D
D
Dmitry2017-06-05 15:46:53
Zabbix
Dmitry, 2017-06-05 15:46:53

How to correctly configure log monitoring with rotation through Zabbix?

Good afternoon!
When setting up monitoring of the log of one of the programs through Zabbix, I ran into several problems.
About the log
The program that writes the log immediately allocates a file for this log with a certain size, and then writes data to it without changing the size of the log file, zabbix sees this and writes to the log of its agent (after changing modification time the size of log file "C: \MetaTraderServer4\logs\20170602.log" still has not been updated, consider it to be a new file). At the beginning of each line of the log, the time of the event is recorded.
About problems
First problem
The log itself is created every day a new one, with the date in the name (example 20170605.log). Initially, I tried to specify a regular expression for the log name (.*[0-9]{8}.log) in the settings of the key field in item and set the skip mode in the parameters (according to the zabbix manual - skip processing old data), as a result, the key field had the following form: logrt["C:\MetaTraderServer4\logs\.*[0-9]{8}.log","^[4-5]",UTF-8,,skip]. The data was collected, but judging by the time in the received lines, the data was not only from the last log. I have not been able to achieve that zabbix would only look at the log of the current number.
Second problem
When I specify a specific file name in item (log["C:\MetaTraderServer4\logs\20170605.log","^[4-5]",UTF-8,,skip]), the data goes, but it is collected according to a strange pattern . As I wrote above in the log at the beginning of each line, the time is indicated, so you can see which lines zabbix receives. First there are lines after 00:00, then after 00:01, then again 00:00, after 01:09, then 00:37, then 00:00, and so on. There is no logical order in the resulting strings from 00 hours to the current time. I watched the log itself, everything is structured there and time goes on increasing without jumps and returns. I also noticed that the received lines are repeated after a certain period of time, as if a looped piece is obtained. I am attaching a screenshot with an example of the received lines from the log, in the value field I left only the time of the received lines.
d72729728ffe42e48f2ef567e11926ed.jpgQuestions
1. How to set up the key field in item so that zabbix understands that the log of the current number is needed (perhaps another gerular in the name or additional parameters)?
2. For what reason are the lines from the log obtained incompletely and in an incomprehensible order?
Thank you in advance!

Answer the question

In order to leave comments, you need to log in

1 answer(s)
T
Talik, 2017-06-05
@Talik0507

If I understand correctly, you are using a regular item. Maybe it's worth writing a script that will determine the last file by the mask and pull out the last line in the log, parse and send the resulting parameter to zabbix?
Perhaps I misunderstood the task, why are you monitoring the log

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question