Acknowledge trigger - reset trigger status

[steria]

Hello,

I am currently monitoring a log file and set up un trigger to catch "ERROR":

ITEM
key: log[/var/log/messages]

TRIGGER
{Template_Linux:log[/var/log/messages].regexp([Ee][Rr][Rr][Oo][Rr])}=1

When the regexp is matched, all works fine since the trigger is set to TRUE.
However, when I try to acknowledge the trigger, it remains to TRUE! Why?

I have seen several topics with a similar pb, but no way to manually set trigger to FALSE? It should be possible to reset trigger value, right?

I certainly doing something wrong or misunderstanding how it works, so please, can someone explain me how it works and what is the problem?

Acknowledge function seems to work fine with other triggers, but not with log monitoring ones.


Thank you very much

[Alexei]

I am thinking of adding new trigger attribute which would specify how events are generated. One of possible options would be "Generate multiple TRUE events". In this case, every matched line of log monitoring (or SNMP trap, anything) would generate a new TRUE event, which can be be used for acknowledgements.

[cperera]

What can we do for the moment to set the trigger status back to FALSE?

Once a log regexp has been matched and triggered, it causes an event and an action takes place. However as the status remains as TRUE the next time a regexp is found it doesn't generate another event. I tried running the following query:

update triggers set value = 0, lastchange = unix_timestamp() where triggerid = 100000000014810;

Although this sets the status back to FALSE, the next time it's triggered an event doesn't get generated. What more needs to be done?

[Christophe]

Hey,
I'm new on zabbix, and I have the same probleme, did someone manage to write a trigger on log that works ?
Thanks

[chriso]

3 years later..and I'm having the same issue. For monitoring logs, should we not be using triggers with "event generation" set to normal? For log monitoring, should this always be set to "normal + multiple true events"?

[jayalps]

Anyone have a resolution to this? I am looking for the same thing.

I want an alert to go off every instance of the string I am looking for appears in a file/log.

For example

vfs.file.regexp[/var/log/messages,error]

The first time the string 'error' appears in /var/log/messages I get an alert. However if the same string appears in the file after that I do not get an alert. I want to be alerted every time that string appears even if I have not acknowledged it yet.