-
Incident report
-
Resolution: Duplicate
-
Major
-
None
-
2.2.3
-
None
-
Ubuntu 12.04, postgres 9.3
Hi,
we parse an application log by means of an item having the key "log[XXX]". The "type of information" is set to "Log".
It looks like zabbix is trying to write the entire output of the matched log line in the "subject" field of the "alerts" table with no length check. Since the field is a varchar(255) and we're using Postgres, the DB throws a "FATAL" error because it's not expecting a line longer then 255 chars. I have an example here of the error, masked accordingly. Notice the length of the line starting with "High:OK":
4948:20140623:145640.679 [Z3005] query failed: [0] PGRES_FATAL_ERROR:ERROR: value too long for type character varying(255)
[insert into alerts (alertid,actionid,eventid,userid,clock,mediatypeid,sendto,subject,message,status,error,esc_step,alerttype) values (18302865,7,139284,83,1403528200,5,'***MASKED_BY_ME***','High:OK:***MASKED_BY_ME***:2014-06-23 14:27:42,970 [WARN ] WatchdogManager - GENERIC, Event 1002132968 | No keep-alive received from ***MASKED_BY_ME*** for specified timeframe. Setting event to Panic mode. MatchClock: MatchClock[MatchTime[period=0, timeInPeriod=TimeInPeriod[100 min, 23.038 s]], running: true]:panic mode detected in ***MASKED_BY_ME*** log:','{"SOURCE":"***MASKED_BY_ME***","SEVERITY":"High","STATUS":"OK","HOSTNAME":"***MASKED_BY_ME***","LASTVALUE":"2014-06-23 14:27:42,970 [WARN ] WatchdogManager - GENERIC, Event 1002132968 | No keep-alive received from ***MASKED_BY_ME*** for specified timeframe. Setting event to Panic mode. MatchClock: MatchClock[MatchTime[period=0, timeInPeriod=TimeInPeriod[100 min, 23.038 s]], running: true]","TRIGGERNAME":"panic mode detected in ***MASKED_BY_ME***","TRIGGERURL":""}',0,'',1,0);
]
This causes some race condition/looping behavior. The escalator ramps up constantly to 90% and more.
I'm attaching a screenshot of how the internal processes graph looks. The drop you see is caused by applying the workaround described here: "http://zabbix.org/wiki/Troubleshooting#Escalation_doesn.27t_seem_to_stop".
I'm not really sure if this is a bug in zabbix, a wrong field type in the DB or something we are doing wrong... Is there any way we can prevent zabbix from trying to save the entire output line in the DB, maybe by truncating it after X chars?
- duplicates
-
-
- Closed
-