eventlog syntax ?

[alixen]

Hi,

I have searched Zabbix manual and this forum for a description of eventlog item type.

I have already understood that I can define eventlog[System], eventlog[Application],...but I get all events from these logs.

Is it possible to define an item that gets events for a specific source and/or severity level ?

I have seen a patch that adds extensive filtering (http://www.zabbix.com/forum/showthre...light=eventlog) but I would like to know what is possible without patching the agent.

Thanks for your help
Alixen

[NOB]

Hi,

I have searched Zabbix manual and this forum for a description of eventlog item type.

I have already understood that I can define eventlog[System], eventlog[Application],...but I get all events from these logs.

Is it possible to define an item that gets events for a specific source and/or severity level ?

I have seen a patch that adds extensive filtering (http://www.zabbix.com/forum/showthre...light=eventlog) but I would like to know what is possible without patching the agent.

Thanks for your help
Alixen

The best you can achieve with the standard agent is filtering by message contents:

eventlog[application,stopped]

will retrieve all messages in the application log whose description contains the pattern stopped.

Then you can add some triggers using logsource(Servicename) or logseverity(2)=2 for type warning or logseverity(4)=4 for type error messages.

No filtering for logsource, severity or event Id, sorry.

Regards

Norbert.