Zabbix can't monitor Mikrotik Logs

[radu990]

Hello,

I have configured on a Mikrotik remote logging to a Rsyslog server, and the entries appear ok on Rsyslog. Same as for other entries, for example logs from PFsense. Logs are saved in /var/log/messages, zabbix user have access to the file.

http://www.pixhost.org/show/218/55624050_clipboard2.png

http://www.pixhost.org/show/218/55624048_clipboard.png

Zabbix can monitor ok the logs from Pfsense (and a few others), however doesn't monitor at all Mikrotik Logs.

http://www.pixhost.org/show/218/55624224_clipboard3.png

Any idea what could be the reason the Mikrotik logs are being ommited?
P.S. Observed that when there is a new log entry in /var/log/messages for Pfsense (that matches the Zabbix item criteria) for example, I can see it in the console. For Mikrotik logins that are set as well in zabbix, nothing appears in console. Maybe the problem is in this/rsyslog.conf settings?

http://www.pixhost.org/show/218/55624880_clipboard4.png

Thanks in advance

[andris]

http://pixhost.org/show/218/55624224_clipboard3.png shows that for some reason (?) you use quotes (") around regexps to be matched for Mikrotik log[] items (and they show nothing) but there are no quotes around PFsense regexps which work as expected.
Maybe you can try to remove quotes from Mikrotik items ?

[radu990]

http://pixhost.org/show/218/55624224_clipboard3.png shows that for some reason (?) you use quotes (") around regexps to be matched for Mikrotik log[] items (and they show nothing) but there are no quotes around PFsense regexps which work as expected.
Maybe you can try to remove quotes from Mikrotik items ?

Thank you very much for your reply. As it wasn't working from start without the quotes, I have tried to change the regexp with quotes (" and ') and without. However still no luck, so unfortunately the problem is not in it

[radu990]

Started working after a while

Suddenly, looks like the solution was simple to wait a while Looks like the /etc/log/messages have aprox. 2.5GB in size in my case, and most probably it took a while to read the logs.

http://i1.imageban.ru/out/2017/11/06/f694d6683aa366edc9f2d0d73e8a1388.png