[ZBX-5592] logrt follows the .swp log file when editing it Created: 2012 Sep 18  Updated: 2017 May 30  Resolved: 2013 Dec 18

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 2.0.2
Fix Version/s: None

Type: Incident report Priority: Major
Reporter: Alain Ganuchaud (Inactive) Assignee: Martins Valkovskis
Resolution: Fixed Votes: 0
Labels: logmonitoring
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

OS: Red Hat Enterprise Linux Server release 6.2 (Santiago)
Kernel: 2.6.32-220.el6.x86_64 #1 SMP
Zabbix Agent & Server : 2.0.2
Postgresql repository sur Zabbix server : 8.4.9


Issue Links:
Duplicate

 Description   

We monitor a log with logrt:
logrt["/var/log/zabbix/rsyslog2zabbix.log(|[1-4])",,,100]
zabbix has read access on this file and get records without any problem.

But when we edit the log with root, we get this strange error in zabbix server logfile (it is normal that zabbix can't read the file because of access permissions but it is strange it follows the swap file):
12403:20120917:173106.415 cannot open '/var/log/zabbix/.rsyslog2zabbix.log.swp': [13] Permission denied
12403:20120917:173106.415 cannot close file '/var/log/zabbix/.rsyslog2zabbix.log.swp': [9] Bad file descriptor
12403:20120917:173106.415 Active check [logrt["/var/log/zabbix/rsyslog2zabbix.log(|[1-4])",,,100]] is not supported. Disabled.

If we look at inodes, they are different:
ls -li .rsyslog2zabbix.log.swp
90 rw------ 1 root root 16384 Sep 18 15:01 .rsyslog2zabbix.log.swp
ls -li rsyslog2zabbix.log
83 rw------ 1 zabbix zabbix 230374 Sep 18 15:01 rsyslog2zabbix.log

We confess we were not able to reproduce this problem on a Debian Squeeze server.
Thanks for help



 Comments   
Comment by richlv [ 2012 Sep 19 ]

that file matches your regexp (although i'm not sure why isn't it just [1-4]* ? )
wouldn't limiting it to the end of line ($) make it work as you expect ?

edit : oh, alexei mentioned that the files have extra leading dot, which would indeed make them not match the regexp

Comment by Oleksii Zagorskyi [ 2012 Sep 19 ]

also those lines can be generated by zabbix agent only, not by zabbix server ans issue reported mentioned

Comment by Alain Ganuchaud (Inactive) [ 2012 Sep 19 ]

right I agree, I miss the fact that regexp is applied on on filename only, not on full path.
Thanks for your help.

Comment by Alexander Vladishev [ 2013 Feb 15 ]

https://www.zabbix.com/documentation/2.0/manual/config/items/itemtypes/log_items#important_notes

Regexp is applied on filename only.

I'm closing the issue.

Comment by richlv [ 2013 Feb 15 ]

hmm... reopening.

filename is ".rsyslog2zabbix.log.swp"

regexp/file is :

/var/log/zabbix/rsyslog2zabbix.log(|[1-4])

how does it match despite there being a leading dot ? even if that is valid operation, what expression should be used to omit filenames, starting with a dot ?

Comment by Alain Ganuchaud (Inactive) [ 2013 Feb 16 ]

we configured
/var/log/zabbix/^rsyslog2zabbix.log(|[1-4])

Comment by Alain Ganuchaud (Inactive) [ 2013 Feb 16 ]

sorry I missed the trailing $

/var/log/zabbix/^rsyslog2zabbix.log(|[1-4])$

Comment by richlv [ 2013 Feb 16 ]

great, thanks. let's add a similar example to the manual

martins-v We already had a similar example in the manual, although it wasn't explained why it would be useful. It also wasn't clear enough that regexp refers to the file name only, not the whole path. Those two improvements made to:

Generated at Thu Jun 19 07:52:03 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.