Virtualization: vmware
Operating System: CentOS Linux 7 (Core)
Kernel: Linux 3.10.0-693.21.1.el7.x86_64
Architecture: x86-64

Hello, Keven

Can you provide example which caused double alert?

Please show us listing with files in the directory with modification time information.

The first parameter in logrt is regexp_describing_filename_pattern. Сan it be that several files match the configuration of a single item? For example item is logrt[/var/log/network/access.log,error,,,] and there are files /var/log/network/access.log0.

Regards,

Elina

Hello,

Thank you for your reply, the discovery rule can find all files ending in ".log" and we have all the files correctly.
These are log files from rsyslog. We monitor all switches, routers and firewalls. With this rule, each file has five items to find "1,2,3,4 or-5-". Each "code" defines a severity of the error and allows to associate it with the good trigger. In fact, the problem comes when a second error arrives, it sends the first error and the new that just happened. It reads the old log file history. Unfortunately I cannot show you more details.

Let me know if you have any questions.

Thank you,

Keven

The discovery rule finds all files ending in ".log", thats right =)

For example it returned the following:

{"data": [{"{#LOGFILEPATH}": "/var/log/zabbix/zabbix_agentd.log"}, {"{#LOGFILEPATH}": "/var/log/zabbix/zabbix_server.log"}]}

And then you then you will get several items and triggers like:

logrt[/var/log/zabbix/zabbix_server.log,-1-,,,skip]
{SomeTemplate:logrt[/var/log/zabbix/zabbix_server.log,-1-,,,skip].strlen()}<>0

If i have file /var/log/zabbix/zabbix_server.log0 it will be match regular expression in that item. When file zabbix_server.log updates, Zabbix reads it from 1 byte and store last read byte. Than file zabbix_server.log0 updates, Zabbix reads it from 1 byte and store last read byte. Than file zabbix_server.log updates again and Zabbix again reads it from 1 byte.

You can put path=path+'$' in your script to form data like:

{"data": [{"{#LOGFILEPATH}": "/var/log/zabbix/zabbix_agentd.log$"}, {"{#LOGFILEPATH}": "/var/log/zabbix/zabbix_server.log$"}]}

Please make sure that you do not have multiple files which can be updated at nearly the same time per one logrt item.

Hi Elina,

Thank you for your fast reply. I added "$" at the end of my path as your talking. Normally, each items monitor only item. But, each file has 5 items :

logrt[/var/log/network/Switch-01.log$,"-0-",,,skip]
logrt[/var/log/network/Switch-01.log$,"-1-",,,skip]
logrt[/var/log/network/Switch-01.log$,"-2-",,,skip]
logrt[/var/log/network/Switch-01.log$,"-3-",,,skip]
logrt[/var/log/network/Switch-01.log$,"-4-",,,skip]
logrt[/var/log/network/Switch-01.log$,"-5-",,,skip]

And each item is joined with a trigger :

{Server:logrt[/var/log/network/Switch-01.log$,"-0-",,,skip].strlen()}<>0
{Server:logrt[/var/log/network/Switch-01.log$,"-1-",,,skip].strlen()}<>0
{Server:logrt[/var/log/network/Switch-01.log$,"-2-",,,skip].strlen()}<>0
{Server:logrt[/var/log/network/Switch-01.log$,"-3-",,,skip].strlen()}<>0
{Server:logrt[/var/log/network/Switch-01.log$,"-4-",,,skip].strlen()}<>0
{Server:logrt[/var/log/network/Switch-01.log$,"-5-",,,skip].strlen()}<>0

Let me know if you have any questions.

Thanks,

Keven

It's okay if one log file is associated with several items, the main thing that you have no item witch collects data from multiple files.

I can not reproduce the situation after adding '$'. Can you share example of double alert if you still have the issue? 

Regards,

Elina

No activity. Closing. Reopen if required.