Zabbix log watch Amazon ECS Agent and init logs..

[joshuamcdo]

So. I am slightly puzzled and have to be honest in admitting that I haven't been able to solve this...

I want to watch the Amazon ECS ( Elastic container service ) log files for certain error messages.. I get how the key basically works.

logrt[file_regexp,cannot allocate memory,UTF-8,50,]

It's the file_regexp that I cannot seem to wrap my head around. How on earch am I supposed to tell it to use the latest file and append that `date`-[00-99] logic to it..

I have pasted an ls -lrt output to this post as well.

Thanks, ( In advance )

J

-rw-r--r-- 1 root root 2430 Dec 8 19:11 ecs-init.log.2015-12-08-19
-rw-r--r-- 1 root root 2075572 Jan 13 00:59 ecs-agent.log.2016-01-13-00
-rw-r--r-- 1 root root 2165692 Jan 13 01:59 ecs-agent.log.2016-01-13-01
-rw-r--r-- 1 root root 2149982 Jan 13 02:59 ecs-agent.log.2016-01-13-02
-rw-r--r-- 1 root root 2114502 Jan 13 03:59 ecs-agent.log.2016-01-13-03
-rw-r--r-- 1 root root 2230684 Jan 13 04:59 ecs-agent.log.2016-01-13-04
-rw-r--r-- 1 root root 2084660 Jan 13 05:59 ecs-agent.log.2016-01-13-05
-rw-r--r-- 1 root root 2169576 Jan 13 06:59 ecs-agent.log.2016-01-13-06
-rw-r--r-- 1 root root 2102628 Jan 13 07:59 ecs-agent.log.2016-01-13-07
-rw-r--r-- 1 root root 2112612 Jan 13 08:59 ecs-agent.log.2016-01-13-08
-rw-r--r-- 1 root root 2131847 Jan 13 09:59 ecs-agent.log.2016-01-13-09
-rw-r--r-- 1 root root 2061634 Jan 13 10:59 ecs-agent.log.2016-01-13-10
-rw-r--r-- 1 root root 2077573 Jan 13 11:59 ecs-agent.log.2016-01-13-11
-rw-r--r-- 1 root root 2130885 Jan 13 12:59 ecs-agent.log.2016-01-13-12
-rw-r--r-- 1 root root 2205857 Jan 13 13:59 ecs-agent.log.2016-01-13-13
-rw-r--r-- 1 root root 2209312 Jan 13 14:59 ecs-agent.log.2016-01-13-14
-rw-r--r-- 1 root root 2157486 Jan 13 15:59 ecs-agent.log.2016-01-13-15
-rw-r--r-- 1 root root 2101759 Jan 13 16:59 ecs-agent.log.2016-01-13-16
-rw-r--r-- 1 root root 2267412 Jan 13 17:59 ecs-agent.log.2016-01-13-17
-rw-r--r-- 1 root root 2266334 Jan 13 18:59 ecs-agent.log.2016-01-13-18
-rw-r--r-- 1 root root 2302414 Jan 13 19:59 ecs-agent.log.2016-01-13-19
-rw-r--r-- 1 root root 2303838 Jan 13 20:59 ecs-agent.log.2016-01-13-20
-rw-r--r-- 1 root root 2318173 Jan 13 21:59 ecs-agent.log.2016-01-13-21
-rw-r--r-- 1 root root 2319237 Jan 13 22:59 ecs-agent.log.2016-01-13-22
-rw-r--r-- 1 root root 2285075 Jan 13 23:59 ecs-agent.log.2016-01-13-23
-rw-r--r-- 1 root root 614935 Jan 14 00:16 ecs-agent.log.2016-01-14-00
-rw-r--r-- 1 root root 322 Jan 14 17:40 ecs-agent.log.2016-01-14-17
-rw-r--r-- 1 root root 106343 Jan 14 17:40 ecs-init.log.2016-01-14-17
-rw-r--r-- 1 root root 2912276 Jan 14 18:53 ecs-agent.log.2016-01-14-18
-rw-r--r-- 1 root root 2452 Jan 14 18:59 ecs-init.log.2016-01-14-18

[joshuamcdo]

Forum dead?

WoW.. This forum seems to be dying.. Which is somewhat of a surprise to me.

So. I am slightly puzzled and have to be honest in admitting that I haven't been able to solve this...

[joshuamcdo]

Re: Forum dead?

This is Zabbix 2.0.16 in case anyone is wondering..

So I have continued to try and solve this and will post here with my babble in hopes that someone chimes in.

The latest failed attempt looks something like this..

key : logrt["/var/log/ecs/ecs-agent.log.*^(19|20)\d\d([- \/.])(0[1-9]|1[012])\2(0[1-9]|[12][0-9]|3[01])-(\d\d)$",cannot allocate memory,UTF-8,50,]

All I get from the zabbix agent log file is :
17225:20160120:155433.142 filename '/var/log/ecs/ecs-agent.log.*^(19|20)\d\d([- \/.])(0[1-9]|1[012])\2(0[1-9]|[12][0-9]|3[01])$' does not contain a valid directory and/or format
17225:20160120:155433.142 active check "logrt["/var/log/ecs/ecs-agent.log.*^(19|20)\d\d([- \/.])(0[1-9]|1[012])\2(0[1-9]|[12][0-9]|3[01])$",cannot allocate memory,UTF-8,50,]" is not supported

Any thoughts?

WoW.. This forum seems to be dying.. Which is somewhat of a surprise to me.

[joshuamcdo]

Posix...

Doing some digging I finally realized that Zabbix uses POSX regexp.

So this is what I have come up with so far.

logrt["/var/log/ecs/ecs-agent.log.*[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{2}",cannot allocate memory,UTF-8,50,]


I know it still needs tweaking and am not even sure if this will work yet or not. Time will tell..

J

[ingus.vilnis]

Hi,

Don't think the forum is dying. Just sometimes the usual contributors are busy enough and simply don't have time to reply here.

I think the item key is too complicated for the files you need to match.

See how this works. In your case file path /var/log/ecs/ is the static part but then everything is the file regexp. You are trying to regexp the date and looks like your final regexp is correct however I would simplify this even more:

logrt["/var/log/ecs/ecs-agent.log.*","cannot allocate memory",,50,]

You can try testing it by using some other regexp for content matching than "cannot allocate memory" which might show up quite rarely.

Best Regards,
Ingus