Master Zabbix Log Monitoring: Key Configurations and Best Practices

Log Item Introduction

Zabbix offers a powerful log file monitoring feature that checks whether a log contains a specific string using regular expressions, supporting log rotation.

When creating an item, select Zabbix agent (active) as the type and configure the Key. Two keys are used for log monitoring:

log[/path/to/some/file,<regexp>,<encoding>,<maxlines>,<mode>,<output>]

logtr[/path/to/some/filename_format,<regexp>,<encoding>,<maxlines>,<mode>,<output>]

Parameters:

regexp : regular expression or literal string to match, e.g., searching for “ERROR”.

encoding : file encoding, can be left empty.

maxlines : maximum lines sent per check; overrides MaxLinesPerSecond in zabbix_agentd.conf, can be empty.

mode : default all, or skip to ignore old data.

output : placeholders (\1‑\9) for captured groups from the regexp.

Unlike log, logtr allows a regular expression in the first parameter, useful for rotating logs such as www.a.com_2021-01-01.log.

As long as <regexp> is set, Zabbix matches log lines accordingly. Ensure the Zabbix user has read permission; otherwise the item becomes “unsupported”.

Monitoring Principle and Considerations

Zabbix Server and Agent track file size and modification time, storing them in byte and time counters.

The Agent resumes reading from the last position.

Counters are saved in the Zabbix database and sent to the Agent to continue reading correctly.

If the file shrinks, the byte counter resets to zero and reading starts from the beginning.

All files matching the configuration are monitored.

When multiple files share the same modification time, they are read in alphabetical order.

Agents check the directory at each update interval.

Agent limits log lines per second via MaxLinePerSecond in zabbix_agentd.conf to avoid overload.

In logtr, the regular expression applies only to the filename, not the directory path.

Log Monitoring Configuration

Ensure the Agent is configured with:

Hostname matching the host name defined on the Server.

ServerActive set to the Server’s IP address.

Create the item: Host → Items → Create Item, selecting Zabbix agent (active) and using a key such as log[/var/log/message,error] to capture lines containing “error”. Adjust the log time format (e.g., MMpddphh:mm:ss) to match the log’s timestamp.

Result View

After configuration, the latest log entries appear in Zabbix with the matched lines, as shown in the screenshots.

Further actions like setting triggers for alerts can be built on the collected data.