[ZBX-8646] logrt does not distinguish between missing files and incorrect permissions Created: 2014 Aug 21  Updated: 2017 May 30  Resolved: 2014 Sep 01

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 2.2.5
Fix Version/s: 2.0.13rc1, 2.2.7rc1, 2.3.5

Type: Incident report Priority: Minor
Reporter: Stefan Sabolowitsch Assignee: Martins Valkovskis
Resolution: Fixed Votes: 0
Labels: logmonitoring, logrt
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

FreeBSD 10.0-RELEASE-p7



 Description   

Hi,
logrt will not match with a regexp.

with this example:

logrt["{$PGLOGDIR}/postgresql-.*\.log","PANIC|FATAL|ERROR|[Ee]rror"]

i get this in error in zabbix-agent logfile:

87681:20140821:142054.145 there are no files matching 'postgresql-.*\.log' in '/var/log/pg_log/'

the path ist ok, also the access rights:

[root@zabbix-m01 /var/log/pg_log]# ls
total 5
-rw-r--r--  1 pgsql  pgsql  265 Aug 21 13:55 postgresql-2014-08-21_135543.log

the regexp self is ok, testet with:
http://www.myregextester.com/index.php

any help here ?



 Comments   
Comment by richlv [ 2014 Aug 21 ]

i suspect it might be caused by usermacros not supported as part of the item key parameter

Comment by Stefan Sabolowitsch [ 2014 Aug 21 ]

rich, not 100% true

i get without a usermacro the same error, please look here

logrt["/var/log/pg_log/postgresql-.*\.log","PANIC|FATAL|ERROR|[Ee]rror"]
93306:20140821:144655.627 there are no files matching 'postgresql-.*\.log' in '/var/log/pg_log/'

i think this is a bug...

Comment by Oleksii Zagorskyi [ 2014 Aug 22 ]

Does zabbix user have Read rights to the "pg_log" directory ?
I'd give 777 for path and files for testing.

Comment by Stefan Sabolowitsch [ 2014 Aug 22 ]

Hi Oleksiy,
yes this should work.
But why not 744 = path and 644 = logfile ?
Only work if path have 777 and then works with logfile 644

Short Info, also work with Usermacro...

Comment by Aleksandrs Saveljevs [ 2014 Aug 22 ]

In order to read contents of a directory, one needs to have execution bit set on it.

Comment by dimir [ 2014 Aug 22 ]

That's right, so set the directory to 755 an the file to 644.

Comment by Stefan Sabolowitsch [ 2014 Aug 22 ]

Hi,
yes 755 also works.

I read the *nix manual an found this:

Read allows you to list the files inside of it.
Execute allows you to enter it and access files (or other directories) inside.

This is the reason why we need also "execution bit".
Thanks for the help and sorry for the noise.
The ticket can be closed.

Greetings to Riga and zabbix team.

Comment by Andris Mednis [ 2014 Aug 22 ]

Closing, it is not a bug.

Comment by Oleksii Zagorskyi [ 2014 Aug 22 ]

Note that in MC this bit named "execute/search by ...".

Comment by Andris Mednis [ 2014 Aug 22 ]

Reopening the issue. It should be investigated why a user was getting message "there are no files matching ..." instead of "Cannot open directory ...for reading" in case of wrong directory permissions.

Comment by Andris Mednis [ 2014 Aug 26 ]

Confirmed. My mistake - logrt[] item in Zabbix agent does not distinguish between absence of matching log files and insufficient rights to read their attributes (e..g. mtime, size). Both cases are processed as "we saw this file a moment ago, now we try to find its attributes and fail, no problem - probably the file has gone, proceed to the next one".

Comment by Andris Mednis [ 2014 Sep 01 ]

Proposed solution for logrt[] on UNIX/GNU/Linux platforms: if logrt[] does not find matching files in the directory, check access rights ("execute" permission on the directory). In case of insufficient access rights (no "execute" permission) write a warning into agent log file, otherwise write a warning about missing files. In both cases do not make the logrt[] item NOTSUPPORTED. "man access" warns about problems which can occur if log files reside on NFS or FUSE mounts, therefore we issue only a warning and continue, but do not turn the item NOTSUPPORTED if access() reports no "execute" permission on the directory.

Available in development branch svn://svn.zabbix.com/branches/dev/ZBX-8646 (for Zabbix 2.0.x)

Comment by Andris Zeila [ 2014 Sep 01 ]

(1) Does not compile on Windows:
..\..\..\src\zabbix_agent\logfiles.c(1313) : error C2065: 'X_OK' : undeclared identifier

andris RESOLVED in r48647.

wiper CLOSED

Comment by Andris Zeila [ 2014 Sep 02 ]

Successfully tested

Comment by Andris Mednis [ 2014 Sep 02 ]

Fixed in versions pre-2.0.13 r48663, pre-2.2.7 r48666, pre-2.3.5 r48671.

Comment by Andris Mednis [ 2014 Sep 03 ]

(2) A note
"If there are several matching log files for logrt[] item and Zabbix agent is following the most recent of them and this most recent log file is deleted, a warning message “there are no files matching ”<regexp mask>” in ”<directory>” is logged. Zabbix agent ignores log files with modification time less than the most recent modification time seen by the agent for the logrt[] item being checked."
added to:
https://www.zabbix.com/documentation/2.0/manual/config/items/itemtypes/log_items?&#important_notes
https://www.zabbix.com/documentation/2.2/manual/config/items/itemtypes/log_items?&#important_notes
https://www.zabbix.com/documentation/2.4/manual/config/items/itemtypes/log_items?&#important_notes

wiper looks good, CLOSED

Generated at Thu Apr 25 17:38:19 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.