Windows EventLog Triggering Thousands of Alerts

[chewie71]

Hi,

I've installed the eventlog template from the wiki...
http://www.zabbix.com/wiki/templates/windows/eventlog

...to my Zabbix install and added it to two Windows hosts. It apparently works very well, because it immediately started sending me email alerts and I must have received 10,000 or more of them before they finally stopped.

It looks like it started at the earliest event it could find in the logs....which in some cases was more than a year ago.

Is there a way I can tell it to only start from today and not go back through a bunch of eventlog history that I don't care about?

If not, can I disable the alerts for this template temporarily until it catches up in the event logs, and then turn alerts back on again?

Right now if I go to the Monitoring - Events tab....there are thousands of these old trigger events still sitting in there filling up my database. How do I get rid of this data that I don't care about?

Thanks,
Matt

[Remyzero]

Hi chewie71,

From personal experience, when I want to start monitoring windows event logs I do the following before installing the agent:
- Change the default total size of the eventlog file to something resonable
- Save and clear the eventlog

You can do both of these by going to computer management > Event log > right click each log file > properties

Unfortunately I dont know enough about zabbix as yet to clear the data that has already been sent.

I hope this helps for future zabbix agent installs on windows

Regards,

Remy