 In process_log() filename:'/opt/log/error.log' lastlogsize:12437
1160:20130217:015111.597 In process_log() filename:'/opt/log/error.log' lastlogsize:12547
1160:20130217:015111.597 In process_log() filename:'/opt/log/error.log' lastlogsize:12437
1160:20130217:015111.597 In process_log() filename:'/opt/log/error.log' lastlogsize:12547
1160:20130217:015111.597 In process_log() filename:'/opt/log/error.log' lastlogsize:12437
1160:20130217:015111.597 In process_log() filename:'/opt/log/error.log' lastlogsize:12547
1160:20130217:015111.597 End of process_active_checks()
1160:20130217:015111.598 In get_min_nextcheck()

To me it looks like it is successfully reading the log file but for some reason the zabbix server doesn't seem to think it is. Anyone have any ideas as to why this might be?

All other items on this server are being correctly reported to the server so I know it can talk to the server. I have other servers set up with identical items and log files and they all work fine but for some reason this one is having issues.

Thanks for any help you can provide!

[tim.mooney]

I have a linux log file monitored with the following item:

log["/opt/log/error.log","CRITICAL event=",,1000]

No matter what I do it shows up in the zabbix front end as "not supported".

You've already tested a lot of the obvious things I was going to suggest. I've only run into "not supported" a few times so far, and its generally been because I haven't set the item data type correctly (generally integer vs. decimal) or because I had the wrong custom key name.

If this exact item works on other servers, then it's something specific to this server. The first thing I would look into is SELinux or whatever mandatory access control software might be active on the server in question.

The other thing I would do is use "zabbix_get" from the monitoring server to debug. Start by using it on one of the other servers where log event processing is working, and then just switch the hostname to be the problem server. If that doesn't turn up why the problem is happening, I would use "strace" (assuming Linux) on the client system while you run the zabbix_get from the server, and see if that turns up what's going on.

Let us know what it turns out to be. Might be helpful for others in the future.