Problem Monitoring Log File

[evertonalex]

Hello, good morning!

I have a problem. I'm testing the logrt function of zabbix. I'm monitoring a folder with several logs files and I would like that an alert(trigger) was activated when 3 new strings (in 10 minutes) "ErrorZabbix" be added to the log.

So, I created a item

logrt["C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\LOGS\^TST-SPS-04-.*$","ErrorZabbix"]

After, I created a trigger:

{tst-sps-04:logrt["C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\LOGS\^TST-SPS-04-.*$","ErrorZabbix"].count(10m)}>=3

However, I think that Zabbix is not working correctly.

The 11:17 AM I added ONE new string "ErrorZabbix" in log manually. However, in lastest data (in Zabbix Monitoring) shows as if I had added 11 strings "ErrorZabbix". It seems that every new string "ErrorZabbix" the zabbix records the old items again. Therefore, always the trigger is activated.

The Zabbix log attachment (zabbix_agentd_5.zip)

The log monitored by zabbix (attachment)

Print of lastest data monitoring (attachment)

Thanks
Everton

[andris]

Hi, Everton !

Seems to me that the testing procedure itself caused this result.

The log shows that you have 2 log files to be analyzed at the moment: TST-SPS-04-20160831-1433.log and TST-SPS-04-20160901-1103.log.
Apparently your SharePoint is running and writing into TST-SPS-04-20160901-1103.log.

My guess is that at 11:17 you manually edited the _OLDER_ logfile TST-SPS-04-20160831-1433.log.
Zabbix agent saw it as log file rotation and reanalyzed it from the start - and you got all "ErrorZabbix" occurrencies from yestarday and today again.
When TST-SPS-04-20160901-1103.log was updated, Zabbix agent again saw it as a logfile rotation and switched to it.

Zabbix agent tries hard to not miss data.