Windows Event Log client side filtering

[sko]

Hi all,

I'm having problems getting client side filtering of the windows event logs to work. I try to filter out events with Severity "Information" (1) on the client side.

My item key is defined as follows:

eventlog[Security,,@no_information_severity]

@no_information_severity maps to the following regexp:

[^1]


It seems like everything is filtered out now, I'm not receiving any events on the zabbix server. Using only eventlog[Security] works fine, it just produces too many events.

I find this hard to debug, as I cannot find anything in the zabbix agent logs about the regexp matching or filtering.

I'd be grateful for any suggestions on how to make this work.

[zalex_ua]

Hi all,

I'm having problems getting client side filtering of the windows event logs to work. I try to filter out events with Severity "Information" (1) on the client side.

My item key is defined as follows:

eventlog[Security,,@no_information_severity]

@no_information_severity maps to the following regexp:

[^1]

ha, beware, you have a lot of mistakes.

First, I have never met in the Security eventlog events with level "Information". I am almost sure that they've never happens. Maybe you need “Success Audit”.
Second, according to documentation third parameter - The parameter accepts the following values: “Information”, “Warning”, “Error”, “Failure Audit”, “Success Audit”. There are no words or examples that there may be a number!
And last read the https://support.zabbix.com/browse/ZBX-2730 and view my last example (so far only in Russian documentation) and other examples in eng doc.

[sko]

works like a charm now...

must have missed that in the docs. thanks!