Windows eventlog and event source?

[Jason]

I'm trying to monitor items in a windows event log generated by "Acronis True Image Echo Server". According to the docs on Ch 4 Item 19.3 then the format for the command is...

eventlog[name,<regexp>,<severity>,<source>,<eventid>,<maxli nes>,<mode>]

This would imply if the source is "Acronis True Image Echo Server" in the application log the item should be

eventlog[application,,,Acronis True Image Echo Server] or even eventlog[application,,,Acronis] assuming it matches part of the string and not complete string.

However, neither of these return any data at all. What are we doing wrong with this?

[zalex_ua]

However, neither of these return any data at all. What are we doing wrong with this?

Try

eventlog[Application,,,"Acronis True Image Echo Server"]

But the reason probably lies elsewhere. Everything is correctly configured for active checks? Hostname in the configuration file agent corresponds to the Hostname of the interface? Active checks not disabled?

http://www.zabbix.com/documentation/.../zabbix_agentd

[Jason]

All the items are active agent and I've used eventlog before several times with regexp, but this is first time I've tried the source

I've tried with the source in quotation marks, but it still gives nothing back.

[zalex_ua]

I tried:

eventlog[Application,,,"Acronis True Image Echo Enterprise Server"]

and it works as expected.
Without quoting it also works, but with quotes it is better IMHO.

[Jason]

It really doesn't seem to be working at all here. I've got the Windows agent on 1.8.3 and the zabbix server is 1.8.3. I've captured raw event log and made sure the source is being picked up correctly and I've even copied the name from that into the item to make sure spelling and capitalisation is all correct.

I've tried both with and without quotation marks (") in the item and it makes no difference.

[zalex_ua]

It really doesn't seem to be working at all here.

Sorry, nothing else can not help. Look carefully debuglog (=4) of agent, if you want then you can send it to me in the mail.

[zalex_ua]

I have a good answer,please show me your email, I will send you.

See my profile for mail.