Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am configured Zabbix to monitor my Jboss Server logs for Erros and exclude some know errors.
This setup is working, Zabbix will send me alerts when there is a new "ERROR" entry in the log file, but with one issue,
sometimes I get multiple alerts for the same event.
For example, I got 5 alerts with the same time stamp "2012-06-25 07:55:56,864 ERROR".
The duplicate alerts count is not constant, sometimes I get 2, sometimes 5 or 11.

I checked the Monitoring > Latest data in the GUI, and found that there are no duplicate entries.

My configuration of the log monitoring is below.
I am using the latest version of zabbix server(2.0)

Item configuration:

  • Description: Server Error Monitoring.
  • Key: log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip]
  • Type: Zabbix Agent (Active)
  • Type of information: Log
  • Interval :30

Trigger configuration:

  • Description: Found Error in Server Log.
  • Expression: (({SERVER Error Monitoring - PS:log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip].regexp("can not execute")})=0) & (({SERVER Error Monitoring - PS:log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip].regexp("Unexpected redirect")})=0)
  • Event generation: Normal + Multiple TRUE events

Action configuration:

  • Name: alert mail
  • Event source: Trigger
  • Enable escalations: Uncheck
  • Default subject/message: Default
  • Recovery message: Uncheck
  • Action conditions: Trigger value = PROBLEM
  • Action operations: Send message to User "Admin"
share|improve this question

2 Answers 2

I have fixed this issue.

The reason for this issue was, I was using {ITEM.LASTVALUE} in my Action, which caused this problem. I have changed this to {ITEM.VALUE}. Which fixed the issue.

{ITEM.VALUE} is faster than {ITEM.LASTVALUE}.

If you want to know more about this fix, please see the detailed explanation in Zabbix bug tracker

share|improve this answer
    
+1 for linking to the bug Tracker recommended solution. –  Joao Figueiredo Jul 5 '12 at 14:16

Arun,

your item expression is catching all ERROR occurences in the log,

log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip]

while your trigger expression is filtering out all "can not execute" and "Unexpected redirect" and triggering all other error strings.

(({SERVER Error Monitoring - PS:log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip].regexp("can not execute")})=0) & (({SERVER Error Monitoring - PS:log["/SERVER/jboss/jboss-5/server/ps/log/server.log","ERROR",UTF-8,200,skip].regexp("Unexpected redirect")})=0)

when selecting 'Event generation: Normal + Multiple TRUE events' you're instructing Zabbix to keep generating new events for each log string which complies with the Trigger conditions.

So everything's correctly configured there,
are you sure you don't have other active trigger(s) with conditions that catch those duplicate events?
This could also happen with Actions which partly duplicate each other conditions, generating redundant alarms,
but from your simple Action conditions I've a hunch this is not the case here.

share|improve this answer
    
Yes I have confirmed that I don't have any duplicate trigger or action items. I even tried in a fresh installation of zabbix (version 2.0 & 1.8) for confirming this. I think this is a zabbix bug. Any way I have posted this issue in zabbix. support.zabbix.com/browse/ZBX-5239 –  ArunS Jun 26 '12 at 3:41
    
The latest "Zabbix server v2.0.1rc2" version has working without this issue. I have tested this and found that the log monitoring is working fine without any issues. My Zabbix server version: Zabbix server v2.0.1rc2 (revision 28384) (20 June 2012) Compilation time: Jun 26 2012 11:45:16 –  ArunS Jun 26 '12 at 10:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.