Trigger on a String in Log File - Zabbix 5.4.1

[tjh]

Hi,

I've created the following item:

logrt[/var/log/syslog,"(?i)error:"]

It works perfectly. Whenever the word "error" appers in my logs, I get a bunch of items appear in "Latest Data"

Now I want to trigger when one comes in.

Reading the docs it seems as simple as:


length(last(/x.y.z/logrt[/var/log/syslog,"(?i)error:"]))>=1

If the length of the last item in x.y.z/logrt[/var/log/syslog,"(?i)error:"] is greater or equal to 1, then trigger!

But whenever I put this expression in, I'm told "Cannot convert expression result of type "string" to floating point value"


What am I doing wrong here? Shouldn't length look at the string and tell me, in a number, how long the string is? If the string is 20 characters long, haven't I just said "if 20 >=1 then trigger"?

I feel really stupid and I'm sure I am being. But I can't understand why.

Please help if possible Thank you.

[tjh]

What's confusing me even more is that if I put that expression into a "Calculated Value" item. it gives me the correct result (a number which is the number of characters in the string)

Oh and even the expression tester in the Trigger Creator works too. If I put some text in the "value" field and hit test it returns true, if I remove the text so it's empty it returns false.

I think this is a bug?

[tjh]

I have logged a bug about this. I hope that was the right thing to do and I'm not wasting people's time!

[Markku]

No error here, with "length(last(/Testhost/logrt[/var/log/syslog, "(?i)error:"])) > 0", trigger is saved without errors. Zabbix 5.4.1.

Markku

[tjh]

Ok so what seems to have happened is, when I was trying to figure out expressions, I saved it with something that gave that error. But then all the updates I've done to it since don't clear/remove that error. Because now that I have deleted the trigger and re-created it, it works perfectly.

[Markku]

Thanks anyway for returning with the update.

Markku

[tjh]

Thank you for helping me to realise that I needed to create a new trigger to resolve the issue. It still seems like a bug to me that no matter how much I updated the "buggy" trigger it wouldn't correct itself. So I still think I've found an underlying bug, but I haven't (yet) been able to figure out the steps to reproduce it. When I do though I will log a new bug about it, because the bug itself is different to the ticket I logged.

Thanks again.