Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-19629

Event log monitoring failed for "lastlogsize < FirstID"

    XMLWordPrintable

Details

    • Team C
    • Sprint 78 (Jul 2021), Sprint 79 (Aug 2021), Sprint 80 (Sep 2021), Sprint 81 (Oct 2021), Sprint 82 (Nov 2021), Sprint 83 (Dec 2021), Sprint 84 (Jan 2022), Sprint 85 (Feb 2022), Sprint 86 (Mar 2022), Sprint 87 (Apr 2022), Sprint 88 (May 2022), Sprint 89 (Jun 2022), Sprint 90 (Jul 2022), Sprint 91 (Aug 2022), Sprint 92 (Sep 2022), Sprint 93 (Oct 2022)
    • 1

    Description

      Case:
      If the eventlog monitoring results in "lastlogsize < FirstID", it will not be monitored correctly.

      Envriment:
      ZabbixServer 4.0.17
      WindowsServer 2019

      ItemSample:
      Itemkey "eventlog[application,,Critical,,,,skip]"

      Logs:

      • zabbix_server.log of event occurrence
        2752:20210614:013034.182 active check "eventlog[application,,Critical,,,,skip]" is not supported: EvtNext failed: [0x000006C6] 配列の範囲が無効です。, EventRecordID:400445
        
      • DebugLogs
        6760:20210624:151415.388 In process_eventslog6() source: 'application' previous lastlogsize: 400444, FirstID: 400657, LastID: 411140
        6760:20210624:151415.413 End of process_eventslog6():FAIL
        6760:20210624:151415.420 In finalize_eventlog6()
        6760:20210624:151415.427 End of finalize_eventlog6():SUCCEED
        6760:20210624:151415.433 active check "eventlog[application,,Warning,^Application Hang$,,,skip]" is not supported: EvtNext failed: [0x000006C6] 配列の範囲が無効です。, EventRecordID:400445
        6760:20210624:151415.439 In process_value() key:'TSCloud-vrai-01:eventlog[application,,Warning,^Application Hang$,,,skip]' lastlogsize:400444 value:'EvtNext failed: [0x000006C6] 配列の範囲>が無効です。, EventRecordID:400445'
        

      The event IDs for the environment are as follows.

      • EventRecordID:400445 did not exist.
      • The latest log EventRecordID: 416475
      • The oldest log EventRecordID: 400922

      Result:
      ZabbixAgent was not check eventlogs.

      Expected:
      It will probably become impossible to monitor if lastlogsize < FirstID.
      Isn't this affected by the modification of ZBX-14441?
      Where does there use the reading_startpoint that was used for calculations?

      • eventlog.c
                if (lastlogsize >= FirstID && lastlogsize < LastID)
                        reading_startpoint = lastlogsize + 1;
                else
                        reading_startpoint = FirstID;
                if (reading_startpoint == LastID)       /* LastID = FirstID + count */
                        goto finish;
        

       

      Attachments

        Issue Links

          Activity

            People

              kprutkovs Konstantins Prutkovs
              kt_eng06 Keita Higa
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated: