PATCH: Windows Agent side filtering of events on event source and type

[dkg]

The attached patch implements agent side filtering of event log events on the 'event source' and 'event type'.

For this functionality the Item key eventlog parameter syntax is extended to allow two extra optional parameters that enable the user to specify a filter expression for the event source and for the event type.

New parameter syntax:

eventlog[<eventlog name>,<event value (description) filter expression>,<event source filter expression>,<event type filter expression>]

This change can greatly reduce the number of events that is sent to the Zabbix server, especially when monitoring just one application or just the error events.

This patch was made using zabbix-1.6.1.tar.gz from 2008-11-04

To apply the patch:
- change to the root of the zabbix source tree
- copy the patch file to the root of the zabbix source tree
- apply the patch with patch -p 1 -i eventlog.patch

I have tested this patch with a stock Zabix 1.6.1 server install on CentOS 5
and a Windows XP Professional SP2 for the Windows agent.

[gospodin.horoshiy]

That looks really promising, thanks!

[cjwallace]

Thanks this could be what i am looking for.

Could you please give a real working example so i can see how to use it?

Thanks again for creating this patch hopefully my event viewer issues take one step closer to working after this

[NOB]

Very good

Hi

thanks for the patch.
We have been waiting for it for a long time.

While you are at it

In my opinion, learned from a closed source Monitoring system, another
way would be to construct an "artificial" log file line in the agent of the
form, e.g.

Source: MSSQL Type: Information Event-ID: 4711 Message: the informational message

and the pattern matching in the agent is applied to that "line".

Depending on the existing patterns in use for the current eventlog items those could remain unchanged.

What do the other posters think about this suggestion ?

This way the agent is still not very smart, but the filtering can be
implemented in a more fine-grained way on the ZABBIX server.

Regards

Norbert.

[jvella]

Will the Patch work with Zabbix 1.6.2

I would like to take advantage of the patch to Eventlog handling but I am running the 1.6.2 version of Zabbix. Will the patch work with this version?

[NOB]

I would like to take advantage of the patch to Eventlog handling but I am running the 1.6.2 version of Zabbix. Will the patch work with this version?

Just try it
The patch is rather small.
The contents of patch files are not so difficult to understand so you could change the lines manually, if it doesn't work.

HTH,

Norbert.

[routinepursuit]

How do I apply the patch, need noob instructions

How do I apply the patch, need noob instructions.

Thanks

[NOB]

How do I apply the patch, need noob instructions.

Thanks

OK. In the patch you'll see (first line) that the patch is for 1.6.1.
So, you have to unpack the sources for zabbix-1.6.1

somewhere, say

$HOME/zabbix-1.6.1

with

cd $HOME

tar xzvf zabbix-1.6.1.tar.gz

Then copy the patch file (eventlog.patch) in that directory, change
to it with

cd $HOME/zabbix-1.6.1

and run the patch tool

patch -p1 <eventlog.patch

I am not sure, whether -p1 is right. If patch asks you which file to
patch, try entering

src/zabbix_agent/active.c

If it still does not work, open the patch file with your favorite editor.
The lines starting with @@ contain the line numbers.
Remove the lines starting with - from the source and add the ones
starting with a +.

It is possible, that the patch will work with the 1.6.2 sources, but I
didn't check it and I have implemented a different approach for us,
so my interest in this patch is not that great

We don't use any 1.6.x release for production purposes, yet, anyway.
But it is recommended that you use 1.6.2 or one of the nightly builds for
Pre-1.6.x (stable).

HTH

Norbert.

[xs-]

Nice work!, the events feature is suddenly usable

@devs, will this be implemented in upstream? (pretty please with sugar on top)

[Danny]

event log filtering

Hi,

I'm running Zabbix 1.6.4 with agent 1.6.4.
Can anyone show an example how to get rid of these TermServDevices-Errors 1111?

Thanks in advance!

[jimbobjoe]

Was this ever included in the new agent releases

Was wondering if this patch was included from this time forward in the agent releases. Would be a great asset for windows event log troubleshooting.

Thanks
Jim

[claudio]

it has been included in the last Alpha version!

[jimbobjoe]

Thanks

Claudio: We are testing the Alpha now. Looks solid so far in our test env. Will try the event log monitoring soon. Thanks a lot for the update.

[claudio]

You're welcome! Please let us know how it is going. We're going for a large deployment and I don't feel like using the Alpha version, but that feature is really a killer one for us.

[Robert Wagnon]

How to use

How is it used? I can't find it in them manual.