logs with the same timestamp does not generate multiple alerts

[melvincv]

Hi,

We are running Zabbix server 4.0.6. We have configured it to look for the word DEVICE_CONFIG_MISMATCH in the log /data/docker-hub/core/TerminalConfigSync/log/terminal_config_sync.log as follows:

item - log["/data/docker-hub/core/TerminalConfigSync/log/terminal_config_sync.log","DEVICE_CONFIG_MISMATCH" ,"UTF-8",100]
trigger - {server-core1:log["/data/docker-hub/core/TerminalConfigSync/log/terminal_config_sync.log","DEVICE_CONFIG_MISMATCH" ,"UTF-8",100].nodata(30)}=0

The issue: there are multiple entries with the same timestamp, but alert is generated for only one entry, like so:
There are 3 entries in the log:

2019-06-12 10:02:58.126 INFO    DEVICE_CONFIG_MISMATCH D:1098 T:80EACA0007B6 WIFI_USER:user=>aterm-df6043 WIFI_PWD:password=>xxxxxxx
2019-06-12 10:02:58.126 INFO    Config api: Forward config updated for 80EACA0007A7
2019-06-12 10:02:58.126 INFO    DEVICE_CONFIG_MISMATCH D:1098 T:80EACA0007A7 WIFI_USER:user=>aterm-df6043 WIFI_PWD:password=>xxxxxxx
2019-06-12 10:02:58.126 INFO    Config api: Forward config updated for 80EACA0007A8
2019-06-12 10:02:58.126 INFO    DEVICE_CONFIG_MISMATCH D:1098 T:80EACA0007A8 WIFI_USER:user=>aterm-df6043 WIFI_PWD:password=>xxxxxxx

The alert is generated only for this:

2019-06-12 10:02:58.126 INFO    DEVICE_CONFIG_MISMATCH D:1098 T:80EACA0007A8 WIFI_USER:user=>aterm-df6043 WIFI_PWD:password=>xxxxxxx

We need alerts for all 3 entries. It is feasible in Zabbix? How?
Please let me know if you need more info.

[melvincv]

Any solution? Is it a limitation of Zabbix?

[Atsushi]

Try selecting "Multiple" in "PROBLEM event generation mode" in the trigger settings.
When "Single" is selected, no trigger event occurs when the trigger status is problem.