Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-9610

Log monitoring item: parameterized regexps with "output" parameter conflict with "Log time-format" parameter

XMLWordPrintable

      Zabbix server is 2.2.7, Zabbix agent is 2.2.1. Other version compatibility unknown.

      Starting from Zabbix Agent 2.2.0, the `log` item supports an `output` parameter, which extracts grouped items from the RegExp and stores them in the log. For instance:

      log[/var/log/sample.log,'^([0-9-]{10}).*(ERROR: .*)',,,,\2]
      

      will save log lines matching `ERROR`. The saved text portion will begin with the word `ERROR` and until the end of the line.

      With the Log Format, it's possible to have Zabbix extract the timestamp given by the log-line itself, instead of when Zabbix "saw" the line. This extracted value is stored in the item's `Local Time` field.

      However, if the subgroup's "output" does not include the time-stamp from the log line, then the `local time` will not be updated. If the subgroup's "output" does include the time-stamp for parsing, it will show up both in the `value` and `local time` fields.

      The end-result is that this makes trigger parsing and log analysis a little more difficult and clumsy. It would be nice if either the parsed time value can be stripped from the output, or if the parser fetches the time value independently of the output macro.

      Since the conjunction of these two features' behavior is not documented, fixing it one way or another would have minimal impact on existing users.

            Unassigned Unassigned
            otheus Otheus
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: