Problem with item in Linux Server

[hgoalv]

Hi,

I have a zabbix ítem created to monitor a log file in a Linux server.

The ítem is:

Type: Zabbix Agent (Active)
Key : log[/var/wrk/batch/app.log,ERROR]

When I go to zabbix web and search the ítem in the host, the ítem show a message that "not supported by zabbix agent"

The same ítem in a Windows server it's working correctly.

I don't know what its the problema. Any idea??

Thanks

[kaspars.mednis]

Hello !

Type: Zabbix Agent (Active)
Key : log[/var/wrk/batch/app.log,ERROR]

Does zabbix user have read permissions on this log file ?

P.S

Is there a little red ! sign in info column next to unsupported ? When you hover mouse over this, more information why it's not supported will be displayed

Regards,
Kaspars

[hgoalv]

Yes, this is the permissions -rw-r--r--

When I hover mouse over, show me a message "not suported by agent".

Zabbix Agent versión is: zabbix-agent-2.0.7-24.1

[kaspars.mednis]

I have replicated your situation on CentOS 7.4 Zabbix 3.4 and it worked for me

-rw-r--r--. 1 root root 53 nov  1 15:06 app.log
/var/wrk/batch

Type: Agent Active
Key: log[/var/wrk/batch/app.log,ERROR]
Type of information: Log

Zabbix Agent versión is: zabbix-agent-2.0.7-24.1

is a VERY old zabbix version... maybe try to upgrade zabbix-agent ?

Regards,
Kaspars

[hgoalv]

Please,

can you write me your ítem and trigger code?

Thanks

[kaspars.mednis]

I have posted all my item code in previous post. The problem at this moment is with unsupported item as i see it

What os are you using ? I have seen permission issues with zabbix agent daemon being not able to read default /tmp directory at all with all the correct permissions set.

You can try to move this log file out of /tmp to different directory and test it there

Regards,
Kaspars

[hgoalv]

Thanks for your reply, I wil try to créate other twice the ítem and try in other folders.

But now, I have other question, my trigger is:

server:log[/var/wrk/batch/app.log,ERROR].nodata(30)}=0

Is this correct? This trigger will advise me, when the log receive a new Error?

[kaspars.mednis]

Yes, it will work, if only data you may receive are ERROR
This trigger will stay in problem state 30 sec after error detection, and can generate some action if configured (send email e.g.)

nodata(30)=0  That part means "if there is data received during the last 30 seconds, change trigger value to PROBLEM".

If in this 30 sec period will be another error, this trigger will stay on screen longer, but will not generate new event - you will not get second error message if action is configured, because the trigger is not fired, its just prolonged

You can not use multiple event generation mode, because of ZBXNEXT-2452, in this case multiple problems will be generated every 30 seconds while trigger is active, even if no more ERROR data is received in this period

Regards,
Kaspars

[hgoalv]

In this log, I receive more message tan errors.

I want that when received and error, show me an alert, but only when received and error, not if the log received an warning

[kaspars.mednis]

Yes, your item is already filtering ERROR only, it must work as expected, zabbix will just bypass all other lines in log

Regards,
Kaspars

[hgoalv]

OK, thanks a lot for your replies

[Delik]

Check zabbix_agentd.d Hostname=
It should be the same as the host on the zabbix server GUI