Log monitoring using Zabbix

Question

I am trying to monitor a log file using Zabbix 1.8.4.

I created an item using the following details:

Host: Zabbix server
Description: logger_test
Type: Zabbix agent (active)
Key: log[/tmp/scribetest/test3/test3_current,error,,100]
Type of Infromation: Log
Update interval (in sec): 1 sec
Keep history (in days): 90
Status: Active
Applications: Log files

I created a trigger and attached it with the item logger_test using the following details:

Name: logger_test_trigger
Expression: {Zabbix server:log[/tmp/scribetest/test3/test3_current,error,,100].str(error)}=1
Severity: disaster

The above settings works fine for the first time but next time the trigger shows ZBX_NOTSUPPORTED and after that item also shows "not supported" message.

Can you please tell me if anything I am doing wrong here ?

Solution

It might be an access issue - Zabbix typically runs as an unprivileged user and if the log file in question is not readable by it, then you will get that error.

If that isn't the case, I suggest you enable loggin on the agent and examine the log - this usually provides useful information.

Comments

[Admin]

first, you haven't specified what "for the first time but next time" means. second, "trigger shows ZBX_NOTSUPPORTED" doesn't sound believable, as i don't think triggers can have such a state. when and where exactly do you see those messages ?

[Admin]

@Richlv Here first time I want to mean that after creating an item and then creating a trigger for that item it worked fine. After it appear (alert) in the dashboard it is not working for the second time. When I check the trigger it shows a red cross and when I mouse over it I see this error ZBX_NOTSUPPORTED. I am new to Zabbix and I am evaluating this package. Is there anything I am missing here ? Can you please tell me how can debug this issue ?

[Admin]

check agent logfile - any error messages reported ? and again, you are not specifying what is "the second time" - after restarting zabbix server ? when new values come in the logfile ? also, what is exact trigger expression and what data does item hold ?

[Richlv]

1 second interval with the log key is ok, that's just the agent locally checking whether file has changed or not

[Supratik]

As per the documentation zabbix.com/documentation/1.8/manual/log_file_monitoring they mentioned that the type should be Zabbix Agent (Active). Now, if I use only "Zabbix Agent" the item or the trigger do not complain but it is unable to collect data. With Zabbix Agent (Active) it works for sometime and then throws the error. Can you please tell me what could be the reason ?

[Supratik]

yes, I tried to change it to 20sec but the issue still remains.