[ZBXNEXT-5946] log.count maxproclines Created: 2020 May 11 Updated: 2024 Apr 10 Resolved: 2020 Jul 28 |
|
| Status: | Closed |
| Project: | ZABBIX FEATURE REQUESTS |
| Component/s: | Documentation (D) |
| Affects Version/s: | 4.4.8 |
| Fix Version/s: | 5.2 (plan) |
| Type: | Change Request | Priority: | Trivial |
| Reporter: | Hayk Hovsepyan | Assignee: | Marina Generalova |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | item, items, parameter | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Team: |
| Description |
|
Hi, I understood correctly that for log.count item maxproclines can`t be greater 10*MaxLinesPerSecond' in zabbix_agentd.conf?. So it can`t be greater 10000(max value MaxLinesPerSecond = 1000),.Values more than 10000 not working. log.count[file,<regexp>,<encoding>,<maxproclines>,<mode>,<maxdelay>,<options>] |
| Comments |
| Comment by Hayk Hovsepyan [ 2020 May 15 ] |
|
any update? |
| Comment by Andris Mednis [ 2020 Jul 13 ] |
|
Yes, For a log.count[] item maximum configurable number of processed lines per second is 10 000, that is 10 * MaxLinesPerSecond. For example, If the item update interval is set to 5 seconds, then up to 50 000 lines can be analyzed in one check. If the log file grows faster than 10 000 lines/sec then the agent cannot keep up with all records in a timely manner. You can consider using <maxdelay> parameter in this situation. |
| Comment by Marina Generalova [ 2020 Jul 15 ] |
|
I added a note to log.count and logrt.count item description that <maxproclines> cannot exceed 10000. Documentation updated: |
| Comment by Hayk Hovsepyan [ 2020 Jul 15 ] |
|
@Andris Mednis thanks for important note, so if use maxdelay>0 , and the time will be exceeded , agent will fix the position and return to this position on next check? Or however we will lose data when maxdelay time exceeded? Thanks. |
| Comment by Andris Mednis [ 2020 Jul 15 ] |
|
'maxdelay' was designed to be used in "log storm" situations when a lot of messages (often trivial) are written into log file and it may take a long time for agent to analyze them because of maxproclines limit. With 'maxdelay' the agent estimates how many bytes to skip (ignore!) in the log file to get faster to the newest records - because you might interested what is happening now instead of crawling through old records. Once some part of log file is skipped it will not be analyzed later. So, 'maxdelay=60' says to agent - "do not stay behind the newest records more than 1 minute if you cannot keep up" and agent will make a calculated jump ahead, based on estimated speed of processing to somewhere within 1 minute of processing from the newest record in the log file. 'maxdelay' is documented in https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/zabbix_agent and in |
| Comment by Hayk Hovsepyan [ 2020 Jul 15 ] |
|
Thanks Andris Mednis for clearly description. You can close ticket. Thanks for your good support. |
| Comment by Andris Mednis [ 2020 Jul 15 ] |
|
Thanks! |