Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I create a graph in Zabbix with a calucated field based on the count of log entries?

I have an item setup to monitor fatal errors, and I want to add another item so that it calculates the count of the fatal errors and graphs them.

Using this key: log["/d2/httpd/logs/myDomain-error_log","PHP Fatal","UTF-8",100]

It properly gets the data that I'm wanting, however it will not graph this, I imagine I have to count the entries and get the format as an integer, but this does not work:

count(log["/d2/httpd/logs/myDomain-error_log","PHP Fatal","UTF-8",100], 60)

Any ideas of what my key should be, or how I would go about graphing this data to see over time how many errors there were?

Actions and triggers are working fine and doing what is supposed but unable to create graph out of it.

like image 812
Kevin Korb Avatar asked Sep 08 '11 16:09

Kevin Korb


People also ask

Can zabbix monitor logs?

Zabbix does offer a way to parse timestamps out of the log entries. Let's use our very first log file monitoring item for this. Navigate to Configuration | Hosts, click on Items next to A test host, and click on First logfile in the NAME column.

How do you get logs from zabbix?

Just like any other item, the log item has a full explanation with examples — explanation of the parameters, what does what in our documentation. To find this, go to Configuration > Items > Item types > Zabbix agent and here you will find the log item.


1 Answers

What worked for me:

Create item for parsing some string in log.

  • Key log["C:/Logs/log.log",ERROR].
  • Type Zabbix agent (active)
  • Type of information Log.

This item should show all the lines from log with specified string "ERROR".

Second, create calculated item with escaped quotation marks:

  • Key my.special.app.error.count
  • Type Calculated
  • Formula count("log[\"C:/Logs/log.log\",ERROR]", 60)

This would count how many times "ERROR" was repeated in log during 60 seconds.

Now this item can be graphed, triggered, etc.

I'm not really sure why parsing item is required, but without it this calculated item does not work.

like image 159
Algirdas Avatar answered Oct 20 '22 06:10

Algirdas