Windows EventLog Item Value Too Long

[ppzbx]

Hi,

we are using Active Checks to monitor the Event Logs of our Windows Servers.
Unfortunately some of the Application Events are not displayed in the Zabbix web frontend. The the Value size of the missed event log entries are longer than usual (2000 characters for example). We checked the Zabbix Agent Log on the Windos servers with Debug Level 5 and saw that these large Events are processed by the agent without any errors. Maybe the values are too long to be stored into the history_log table or something like this.

Does anybody know how it is possible to adjust the size of the values?

We are using Zabbix Server 1.4.2 on Linux with MySQL 5.0 Database

Many thanks in advance!

[ldil]

Hi ppzbx,

If your event log is growing fast and is to big don't use active checks.

Greetz Leo

[ppzbx]

Hi Leo,

thanks for your reply.
Our problem is not the growth of the event log but the length of some single events who deliver strings longer than usual (1000 Characters for Example) and it seems Zabbix is not able to handle it. We guess there is a fixed limitation in the Zabbix Code.
The history_log table itself shouldn't be the problem because the field value is datatype text
Also the Agent may be not the problem because we saw the XML String for these large Events in the zabbix log XML before sending [.....]
and OK

Unfortunately Zabbix generates no errors in the Server log, also if we used Debuglevel 5.

If we would know, where the limitation is set we could change it as a workaround.

Do you have an idea if there is a limitation?

Many Thanks in adcvence,

Dirk

[ppzbx]

Hi Leo,

thanks for your reply.
Our problem is not the growth of the event log but the length of some single events who deliver strings longer than usual (1000 Characters for Example) and it seems Zabbix is not able to handle it. We guess there is a fixed limitation in the Zabbix Code.
The history_log table itself shouldn't be the problem because the field value is datatype text
Also the Agent may be not the problem because we saw the XML String for these large Events in the zabbix log XML before sending [.....]
and OK

Unfortunately Zabbix generates no errors in the Server log, also if we used Debuglevel 5.

If we would know, where the limitation is set we could change it as a workaround.

Do you have an idea if there is a limitation?

Many Thanks in adcvence,

Dirk

[ldil]

Hi Dirk

Look at this i am not sure but i think this can help you.

zabbix-1.4.2/src/zabbix_agent/eventlog.c en eventlog.h

There are limits there and i think those limits are the defaults

[ppzbx]

Cool!

as if I looked to the Server stuff, you gave me the right answer
In eventlog.c I increased MAX_MSG_LENGTH Definition and bBuffer size to 64kB.

As if we store the event logs only for 24h (just to trigger the error events to generate alerts) we will never get in trouble with tis large data size.

Many Thanks for your help!!!!!

Cheers,

Dirk