HOWTO Monitor Windows Systems

Event Logs

Thank you cstackpole for your investigations. Based on this, here is an example (cookbook) for everybody also struggling around with eventlog:

the source is “W32Time”
the description contains “synchronisiert”
the trigger goes off after 30 seconds
the eventdetails should be reportet in the mail

Create an item

Type: ZABBIX agent (active) Key: eventlog[System] Type of information: Log

NOTE: In the CLIENT config file “Hostname=<host name>” MUST exist (and match the “Hostname” field on the Server) before eventlog will work. Also, ensure there is no “DisableActive=1” line.

Create a trigger

({mypc:eventlog[System].logsource(W32Time)}=1)&({mypc:eventlog[System].str(synchronisiert)}=1)&({mypc:eventlog[System].nodata(30)}#1) you can add “logseverity()” the same way

Create a action

Condition: Host = mypc; Trigger value = ON (when you only want one message) Message: {mypc:eventlog[System].last(0)}

(http://www.zabbix.com/forum/showpost.php?p=15170&postcount=6)

Notes

Agentd W32 1.4.1: stopped working after deletion of eventlog
Agentd W32 1.4.2: OK
Agentd W32 1.4.1/2: resends full eventlog on reboot

Performance

Item: perf_counter[$COUNTER]

On the windows system you can get the possible counter with the following command (at least Windows XP, Windows 2003): typeperf -qx

Enterprise Vault is an email journaling, file and email archiving solution from Symantec formerly Veritas designed for large/medium sized companies with a huge email volume handled by an MS environment. (Lotus Notes and several other Applications are also provided but i will focus on Exchange).

Check, how to Monitor e-vault