Event Log Monitoring - Trigger Expression

[Icenode]

I'm new to Zabbix. In fact I'm just setting this up in our lab for testing to see if we would like to fully implement it in our company. I've been able to muddle through much of setup of checks by searching the forums, but I can't quite figure this problem out.

I'm trying to monitor the event logs of a number of computers on our network. I'm not looking for specific entries from a specific source. I'd like a trigger to be tripped for any "Error" found in the event logs of these computers. I'm mostly looking for application errors. This part I have working. The part I'm having problems with is if no more new logs are written, the trigger is staying active because the last event in the log was the error. I'm wanting a trigger to activate and then return to normal so an event will show up on the dashboard and I'll know to investigate. (I'm not setting these up as high priority and paging on them)

So is this even possible? If a trigger goes back to normal without being acknowledged, does the event still show in the recent events on the dashboard until acknowledged? Is there a way to set a trigger up so that it stays active until it has been acknowledged, then somehow uses that to reset the trigger without the trigger going off on the next check because the last event is still the error in the log?

Not sure if I've explained the situation clearly. Here is the simple trigger expression I'm using now.

{Template_Windows:eventlog[Application].logseverity(4)}=4

Thanks for any help.

[jroberson]

The only way that I can come up with is to use the "eventcreate.exe" command to push an event to that system so that the next check it receives a non error entry in the log. I can't think of any way to flush it from Zabbix, but if you have acknowledgments enabled on the Dashboard, you should see if they are acknowledged or not.

Though there might be a nice front-end enhancement in this. If they are acknowledged, change color or move to another area on the Dashboard.

[bbrendon]

You need to combine what you have with a trigger expression that uses the nodata function. This might be in the documentation, but I know it has been discussed here too many times.

[jroberson]

Something like this perhaps:

({Template_Windows:eventlog[Application].logseverity(4)}=4)&({Template_Windows:status. nodata( 300 ) }=0)

I haven't tested that, but if I'm right (and I'm probably not ) it should only display the trigger for five minutes then disappear. Though, in my opinion, this isn't what I would want to do. I would want a confirmation that it has been acknowledged before it disappears. I don't know of any keys or macros that deal with acknowledgments. It seems that acknowledgments were just tacked on to Zabbix without much integration. Maybe 1.8 will be better.

[Icenode]

Your trigger for the 5 min nodata works. Thanks for that. I know most things have probably been covered sometime in the past in these forums, but I don't necessarily know what I'm looking for yet.

So there is no way for acknowledgments to be used to keep items showing on the dashboard, I guess I can use the events page to view recent alerts. The only problem I have with that is, that when clicking on an event in that view, it doesn't give you any useful details. Like an event triggered from iexplore just shows as an application log event, or high cpu doesn't show how high. Is there a way to make that info show? Perhaps I should start a new topic for that?