monitore multiple logs in directory

[lib95]

Hello,

I try to monitore multiple logs in directory :

logrt["/backup/backup-(Mon|Tues|Wed|Thu|Fri|Sat|Sun).log-[0-9]",".* (bpstart|bpend) .* (\d)"]

exemple of log file :
/backup/backup_Sat.log-20230312

But item is empty, no error.

How to modify this item log ?

Thank you

Regards

[cyber]

Is only one logfile being written to each day?
This item is meant to monitor ONE logfile. if multiple one match the regex, then the one what has been modified LAST will be looked at.

[lib95]

Hello,

Exactly one logfile being written to each day.

Thank you

[Hamardaban]

You have an error in the expression and you can write a little differently

^backup_(Mon|Tues|Wed|Thu|Fri|Sat|Sun)\.log-\d+$

[lib95]

I have modified item like below, it's always empty :
logrt["/backup/^backup-(Mon|Tues|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".* (bpstart|bpend) .* (\d)"]

There is a log backup-Thu.log-20230316
In Zabbix log with debuglevel 5 :
2023/03/16 15:24:42.297185 [101] created exporter task for plugin 'Log' itemid:1349591 key 'logrt["/backup/^backup-(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".* (bpstart|bpend) .*"]'

Best regards

[Hamardaban]

Then you need to look at the contents of the file - which lines exactly do you want to catch?

[lib95]

Hello,

I want to catch two lines that contains bpstart or bpend.

Thank you

regards

[Hamardaban]

Then it's unnecessary
".* (bpstart|bpend) .*_(\d)"
And remove the extra spaces. If they are needed, use \s

[lib95]

Hello,

I have modified the item that is always empty :
logrt["/backup/^backup-(Mon|Tues|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".*(bpstart|bpend).*_(\d)"]

In Zabbix log file :
2023/03/16 19:55:55.375570 [101] adding new request for key: 'logrt["/backup/^backup-(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".* (bpstart|bpend) .*_(\d)"]'

Best regards

[MaterazziSan]

Hello,

I have modified the item that is always empty :
logrt["/backup/^backup-(Mon|Tues|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".*(bpstart|bpend).*_(\d)"]

In Zabbix log file :
2023/03/16 19:55:55.375570 [101] adding new request for key: 'logrt["/backup/^backup-(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".* (bpstart|bpend) .*_(\d)"]'

Best regards

Hi,

Could you write complete 2 lines in log file to be matched?

Best regards

[lib95]

Hello,

There is only below line :
2023/03/16 19:55:55.375570 [101] adding new request for key: 'logrt["/backup/^backup-(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".* (bpstart|bpend) .*_(\d)"]'

Thank you

regards

[Hamardaban]

You were asked to write \ show lines from the source log file in which you are looking for matches.
It's not about the zabbix log!

[cyber]

I have modified item like below, it's always empty :
logrt["/backup/^backup-(Mon|Tues|Wed|Thu|Fri|Sat|Sun)\.log-\d+$",".* (bpstart|bpend) .* (\d)"]

This is not a valid regex... you cannot use ^ in the middle of regex...

[Hamardaban]

As far as I understand, the first parameter in the key "consists" of 2 parts: the path to the file and a regular expression describing the file.
Here is a quote from the documentation:
file regexp - the absolute path to file and the file name described by a regular expression. Note that only the file name is a regular expression.
Based on this, the ^ sign is not in the middle of the regular

Moreover, I have items in which this pattern works!

[cyber]

Right... there is some internal processing to achieve that... I tried at regex101 just in case and it did not work out.. Did not think straight, I guess... its Friday after all.

Then lets wait until real examples of loglines ..

[Hamardaban]

indeed Friday ! :-)

[lib95]

Hello,

Example /backup/backup_Sat.log-20230312 :
Tue 14 Mar 02:10:31 CET 2023. | INFOS : | IN -> bpstart_notify.policy_my. Debut Sauvegarde.
4/B1000028
Tue 14 Mar 02:11:10 CET 2023. | INFOS : | OUT -> bpend_notify.policy_my. Fin Sauvegarde.

Thank you

Regards