Log file Monitoring

[Umair]

I am trying to monitor log files in zabbix 1.4.1, but the front end does not show anything.
There is only one message thrown at zabbix server log file.

Timeout while answering request

Everything else from the agent is working fine.
I am using the following tutorial as mentioned in Zabbix Documentation.


Type Must be set to 'ZABBIX Agent (active)'.
Key Must be set to 'log[file<,regexp>]'.
For example: log[/var/log/syslog], log[/var/log/syslog,error]
Make sure that the file has read permissions for user 'zabbix' otherwise the item status will be set to 'unsupported'.
ZABBIX agent will filter entries of log file by the regexp if present.

Type of information Must be set to 'log'.
Update interval (in sec) The parameter defines how often ZABBIX Agent will check for any changes in the log file. Normally must be set to 1 second in order to get new records as soon as possible.

Suggestions would be appreciated!

[Aly]

Please read manual:
3.4.5. ZABBIX WEB Interface.

Generally about minimal php-script execution time.

[Umair]

The Existing values are :

1). PHP max execution time is set to 300 seconds.
2). PHP Memory limit is set to 128 MB.

[Aly]

Sorry i took it wrongly.. of course it's not about php execution time..

[cstackpole]

I have struggled with logs many times so maybe I can help.

1) check your path structure. I have had issues with spaces and other special characters in the path name

2) Check the depth of the path. It might sound silly, but I have noticed that there is a limit (how far I am not sure but it is several levels deep). I had this problem with one log file that is stored by the program and I have little control over where the file is placed. It is something like 8 levels deep and zabbix just won't see it. I made a symlink and it worked just fine.
ln -s /path/to/crazy/long/file/log/ /opt/ZabbixLogs/shortpath/

/opt/ZabbixLogs just has a bunch of symlinks and everything appears to be happy. If your path is something simple to begin with (like /tmp/log or /home/user/log), don't worry about this step. No point creating symlinks when you don't need them.

3) Check permissions. I have been burned on this one many a time. User zabbix has to at least be able to see and read the log file.

4) Lastly, check that the type really is set to log. I have skipped this step a few times and it drove me crazy cause I thought I had set the server up correctly.

Hopefully this helps, if it doesn't I will check back later and see how things are going.

[joaohf]

Hello,

Can the Key be set to 'log[c:\Documents and Settings\All Users\Application Data\Bacula\Work\log]' on Windows?

What is the limitations of log monitoring files?


Thanks

[cstackpole]

Joaohf
I am not 100% certain but I believe that should work. I don't have anything to verify against at the moment, but from what I see on the PDF it appears that it should be valid for windows.

[Umair]

I have struggled with logs many times so maybe I can help.

1) check your path structure. I have had issues with spaces and other special characters in the path name

2) Check the depth of the path. It might sound silly, but I have noticed that there is a limit (how far I am not sure but it is several levels deep). I had this problem with one log file that is stored by the program and I have little control over where the file is placed. It is something like 8 levels deep and zabbix just won't see it. I made a symlink and it worked just fine.
ln -s /path/to/crazy/long/file/log/ /opt/ZabbixLogs/shortpath/

/opt/ZabbixLogs just has a bunch of symlinks and everything appears to be happy. If your path is something simple to begin with (like /tmp/log or /home/user/log), don't worry about this step. No point creating symlinks when you don't need them.

3) Check permissions. I have been burned on this one many a time. User zabbix has to at least be able to see and read the log file.

4) Lastly, check that the type really is set to log. I have skipped this step a few times and it drove me crazy cause I thought I had set the server up correctly.

Hopefully this helps, if it doesn't I will check back later and see how things are going.

I checked, rechecked all these things and the Item definition seems fine.
Just as you required.
Still there is no output from the logs.

[cstackpole]

Sorry for the long delay. I was out of town.

Hrm..if all of that is ok, then I am a bit stumped.
Is that the only message you are given? Did you find that in the agent or the server log files (have you checked those files)?
Also, are you trying to read the log file just from the server or are you giving the log file through zabbix_agentd.conf? If you are using the agentd.conf try removing that line and using just the server. I never quite got that working right but just using the server configuration and options works for me.

Post back your answer if you get this working.

Good Luck!

[Umair]

Sorry for the late reply.
I was on vacations.

I am having the following output on Agent (zabbix_agentd) side:

14590:20071031:150629 In refresh_metrics('127.0.0.1',10051)
14590:20071031:150629 get_active_checks('127.0.0.1',10051)
14590:20071031:150629 Sending [ZBX_GET_ACTIVE_CHECKS
localhost
]
14590:20071031:150629 Before read
14590:20071031:150629 In parse_list_of_checks('ZBX_EOF
')
14590:20071031:150629 In disable_all_metrics()
14590:20071031:150629 Parsed [ZBX_EOF]
14590:20071031:150629 In process_active_checks('127.0.0.1',10051)
14590:20071031:150629 In get_min_nextcheck()
14590:20071031:150629 Sleeping for 60 seconds

Zabbix server log shows the following output :

Timeout while answering request

.

This is my configuration for the log file:
The server is trying to read its own Log file through Zabbix Agent (zabbix_agentd).

Type: Zabbix Agent (Active)
key : log[/tmp/zabbix_server.log]
Type of Information : Log
Update Interval : 1

[xal]

I just went through similiar issue and found the cause of this. I had 'localhost' defined as a Hostname in zabbix-agentd.conf and I had my real DNS hostname of zabbix server defined in database. Documentation clearly states that those two must match, but I have been ignoring that somehow :-) I changed the hostname in agent's config file and now it works perfectly.

[Umair]

Well it shows in the configuration file of server that the default DB Host name is localhost.
It is the same in Zabbix_Agentd Configuration file.

Still it does not work

[xal]

But it's not DB Host issue. The name in agent's config must match the name of Zabbix server as defined via GUI for monitoring (by default it is "ZABBIX server").

[Umair]

Thanx Man..
That worked like a charm !