Home / server / Questions / 270267
Accepted
Mediocre Gopher
Asked: 2011-05-17 10:22:21 +0800 CST

Understanding Zabbix Triggers

  • 772

I have zabbix set with an item to monitor a log file on a zabbix client:

log["/var/log/program_name/client.log","ERROR:","UTF-8",100]

And a trigger to determine when that log file get's more ERRORs:

{Template_Linux:log["/var/log/program_name/client.log","ERROR:","UTF-8",100].change(0)}#0

This trigger gets tripped when the log file gets ERRORs the first time, but then that first trigger just sits around for ever in Monitoring->Triggers. My understanding is that the next time the server checks the value of log["/var/log/program_name/client.log","ERROR:","UTF-8",100] and sees that it hasn't changed that the trigger would go away. Obviously this isn't the case. Could someone explain why this first trigger isn't going away?

Ultimately my goal is to receive an email whenever ERRORs are added to that log file, but I would like to understand how triggers are working first.

logging email zabbix

2 Answers

  1. Best Answer

    The "log" agent item checks the whole log by default, you must tell it to use the "skip" mode to avoid processing of older data. Simply add a ",skip" to the end of your parameters to the log item. Check carefully this page in the documententation.

    • 1

  2. Both the templated item & Trigger seem OK.

    • is the item attached to that host the original templated one or did you clone it and made some changes?
    • Is the item being correctly updated? (Check Monitoring | Latest Data)?

    .change(0) behaves as you'd expect, it returns 1, if the last and previous string are different.

    Just for debugging sake try the following:

    {Template_Linux:log["/var/log/program_name/client.log","ERROR:","UTF-8",100].last(0)}#{Template_Linux:log["/var/log/program_name/client.log","ERROR:","UTF-8",100].prev(0)}
    • 0