Check for missing

[Flexyz]

Hi

Is it possible to get an alert if a given event on a windows box don't appear in a given timeframe?

Thanks

[zalex_ua]

Hi

Is it possible to get an alert if a given event on a windows box don't appear in a given timeframe?

Thanks

event in eventlog? Yes for identical time interval.
Add special item with extra parameters for filtering you event. See examples for eventlog key
http://www.zabbix.com/documentation/...s#zabbix_agent
Then use 'nodata' function http://www.zabbix.com/documentation/...onfig/triggers with corresponding parameter (time interval in seconds).

[Flexyz]

can someone maybe give me an example?

I am trying to add the new trigger for my host

[Flexyz]

Can I use the "nodata" function to specific a timestamp?

example : 01:00->02:00

[Flexyz]

I tried this : (to begin with just to trigger in a specific time frame)

Item:
eventlog[Application]

Trigger:
{cph41mrtg:eventlog[Application].logsource("Check for Missing")}=1&{cph41mrtg:eventlog[Application].time(0)}>133600 &{cph41mrtg:eventlog[Application].time(0)}<141000}

[Flexyz]

hmm I still can't figure out how to get this solved.

I want a action/trigger to run when a specific eventlog message has NOT been detected in a given timeframe example 22:00 -> 23:00

Thanks

[zalex_ua]

hmm I still can't figure out how to get this solved.

Read my post #2 again.

[Flexyz]

Thanks but find it hard to understand. I need the trigger to fire each day if the event log entry is not present.

Could you be so kind and give me an example for the item and trigger for a given time frame

Thanks

[zalex_ua]

Your mistake is that you have not answered my first question!

Could you be so kind and give me an example for the item and trigger for a given time frame

Ok. Once you have written at least some detail, it is possible.

I understand correctly that the event occurs once per every day at the same time? If yes, then
You item:

eventlog[Application,,,"Check for Missing"]

You trigger:

{cph41mrtg:eventlog[Application,,,"Check for Missing"].nodata(86460)}=1

where 86460 is 24 hours + one minute (just in case) in seconds.

[Flexyz]

Yes same time each day - how do I specify the time for it to start?

Let's say I want the time frame to be from 01:00-02:00

Thanks again

[zalex_ua]

Yes same time each day - how do I specify the time for it to start?

Let's say I want the time frame to be from 01:00-02:00

* RTFM *

[Flexyz]

Will try again. Thanks anyway

[Flexyz]

when is the nodate started from?

If I do this :

({cph41mrtg:eventlog[Application,,,"Check for Missing"].time(0)}>111500 & {cph41mrtg:eventlog[Application,,,"Check for Missing"].time(0)}<112000)&{cph41mrtg:eventlog[Application,,,"Check for Missing"].nodata(300)}=1

The trigger fires at "11:15:00" - and not waiting 300 secs.

[Flexyz]

I guess I need to adjust the nodate(x) from 00:00 -> 11:20:00 (from example below) if it it each day.

And the same when I test - adjust nodata(x) from the time I submit update to trigger?

[Flexyz]

Update:

Item:
Type = Zabbiz agent (active)
Key = eventlog[Application,,,"Check for Missing",,200]
(submitted : 15:07)

Trigger:
Name = “missing event”
Expression =
({cph41mrtg:eventlog[Application,,,"Check for Missing",,200].time(0)}>151500
& {cph41mrtg:eventlog[Application,,,"Check for Missing",,200].time(0)} 152000)
&{cph41mrtg:eventlog[Application,,,"Check for Missing",,200].nodata(300)}=1

Dashboard:
"missing event" 29 Oct 2010 15:15:30

(even though {cph41mrtg:eventlog[Application,,,"Check for Missing",,200].time(0)}<152000) is not "true")

Alert is "red" until time passes 15:20:00 even though "acknowledge" has been applied