can't monitor log file

[seif]

hi there , i've been struggling with monitor log files with zabbix 3.4 installed on centos 7

simply i'm trying to monitor more than log file located on windows machine i want to be alerted whenever a string shows up such as the below

String 1 : Provider Error : Service not allowed - however the whole line looks like this Message=[Bee] Provider Error : Service not allowed , i couldn't update the item with the whole msg as i can't update the item with "[]"

anyway my item looks exactly like this

log[C:\logs\BeeTopup.log,Message=Bee Provider Error : Service not allowed,100]

and my trigger looks like this

{MOMKN-APP:log[C:\logs\BeeTopup.log,Message=Bee Provider Error : Service not allowed,100].str(Provider Error : Service not allowed)}=1

and i'm pretty sure the string shows up on my log file however i'm not alerted whenever it happens

another question can i assign more than one trigger "more than 1 string " for the same item ? and how would it look like then ?

Appreciate your support alot

[seif]

can anyone help ?!

[dimir]

Quote the parameters inside the item to look like this:

log["C:\logs\BeeTopup.log","Message=[Bee] Provider Error : Service not allowed",100]

[seif]

Quote the parameters inside the item to look like this:

done , and leave the trigger untouched ?

[dimir]

See if you are getting the values in "Latest data". Then, see if you get the trigger changing state in "Problems".
By the way, that "100" in the item looks incorrect, remove it:

log["C:\logs\BeeTopup.log","Message=[Bee] Provider Error : Service not allowed"]

and then the trigger could be just matching "Error":

{MOMKN-APP:log["C:\logs\BeeTopup.log","Message=[Bee] Provider Error : Service not allowed"].str(Error)}=1

[seif]

See if you are getting the values in "Latest data". Then, see if you get the trigger changing state in "Problems".

appreciate your support alot . and no i'm getting nothing at dashboard or latest data

[seif]

See if you are getting the values in "Latest data". Then, see if you get the trigger changing state in "Problems".
By the way, that "100" in the item looks incorrect, remove it:

and then the trigger could be just matching "Error":

updated , yet no problems found , any advice ?!

[dimir]

Please attach the following screenshots:
- latest data
- item configuration
- trigger configuration

[seif]

[dimir]

1). You still have "100" as third parameter in item, remove it. 3rd parameter is encoding: log[/path/to/file/file_name,<regexp>,<encoding>,<maxlines>,<mode>,<o utput>,<maxdelay>], https://www.zabbix.com/documentation...ypes/log_items
2). I still don't see latest values of the item "Topup stopped by Bee".

[seif]

1). You still have "100" as third parameter in item, remove it. 3rd parameter is encoding: log[/path/to/file/file_name,<regexp>,<encoding>,<maxlines>,<mode>,<o utput>,<maxdelay>], https://www.zabbix.com/documentation...ypes/log_items
2). I still don't see latest values of the item "Topup stopped by Bee".

removed the third parameter in item , now item looks like below

log["C:\logs\BeeTopup.log","Message=[Bee] Provider Error : Service not allowed"]

i can't find latest value for the item topup stopped by bee , i checked latest data and filtered the item , screen shot attached

[dimir]

That means you probably haven't hit that string after the latest changes. You can simplify the item e. g. log["C:\logs\BeeTopup.log"] to see if it gets the results at all.

[seif]

That means you probably haven't hit that string after the latest changes. You can simplify the item e. g. log["C:\logs\BeeTopup.log"] to see if it gets the results at all.

then i should update the trigger to look like below ?

{MOMKN-APP:log["C:\logs\BeeTopup.log"].str(Provider Error : Service not allowed
)}=1

instead of

{MOMKN-APP:log["C:\logs\BeeTopup.log"].str(Error)}=1

or to look like

{MOMKN-APP:log["C:\logs\BeeTopup.log"].str(Message=[Bee] Provider Error : Service not allowed)}=1 ?

[dimir]

For a start leave trigger as is. First - make sure you are receiving values on the server side.

[seif]

For a start leave trigger as is. First - make sure you are receiving values on the server side.

sorry if this is stupid , but do u mean i should check if zabbix agent send data to zabbix server from logs ? if yes where can i find those logs ?