event monitor unkown error

[bahram]

I need help to monitor the Eventlog by Zabbix , active check is enabled and i got unknow error in logs , any idea

1599:20240620:233107.082 active check "eventlog[System,,,,^1$]" is not supported: Unknown error.

[markfree]

bahram, it appears that you are mixing up your configurations. I could not make sense of what you are trying to solve.
Please, try reading the host configuration guide in the documentation first, including the appendix on passive and active checks.

[Markku]

What is the agent version? Does it behave the same with previous major version?

Markku

[bahram]

my zabbix version is 7 ( latest ) and Zabbix server version is 6.2 , not sure it might not compatible ? i did not try it with other version

[bahram]

here is screenshot of what setup in items.







i have only two node on my zabbix , server itself and a windows server , here is snapshot of what i entered in config file

[Markku]

You didn't answer my question, I see.

How is it possible that your Windows host has "ServerActive=127.0.0.1" (= localhost)? There is no Windows version of Zabbix proxy or server.

Markku

[bahram]

probably i am doing something wrong. not sure how to fix it , i dont know much about Zabbix and trying to get familiar with and use it to monitor my network.

when i put the Hostname my server name , the active check is unavailable for windows host. how can i fix it might be something wrong with config file on Zabbix

[bahram]

i chnaged it to name of my server , but have these logs.

ServerActive=127.0.0.1

### Option: Hostname
# List of comma delimited unique, case sensitive hostnames.
# Required for active checks and must match hostnames as configured on the server.
# Value is acquired from HostnameItem if undefined.
#
# Mandatory: no
# Default:
# Hostname=

Hostname=Zabbix server

### Option: HostnameItem
#


gotadmin@ZABBIX:~$ sudo tail /var/log/zabbix/zabbix_agentd.log
617:20240621:100744.513 active check "eventlog[Security,,,,4672,,skip]" is not supported: Unknown error.
617:20240621:100754.516 active check "eventlog[Application,,error,Security-SPP,8198,,skip]" is not supported: Unknown error.
617:20240621:100754.516 active check "eventlog[Security,,,,4672,,skip]" is not supported: Unknown error.
617:20240621:100804.519 active check "eventlog[Application,,error,Security-SPP,8198,,skip]" is not supported: Unknown error.
617:20240621:100804.520 active check "eventlog[Microsoft-Windows-Hyper-V-VMMS-Admin,,error,,,,skip]" is not supported: Unknown error.
617:20240621:100804.520 active check "eventlog[Security,,,,4672,,skip]" is not supported: Unknown error.
617:20240621:100814.522 active check "eventlog[Application,,error,Security-SPP,8198,,skip]" is not supported: Unknown error.
617:20240621:100814.523 active check "eventlog[Security,,,,4672,,skip]" is not supported: Unknown error.
617:20240621:100824.525 active check "eventlog[Application,,error,Security-SPP,8198,,skip]" is not supported: Unknown error.
617:20240621:100824.526 active check "eventlog[Security,,,,4672,,skip]" is not supported: Unknown error.
gotadmin@ZABBIX:~$

[Markku]

You cannot use eventlog item in the Zabbix server, because Zabbix server is only running on Linux (etc), and the eventlog item is only available on Windows version of Zabbix agent.

Reconfigure your Zabbix agent on the Windows host: set ServerActive to the IP address of the Zabbix server. That's how the agent understands where the Zabbix server is so that the active items can work.

Then ensure that you configure the eventlog item for the Windows host, not for the Zabbix server host.

Markku

[bahram]

i want to monitor event log on my windows server , there is misunderstanding happen ,maybe i didn't explain well.


i change server config file and put the serviceactive=10.25.10.175 which is my Zabbix server , is it looks correct ? with this stting Active check is not available now


ServerActive=10.25.10.175



Hostname=Zabbix server

[Markku]

You already showed above that your Windows host was configured with "Hostname=WIN-SICE21N7L92". that's fine, don't set the Windows host's hostname to Zabbix server.

Markku

[bahram]

i just renamed my windows server to make sense , here is the screenshot. my server is "Zabbix server" and ip address is 10.25.10.175
windows server : SRV2019 ip 10.25.10.100
Windows 10 PC : PC1 IP 10.25.10.150


and here is config file on zabbix server , if i want to monitor 100 server or device which need active check , should add all names manually ?


ServerActive=10.25.10.175

### Option: Hostname
# List of comma delimited unique, case sensitive hostnames.
# Required for active checks and must match hostnames as configured on the server.
# Value is acquired from HostnameItem if undefined.
#
# Mandatory: no
# Default:
# Hostname=

Hostname=SRV2019;PC1

[markfree]

bahram, it appears that you are mixing up your configurations. I could not make sense of what you are trying to solve.
Please, try reading the host configuration guide in the documentation first, including the appendix on passive and active checks.

[bahram]

thanks marks for your help , i figure it out ad finally get it to work , i made mistake and try make chnage on my server instead of going on every host and modify the config file , after i config file event start to showing up on my server

[dineshmadhu]

Hi

I have recently upgraded zabbix 4.2 to the 6.4 version. The major issue I face is that each host's active check shows as 'Unknown' on the zabbix portal. Does anyone know what could be the reasons?

Details
-------------------------------
Zabbix agent on the host server 4.2.4
Zabbix server version 6.4
Ubuntu 22.04

Error
------------

[vijayk]

Hi

I have recently upgraded zabbix 4.2 to the 6.4 version. The major issue I face is that each host's active check shows as 'Unknown' on the zabbix portal. Does anyone know what could be the reasons?

Details
-------------------------------
Zabbix agent on the host server 4.2.4
Zabbix server version 6.4
Ubuntu 22.04

Error
------------

Please check in agent config ServerActive=Zabbix Server IP and Hostname= system hostname.