Windows Event Log Monitoring

[Sypherg]

Hi,

I am trying to monitor logs from Windows Event Viewer for System errors. I have setup template, triggers and items all fin.

I setup item like this:

Type: Zabbix agent (active)
Key: eventlog[system]
type of information: log
update interval: 30
keep history: 90
Status: Active
Applications: WindowsEventLogs

I setup my trigger with this expression: (to pickup system ERROR)
{Windows Logging:eventlog[System].logseverity(4)}=4

I made sure my "host=" matches the hostname configured on the server. I didnt set flag for disableActive and disablePassive.

All my other triggers and checks works just cant get windows event log monitoring to work.

I tried to telnet to the 10051 port, doesnt return anything, also no error saying its blocked. (i will check with IT) but thought i'd ask to see if i am missing something.

Application does not show up in "Latest Data" for the "WindowsEventLogs".

Help?

Here is my config file on the host(s):

############ GENERAL PARAMETERS #################

### Option: DebugLevel
# Specifies debug level
# 0 - no debug
# 1 - critical information
# 2 - error information
# 3 - warnings
# 4 - for debugging (produces lots of information)
#
# Mandatory: no
# Default:
DebugLevel=0

### Option: LogFile
# Name of log file.
#
# Mandatory: no
# Default:
# LogFile=

LogFile=C:\Zabbix\Zabbix_agentd.log

### Option: LogFileSize
# Maximum size of log file in MB.
# 0 - disable automatic log rotation.
#
# Mandatory: no
# Range: 1-1024
# Default:
LogFileSize=1

### Option: SourceIP
# Source IP address for outgoing connections.
#
# Mandatory: no
# Default:
# SourceIP=

### Option: EnableRemoteCommands
# Whether remote commands from Zabbix server are allowed.
# 0 - not allowed
# 1 - allowed
#
# Mandatory: no
# Default:
EnableRemoteCommands=1

##### Passive checks related

### Option: Server
# List of comma delimited IP addresses (or hostnames) of Zabbix servers.
# No spaces allowed. First entry is used for receiving list of and sending active checks.
# Note that hostnames must resolve hostname->IP address and IP address->hostname.
#
# Mandatory: yes
# Default:
# Server=

Server=10.x.x.x

### Option: Hostname
# Unique hostname.
# Required for active checks and must match hostname as configured on the server.
#
# Default:
# Hostname=system.uname

Hostname=(same as my server hostname)

### Option: ListenPort
# Agent will listen on this port for connections from the server.
#
# Mandatory: no
# Range: 1024-32767
# Default:
ListenPort=10050

### Option: ListenIP
# Agent will listen on the specified interface.
#
# Mandatory: no
# Default:
# ListenIP=0.0.0.0

# ListenIP=127.0.0.1

### Option: DisablePassive
# Disable passive checks. The agent will not listen on any TCP port.
# Only active checks will be processed.
# 0 - do not disable
# 1 - disable
#
# Mandatory: no
# Default:
# DisablePassive=0

##### Active checks related

### Option: DisableActive
# Disable active checks. The agent will work in passive mode listening for server.
#
# Mandatory: no
# Default:
# DisableActive=0

# DisableActive=1

### Option: ServerPort
# Server port for retrieving list of and sending active checks.
#
# Mandatory: no
# Default:
ServerPort=10051

### Option: RefreshActiveChecks
# How often list of active checks is refreshed, in seconds.
#
# Mandatory: no
# Range: 60-3600
# Default:
# RefreshActiveChecks=120

### Option: BufferSend
# Do not keep data longer than N seconds in buffer.
#
# Mandatory: no
# Range: 1-3600
# Default:
# BufferSend=5

### Option: BufferSize
# Maximum number of values in a memory buffer. The agent will send
# all collected data to Zabbix Server or Proxy if the buffer is full.
#
# Mandatory: no
# Range: 1-65535
# Default:
# BufferSize=100

### Option: MaxLinesPerSecond
# Maximum number of new lines the agent will send per second to Zabbix Server
# or Proxy processing 'log' and 'eventlog' active checks.
# The provided value will be overridden by the parameter 'maxlines',
# provided in 'log' or 'eventlog' item key.
#
# Mandatory: no
# Range: 1-1000
# Default:
# MaxLinesPerSecond=100

############ ADVANCED PARAMETERS #################

### Option: StartAgents
# Number of pre-forked instances of zabbix_agentd that process passive checks.
#
# Mandatory: no
# Range: 1-16
# Default:
StartAgents=5

### Option: Timeout
# Spend no more than Timeout seconds on processing
#
# Mandatory: no
# Range: 1-30
# Default:
# Timeout=3

### Option: Include
# You may include individual files or all files in a directory in the configuration file.
#
# Mandatory: no
# Default:
# Include=

# Include=c:\zabbix\zabbix_agent.userparams.conf
# Include=c:\zabbix\zabbix_agentd\

####### USER-DEFINED MONITORED PARAMETERS #######

### Option: UserParameter
# User-defined parameter to monitor. There can be several user-defined parameters.
# Format: UserParameter=<key>,<shell command>
# Note that shell command must not return empty string or EOL only.
# Example: UserParameter=system.test,echo 1
#UserParameter=system.test,echo 1

[kehall]

I am also not seeing any log data anywhere (1.8.3). The configuration status shows as "active" in Hosts/Items configuration with no error shown.

I don't see any errors in zabbix_server.log either. It just doesn't seem to do anything!

I've verified hostname is set in agent config, and can access the zabbix server on port 10051 from that host.

Any ideas?

Keith

[simonuk1]

if you put debugging on the zabbix agent, then check the log that may help you find the issue.

[kehall]

I turned on debug log but am getting nothing much of use.. Lots of 'processing request, in check_security(), Requested [xxx], sending back [yyy] for the normal items, but the only things I see referencing active checks are:

...

in refresh_metrics['zbx server ip',10051]

get_active_checks['zbx server ip',10051]

Sending [ZBX_GET_ACTIVE_CHECKS
server name
]

Before read

In parse_lsit_of_checks() [ZBX_EOF
]

In disable_all_metrics()

Parsed [ZBX_EOF]

In process_active_checks('zbx server ip',10051)

In get_min_nextcheck()

Sleeping for 60 seconds


....

I specified Logfile=c:\zabbix.log to try to make it easier to debug, and it still writes to System Event log.

The agent is 1.4.4 - is there a known issue with this version?

Keith.

[kehall]

1.8.3 tried, writing to log file is ok now, but still not getting any joy with active checks:

18664:20101115:235521.057 refresh_active_checks('<zbxserver>',10051)
18664:20101115:235521.057 Sending [{
"request":"active checks",
"host":"<host>"}]
18664:20101115:235521.057 Before read
18664:20101115:235521.057 Got [{
"response":"success",
"data":[]}]
18664:20101115:235521.057 In parse_list_of_checks()
18664:20101115:235521.057 In disable_all_metrics()
18664:20101115:235521.057 In process_active_checks('<zbxserver>',10051)
18664:20101115:235521.057 In get_min_nextcheck()
18664:20101115:235521.057 Sleeping for 1 seconds

There is an Item defined on this server :

Type: Zabbix agent (active)
Key: eventlog[Application]
Type of information: Log
Update interval: 30
Keep history (in days): 2
Status: Actuve

Nothing shows in Latest data for this item.

:/

[simonuk1]

if you look in your hosts item list does the eventlog item show up and is it marked as active. you youvhave this item set as active and do you have active checks enabled in the agent config?

[kehall]

yes to both

[kehall]

I'm stuck with this now... Is it really broken (at least in v1.8.3) or what?

Everything I've seen points to it being set up correctly, everything is active, running, but there is no data requested from the agent seemingly, and no data returned. Nothing is logged on the server to suggest it's even trying.

I need to be able to monitor for event ids in exchange and report when a value in an event decreases beneath a threshold.

Helpppp please

Keith

[kehall]

Does anyone have windows event log monitoring working?

[kehall]

Further to this... Is the hostname check case sensitive?

17396:20101123:112347.007 Sending [{
"request":"active checks",
"host":"WIN-SQL-3"}]
17396:20101123:112347.007 Before read
17396:20101123:112347.007 Got [{
"response":"success",
"data":[]}]

the host in dns, zabbix etc is 'win-sql-3' so maybe its not returning due to that

however if I specify

Hostname win-sql-3

in zabbix_agentd.conf

the configuration file doesn't seem to be read, and I don't get any logging output.

[simonuk1]

make sure the name you have put in the agent congif file matches the name you have for the host in the host screen in zabbix under Name

[kehall]

OK, after refreshing the agent and rewriting the config file I eventually got it accepting data!

It seems the hostname must be case sensitive - can this be changed in a future version - I'm not sure why hostnames should be subject to that, and windows generally report in upper case.

Anyway I'm fighting with regex now so will start a new thread..

ta for the pointers!

Keith