Trigger with string

[NotaGain]

Hi everyone,

I have a hopefully a small issue. I have created a item to read the log file from robocopy and extract the error code
"vfs.file.regexp[/pathtolog/TEMP.log,(\bFEHLER 2\b|\bFEHLER 3\b|\bFEHLER 5\b|\bFEHLER 32\b|\bFEHLER 53\b|\bFEHLER 64\b|\bFEHLER 112\b|\bFEHLER 121\b),,,].
which returns the string
"2021/06/02 14:26:05 FEHLER 2 (0x00000002) Zugriff auf Quellverzeichnis C:\tmp" which is fine.

Then I created a trigger with the expression
{Zabbix server:vfs.file.regexp[/pathtolog/TEMP.log,(\bFEHLER 2\b|\bFEHLER 3\b|\bFEHLER 5\b|\bFEHLER 32\b|\bFEHLER 53\b|\bFEHLER 64\b|\bFEHLER 112\b|\bFEHLER 121\b),,,].str()}=1
which is working as well buuuuuuttt as soon as the created item returns "<empty string>" the trigger is still running.

So I created a recovery expression
{Zabbix server:vfs.file.regexp[/pathtolog/TEMP.log,(\bFEHLER 2\b|\bFEHLER 3\b|\bFEHLER 5\b|\bFEHLER 32\b|\bFEHLER 53\b|\bFEHLER 64\b|\bFEHLER 112\b|\bFEHLER 121\b),,,].str()}=0 but
nothing changed .

I have tried it with "strlen" the same issue.

Can some one help me to solve the issue? or has a hint what is going wrong with the recovery expression or does it even work with a string?

Thnak you very much.

Regards
NotaGain


We are using Zabbix 5.0.7

[Hamardaban]

str(FEHLER)=1
or
count(30,"FEHLER",regexp)>0

[Markku]

Hi, note that vfs.file.regexp will search the whole file for the regular expression, so a match will stay true as long as the string is found in the file.

Look at log file monitoring items (log*) instead to create an item that looks at one line at a time.

Markku

[NotaGain]

Thank you both of you I will have a look at it and will respond as soon as I have a result.

[NotaGain]

Hi Markku,

I have had a look at the log monitoring and created a item with the log option.
log[/pathtofile/TEMP.log,^(\bFEHLER 2\b|\bFEHLER 3\b|\bFEHLER 5\b|\bFEHLER 32\b|\bFEHLER 53\b|\bFEHLER 64\b|\bFEHLER 112\b|\bFEHLER 121\b)$,,,,,,] Is there a way to check what the active agent returns? Unfortunaltely the Test option is greyed out.
Sorry for my stupid question I was working till now only with the passiv agent.

NotaGain

[Markku]

Provided that your syntax and configuration is fine, you should now see the matching lines in the Latest data for that host as soon as the matching lines arrive to the log file.

If you have problem with that, then create a simpler log file item at first (/tmp/testfile, and so on), and echo some simple data there to get a hold of how the log file item works. Then you can proceed with more advanced matches and scenarios.

Markku

[NotaGain]

Thank you Markku for the information. I will test it or check better check the latest data on the host.

NotaAgain

[NotaGain]

Hi Markku,

thank you for your help I could solve it with both the active and the passive agent. I also reworked the regex into (FEHLER|ERROR)\d+ so that it is not that long and a various error or Fehler code can be read by the item.

[lreis5945]

Can someone help me ?
I have a trigger configured that reads MSSQL command through userparameters.
When the result in Last Data contains the phrase : 0 rows affected = OK
When to display the phrase: 1 rows affected = Generate alarm

But it's not working. How do I add a keyword in Trigger when it is equal to: 1 rows affected

Example
last(/VRSRVCORPDB/pluricare_2)="(0 rows affected)"

[cyber]

https://www.zabbix.com/documentation/6.0/en/manual/appendix/functions/history

find (/host/key,<(sec|#num)<:time shift>>,<operator>,<pattern>)
Find a value match.	See common parameters. sec or #num (optional) - defaults to the latest value if not specified operator (optional; must be double-quoted) Supported operators: eq - equal (default) ne - not equal gt - greater ge - greater or equal lt - less le - less or equal like - value contains the string given in pattern (case-sensitive) bitand - bitwise AND regexp - case-sensitive match of the regular expression given in pattern iregexp - case-insensitive match of the regular expression given in pattern pattern - required pattern (string arguments must be double-quoted); Perl Compatible Regular Expression (PCRE) regular expression if operator is regexp, iregexp.	Supported value types: float, int, str, text, log Returns: 1 - found 0 - otherwise If more than one value is processed, '1' is returned if there is at least one matching value. With regexp or iregexp as the third parameter, the fourth pattern parameter can be an ordinary or global (starting with '@') regular expression. In case of global regular expressions case sensitivity is inherited from global regular expression settings. Example: => find(/host/key,10m,"like","error") → find a value that contains 'error' within the last 10 minutes until now