Netscreen syslog problem

[bleedingpegasus]

Hello all,
I just installed this Zabbix, and already monitoring localhost with very little effort. But then I need to monitor netscreen syslog, which gives me problem.

/etc/zabbix/zabbix_agentd.conf
Hostname=localhost
#DisableActive=1
#EnableRemoteCommands=1
ListenPort=10050

Then in Menu->Configuration->Items:
Description: Netscreen Syslog
Type: ZABBIX agent(active)
Key: log[/var/log/netscreen.log]
Type of Information: log
Update Interval: 3
Keep in History: 90
Keep trends: 365
Status: Monitored
Log time format: <empty>
Applications: <none>

- What should i expect to see?
- In Monitoring->Latest Data, Last Check, Last value, and Change is empty (-) --> what went wrong?
- In field log time format, should i enter something? if yes. what? can't find about it anywhere. (there are >2 other users asked this question without answer in this forum)

Thanks in advance.

[Alexei]

Please check http://www.zabbix.com/manual/v1.1/tu...s_logfiles.php

[bleedingpegasus]

More interesting

Yes... i got it working now.
But all i can see if very raw data.

Is it possible to let zabbix parse the log entry?
One of the entry is looking like this:

Not classified Sep 11 15:56:22 10.0.x.x ns50: NetScreen device_id=xxXX [No Name]system-notification-00257(traffic): start_time="2006-xx-xx xx:xx:xx" duration=3 policy_id=x service=http proto=x src zone=Trust dst zone=Untrust action=Permit sent=7097 rcvd=1466 src=10.0.x.x dst=x.y.z.w src_port=xxxx dst_port=80 src-xlated ip=a.b.c.d port=12110 session_id=63575

So, how do i parse the information, so zabbix can display graph, let say, per ip, or per hour statistic?

Anybody has similar experience

[bleedingpegasus]

I believe this kind of parsing (if there's no plug-ins at all) has to be done manually. I won't mind at all to do some perl/php scripting.
So, if anybody can tell me which file(s) do i have to start? and which tables should i mess up, or any clue at all, these would make my life easier.

nb. the info from netscreen must be in syslog format, not snmp.