zabbix log monitoring

dyto · 08-27-2014, 10:40 AM

hello all
I am monitoring log file with zabbix-agent. for example when it reads from log "SELinux is preventing" it generates alarm by trigger. my questions is that if I set item's update on 1 sec, even in one second it is generating alarm on last match in the log file. I think agent is reading from the bottom of file. how can I generate alarm for each mach by timestamp? any ideas?

Habitual · 08-27-2014, 02:12 PM

Quote:

Originally Posted by dyto

hello all
I am monitoring log file with zabbix-agent. for example when it reads from log "SELinux is preventing" it generates alarm by trigger. my questions is that if I set item's update on 1 sec, even in one second it is generating alarm on last match in the log file. I think agent is reading from the bottom of file. how can I generate alarm for each mach by timestamp? any ideas?

show us your zabbix_agentd.conf and the script you are using to monitor the log.
And a sanitized snippet of the monitored log please that includes the timestamp.

Do NOT use 1s to update, it's a recipe for failure.

I did something like this for varnish 503 errors with a UTC Timestamp.
solution at https://www.zabbix.com/forum/showpos...89&postcount=9

dyto · 08-27-2014, 02:22 PM

ok thanks for you reply.I will show it later now I am not at place. zabbix-agend.conf contains usual settings server ip and hostname of monitored server. I just want to see alert from /var/log/maillog everytime it logs "Virus Detected" if it is logged 10 times logged zabbix gives alert for tenth not for each entry. I want alert for each entry. zabbis server is checking it every 10 minute but there may be 100 entries anyway I have to look logs for investigation but in case of monitoring system I need every entry.

Habitual · 08-28-2014, 08:48 AM

You're very welcome.
Let us know how it goes.

dyto · 08-28-2014, 10:31 AM

hello again,

here is the my zabbix example how I configured

item:

key: log[/var/log/maillog, Virus Detected,,250]

and the trigger:

Expression: {server.domain:log[/var/log/maillog, Virus Detected,,250].logeventid(1)}=0