I am trying to monitor a log file using Zabbix 1.8.4.

I created an item using the following details:

Host: Zabbix server
Description: logger_test
Type: Zabbix agent (active)
Key: log[/tmp/scribetest/test3/test3_current,error,,100]
Type of Infromation: Log
Update interval (in sec): 1 sec
Keep history (in days): 90
Status: Active
Applications: Log files

I created a trigger and attached it with the item logger_test using the following details:

Name: logger_test_trigger
Expression: {Zabbix server:log[/tmp/scribetest/test3/test3_current,error,,100].str(error)}=1
Severity: disaster

The above settings works fine for the first time but next time the trigger shows ZBX_NOTSUPPORTED and after that item also shows "not supported" message.

Can you please tell me if anything I am doing wrong here ?

  • first, you haven't specified what "for the first time but next time" means. second, "trigger shows ZBX_NOTSUPPORTED" doesn't sound believable, as i don't think triggers can have such a state. when and where exactly do you see those messages ? – Richlv Feb 28 '11 at 8:43
  • @Richlv Here first time I want to mean that after creating an item and then creating a trigger for that item it worked fine. After it appear (alert) in the dashboard it is not working for the second time. When I check the trigger it shows a red cross and when I mouse over it I see this error ZBX_NOTSUPPORTED. I am new to Zabbix and I am evaluating this package. Is there anything I am missing here ? Can you please tell me how can debug this issue ? – Supratik Feb 28 '11 at 11:00
  • check agent logfile - any error messages reported ? and again, you are not specifying what is "the second time" - after restarting zabbix server ? when new values come in the logfile ? also, what is exact trigger expression and what data does item hold ? – Richlv Mar 2 '11 at 7:17

It might be an access issue - Zabbix typically runs as an unprivileged user and if the log file in question is not readable by it, then you will get that error.

If that isn't the case, I suggest you enable loggin on the agent and examine the log - this usually provides useful information.


Do you really need polling the log each sec? The item's becoming unsupported due to some bottleneck. Try changing it to something like 20sec and it probably will go away. Else, try tweaking your zabbix_agentd.conf, can't recall if you have to change MaxLinesPerSecond= for this case or it's another parameter.

  • 1 second interval with the log key is ok, that's just the agent locally checking whether file has changed or not – Richlv Feb 28 '11 at 8:42
  • yes, I tried to change it to 20sec but the issue still remains. – Supratik Feb 28 '11 at 10:44

This type of error usually indicates an error in the Zabbix key although your format matches the documentation. I would do the following to try and narrow down the cause:

  • When an item/trigger isn't working start with the bare minimum setup. Disable/remove the trigger and use the simplest item key possible (in this case just log[/tmp/scribetest/test3/test3_current]).
  • Make sure the log file exists and is readable by Zabbix on the client.
  • Check the log files both on the Zabbix server and client. For example, on my setup I was getting "No active checks found on server: host not found" errors which indicates some sort of Zabbix configuration issue preventing all active checks from working.
  • As per the documentation zabbix.com/documentation/1.8/manual/log_file_monitoring they mentioned that the type should be Zabbix Agent (Active). Now, if I use only "Zabbix Agent" the item or the trigger do not complain but it is unable to collect data. With Zabbix Agent (Active) it works for sometime and then throws the error. Can you please tell me what could be the reason ? – Supratik Feb 28 '11 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.