-
Incident report
-
Resolution: Won't fix
-
Major
-
None
-
2.0.3
-
Zabbix Server 2.0.3 (revision 30485)
I have an active agent item with type Log and update interval 60 seconds.
Item key looks like this
log[/var/log/zabbix/syslog/alert.log]
I tried to create trigger using count function to notify me if there are any new records on that logfile, so I used following trigger expression:
{LINUX:log[/var/log/zabbix/syslog/alert.log].count(60)}>0
When created this, trigger remained in unknown state (trigger just added - no status update so far). And became true when first row was logged to the logfile but did not reset itself after minute had passed and nothing else was logged. It actually remained true for at least couple of hours (didn't had time to wait any longer).
I also tried another notation (found on http://www.zabbix.com/documentation/2.0/manual/config/triggers/expression Example 7) on the time field but the result was the same.
>0
For a workaround I tried to create a calculated item that would count log entries by minute and that worked as expected
count("log[/var/log/zabbix/syslog/alert.log]",60)
count("log[/var/log/zabbix/syslog/alert.log]",1m)
In both cases item value went back to 0 when no records was logged
So it seems to me that the count function just doesn't work with the log item in the trigger expression.