[ZBXNEXT-448] New trigger function support - logeventid Created: 2010 Jul 08  Updated: 2011 Mar 23  Resolved: 2011 Mar 18

Status: Closed
Project: ZABBIX FEATURE REQUESTS
Component/s: Server (S)
Affects Version/s: 1.8.2
Fix Version/s: 1.8.5, 1.9.3 (alpha)

Type: New Feature Request Priority: Major
Reporter: Oleksii Zagorskyi Assignee: Rudolfs Kreicbergs
Resolution: Fixed Votes: 9
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


 Description   

It must check if EventID of the last log entry matches parameter.
in ARGUMENT need to accept single number of EventID.
trigger for example:

{Host:eventlog[System].logeventid(1001)}

=1

Use this feature very useful for Templates if there are servers or workstations with different Locales, as the text of messages in them are different but number of EvenID is identical.

I think this feature was not just because the support of EventID generally appeared recently in v1.8.

Something of this in the first post: http://www.zabbix.com/forum/showthread.php?t=14944



 Comments   
Comment by Oleksii Zagorskyi [ 2010 Jul 09 ]

additional forum post http://www.zabbix.com/forum/showthread.php?t=17102

Comment by Oleksii Zagorskyi [ 2010 Sep 18 ]

I've been wanting to write, and that's just the case turned up
http://www.zabbix.com/forum/showthread.php?t=19246

Although I specifically stated in the beginning of that "in ARGUMENT need to accept single number of EventID", but lately am sure that it would be better to incoming ARGUMENT supports regular expressions. There is a lot of sense if you've worked for finding problems with the windows servers you will understand why. This will write the expressions triggers much shorter than if a single ARGUMENT.
Perhaps this is a problem, because not exist yet trigger functions where in the input ARGUMENT is supported by a regular expression, so not sure what you wish for such an idea, and so did I from the beginning created the query without regular expressions support.
For example the expression will look like this:

{Host:eventlog[System].logeventid(1001|2002|3003)}

=1

And anyway, I think that the function 'logseverity' not entirely logical, is inconvenient, as the way you can see a lot of user error on the forum. I would put a goal to make it look like on my last sentence, namely that the incoming ARGUMENT supports regular expressions and returns the output 1 or 0. Then it be standardized with other trigger functions.
For example the expression will look like this:

{Host:eventlog[System].logseverity(3|5)}

=1
Also it would be very convenient for this my request ZBXNEXT-470
And we can write something like that short expression for a range of Error up to Emergency:

{Host:eventlog[System].logseverity(1[4-7])}

=1

I understand that this is the subject for another ZBXNEXT, if necessary, I'll create it.
Of course I understand that for existing installations of such a change would conflict, but a compromise must be sought (maybe new function need create? ).

Comment by richlv [ 2010 Dec 19 ]

i'd agree that it would make sense to support regexps right away in such a function

Comment by Oleksii Zagorskyi [ 2010 Dec 20 ]

Richlv, you wrote this comment when I have a great national feast day of St. Nicholas.
St. Nicholas is a Ukrainian national analogue of Santa Claus.
It is no coincidence that you wrote on that day? Maybe I expect a gift from St. Nicholas?
http://uk.wikipedia.org/wiki/Святий_Миколай

Comment by Oleksii Zagorskyi [ 2011 Mar 14 ]

before the work will be done can you say me how is your decision? this trigger function will be support a regexp or not?
btw, i'm ready to test a first revision of this dev branche

Comment by Rudolfs Kreicbergs [ 2011 Mar 15 ]

logseverity should be addressed in a seperate ZBXNEXT since the current functionality ignores the argument and returns the severity, thus it should be discussed some more.

Comment by Rudolfs Kreicbergs [ 2011 Mar 15 ]

Available in dev branch: svn://svn.zabbix.com/branches/dev/ZBXNEXT-448
The function logeventid takes regex as an argument: http://www.zabbix.com/documentation/1.8/manual/config/triggers

Comment by Aleksandrs Saveljevs [ 2011 Mar 15 ]

(1) It should be documented that both dayofmonth() and logeventid() are available since 1.8.5.
<rudolfs> Added a note to the functions
<asaveljevs> Perfect! CLOSED

Comment by Aleksandrs Saveljevs [ 2011 Mar 15 ]

(2) Please review my changes in r18446. If you like them, feel free to merge.

Comment by Rudolfs Kreicbergs [ 2011 Mar 17 ]

Available in pre1.8.5 r18491 and pre1.9.3 r18494.

Comment by Oleksii Zagorskyi [ 2011 Mar 17 ]

Global regexps doesn't supported in the logeventid function at the server side.
Trigger:

{it2:eventlog[Test].logeventid(@TWOID)}

=1

Server debuglog:
65572:20110317:201648.354 In evaluate_function('it2:eventlog[Test].logeventid(@TWOID)')
65572:20110317:201648.354 In evaluate_LOGEVENTID()
65572:20110317:201648.354 In get_function_parameter_str() parameters:'@TWOID' Nparam:1
65572:20110317:201648.355 In substitute_simple_macros() data:'@TWOID'
65572:20110317:201648.355 get_function_parameter_str() value:'@TWOID'
65572:20110317:201648.355 End of get_function_parameter_str():SUCCEED
65572:20110317:201648.355 Query [txnlev:1] [select logeventid from history_log where itemid=24164 order by id desc limit 1]
65572:20110317:201648.355 End of evaluate_LOGEVENTID():SUCCEED
65572:20110317:201648.355 End of evaluate_function('it2:eventlog[Test].logeventid(@TWOID)',value:'0'):SUCCEED
65572:20110317:201648.355 End of substitute_functions() expression:'0=1'
65572:20110317:201648.355 In evaluate() expression:'0=1'
65572:20110317:201648.355 In evaluate_simple(0=1)
65572:20110317:201648.355 In evaluate_simple(0)
65572:20110317:201648.355 In evaluate_simple(1)
65572:20110317:201648.355 End of evaluate() value:0.000000
65572:20110317:201648.355 evaluate_expression() result:0

Global regexp exist:
TWOID 1» ^70$|50 [Result is TRUE]

Event come with ID 70 or 50.

Regular trigger like a

{it2:eventlog[Test].logeventid(^70$|50)}

=1 works well.

Comment by Rudolfs Kreicbergs [ 2011 Mar 18 ]

Added global regex support. Available in dev branch: svn://svn.zabbix.com/branches/dev/ZBXNEXT-448

Comment by Oleksii Zagorskyi [ 2011 Mar 18 ]

Dev branche tested (r18531).
Active check stop to works at all

Server side debuglog:
16384:20110318:144752.987 Trapper got [

{ "request":"active checks", "host":"it2"}

] len 44
16384:20110318:144752.987 In send_list_of_active_checks_json()
16384:20110318:144752.987 In get_hostid_by_host() host:'it2'
16384:20110318:144752.987 Query [txnlev:0] [select hostid,status from hosts where host='it2' and status in (0,1) and proxy_hostid=0
16384:20110318:144752.988 Query [txnlev:1] [begin;]
16384:20110318:144752.988 Query [txnlev:1] [select autoreg_hostid from autoreg_host where proxy_hostid=0 and host='it2' and autoreg_
16384:20110318:144752.988 In DCget_nextid() table:'autoreg_host' num:1
16384:20110318:144752.988 End of DCget_nextid() table:'autoreg_host' [9109:9109]
16384:20110318:144752.988 Query [txnlev:1] [insert into autoreg_host (autoreg_hostid,proxy_hostid,host) values (9109,0,'it2')]
16384:20110318:144752.989 [Z3005] Query failed: [1452] Cannot add or update a child row: a foreign key constraint fails (`zabbix`.`a
16384:20110318:144752.989 In process_event() eventid:0 object:3 objectid:9109 value:1
16384:20110318:144752.989 In DCget_nextid_shared() table:'events'
16384:20110318:144752.989 End of DCget_nextid_shared() table:'events' [515345]
16384:20110318:144752.989 Query [txnlev:1] [insert into events (eventid,source,object,objectid,clock,value) values (515345,2,3,9109,
16384:20110318:144752.990 In process_actions() eventid:515345
16384:20110318:144752.990 Query [txnlev:1] [select actionid,evaltype from actions where status=0 and eventsource=2 and actionid betw
16384:20110318:144752.990 End of process_actions()
16384:20110318:144752.990 End of process_event():SUCCEED
16384:20110318:144752.990 Query [txnlev:1] [commit;]
16384:20110318:144752.991 Sending list of active checks to [10.20.0.16] failed: host [it2] not found
16384:20110318:144752.991 Sending [

{ "response":"failed", "info":"host [it2] not found"}

]

Comment by Rudolfs Kreicbergs [ 2011 Mar 18 ]

The devbranch svn://svn.zabbix.com/branches/dev/ZBXNEXT-448 is based on 1.8 branch. The issue noticed is likely to be caused by using this branch with a DB for the pre1.9.3 branch.

Comment by Oleksii Zagorskyi [ 2011 Mar 21 ]

Thanks Rudolfs, you are right.
I tested diff for the 18531 revision to current trunk (as you recommended):
svn merge svn://svn.zabbix.com/branches/dev/ZBXNEXT-448 -c 18531

Global regexp works !!!

Why did I go wrong:
I looked at huge "Style impromement" changes in the revision 18529. I thought that you overdo it, and somewhere made a mistake and i hastened to report it.
Yes I have seen a string with an error that I had to know that I'm wrong, but unfortunately i think insufficiently.
In short, i was wrong, sorry.

Comment by Rudolfs Kreicbergs [ 2011 Mar 23 ]

Fixed/available in pre-1.8.5 r18624 and pre-1.9.3 r18629

Generated at Fri Apr 26 00:49:49 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.