Automate pattern detection in collected values. The new find history function provides multiple ways of searching for patterns in collected data.
Previously, Zabbix had multiple trigger functions for detecting string patterns – str, regexp, and iregexp. To simplify the history analysis, they were merged into a single Find function.
In Zabbix 5.4 release, we have introduced the new trigger expression syntax and added over 60 new trigger functions. One of them is the new Find history function, which:
- Can detect a string or a regex pattern
- Can check for a number that is greater/less than the given value
- Has 10 different operators, including equal/not equal, bitwise AND, greater/less, like (for strings), regexp/iregexp
- Returns 1 if a match is found and 0 otherwise
- Supports time shift parameter for moving the evaluation period back in time
In the video, we explain how to detect log errors using the find function.
How to detect log errors with the find function:
- Open the item configuration form
- Select type Zabbix agent (active)
- For the key field, press Select and choose log from the item list
- Specify the path to the log file in square brackets
- Set the type of information to Log
- The recommended update interval is 1 second
- Save the item and switch to the host triggers
- Press Create a new trigger
- Enter name and set trigger severity
- Open the expression builder
10.1. Select the log item
10.2. Selec the find function
10.3. Define the evaluation time period, the operator, the search pattern, and the result - Save the trigger
Tips and best practices:
- To avoid storing excessive log data, define your items with the required pattern
- Triggers can analyze values over time or over number of previous values
- With regexp or iregexp operators, the fourth parameter can be a Global regular expression
- Like and regexp operators are case sensitive, while iregexp is case-insensitive
- Triggers using the find function are recalculated only when new values are received
Subscribe
Login
Please login to comment
0 Comments