Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-19629

Event log monitoring failed for "lastlogsize < FirstID"

    XMLWordPrintable

Details

    • Team C
    • Sprint 78 (Jul 2021), Sprint 79 (Aug 2021), Sprint 80 (Sep 2021), Sprint 81 (Oct 2021), Sprint 82 (Nov 2021)

    Description

      Case:
      If the eventlog monitoring results in "lastlogsize < FirstID", it will not be monitored correctly.

      Envriment:
      ZabbixServer 4.0.17
      WindowsServer 2019

      ItemSample:
      Itemkey "eventlog[application,,Critical,,,,skip]"

      Logs:

      • zabbix_server.log of event occurrence
        2752:20210614:013034.182 active check "eventlog[application,,Critical,,,,skip]" is not supported: EvtNext failed: [0x000006C6] 配列の範囲が無効です。, EventRecordID:400445
        
      • DebugLogs
        6760:20210624:151415.388 In process_eventslog6() source: 'application' previous lastlogsize: 400444, FirstID: 400657, LastID: 411140
        6760:20210624:151415.413 End of process_eventslog6():FAIL
        6760:20210624:151415.420 In finalize_eventlog6()
        6760:20210624:151415.427 End of finalize_eventlog6():SUCCEED
        6760:20210624:151415.433 active check "eventlog[application,,Warning,^Application Hang$,,,skip]" is not supported: EvtNext failed: [0x000006C6] 配列の範囲が無効です。, EventRecordID:400445
        6760:20210624:151415.439 In process_value() key:'TSCloud-vrai-01:eventlog[application,,Warning,^Application Hang$,,,skip]' lastlogsize:400444 value:'EvtNext failed: [0x000006C6] 配列の範囲>が無効です。, EventRecordID:400445'
        

      The event IDs for the environment are as follows.

      • EventRecordID:400445 did not exist.
      • The latest log EventRecordID: 416475
      • The oldest log EventRecordID: 400922

      Result:
      ZabbixAgent was not check eventlogs.

      Expected:
      It will probably become impossible to monitor if lastlogsize < FirstID.
      Isn't this affected by the modification of ZBX-14441?
      Where does there use the reading_startpoint that was used for calculations?

      • eventlog.c
                if (lastlogsize >= FirstID && lastlogsize < LastID)
                        reading_startpoint = lastlogsize + 1;
                else
                        reading_startpoint = FirstID;
                if (reading_startpoint == LastID)       /* LastID = FirstID + count */
                        goto finish;
        

       

      Attachments

        Issue Links

          Activity

            People

              ak Andrejs Kozlovs
              kt_eng06 Keita Higa
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated: