How to create a simple trigger in Zabbix?

Question

Zabbix

Hello colleagues!
There is a log file error.log ONLY the same type of ERRORS are poured into it. Those. any entry in it is a signal of another error.
Make an error trigger for no problems: last(/test/log[/logs/program/error.log])<>0
An error occurs when adding any new entry. Everything is simple here.
I can't figure out how to suppress this error when a positive message falls into another all.log file , like: MACHINE_ID_OK
What I don't do, the error is not fixed.
There is an item in which error.log and all.log
Advise how to solve this problem?
Thanks in advance.

Answer 1

Let's start with the fact that the trigger may be simple, you have difficulty with its redemption. You need to at least hang this very all.log on the data element, and then experiment with the expression for disabling the trigger using the event metadata, which you still have to scoop out from the line in the error.log that causes the error. But if it is enough for you to extinguish the error on any line in all.log, select "OK event generation = Recovery expression" in the trigger settings and write, say, nodata(/test/log[/logs/program/all. log],30)=0.
However, there is a pitfall here - the recovery expression is checked only if the trigger expression becomes false, i.e. until you DELETE ALL LOGS (with such a formulation of the trigger) from error.log (or write 0 there, as zabbix understands it), your trigger will not go down. Therefore, when triggering on logs (any), you need to use nodata()=1 as a trigger expression for filtered logs, and if the absence of data in the logs does not mean the problem is over, write some kind of sane recovery expression.