Windows event log filtering

[OneWaySWB]

Hello,

I am new to Zabbix so please bear with me. We need to monitor Windows 2003 & 2008 windows event logs. I have it working and can monitor the event logs but I need to filter (exclude) certain events or categories from being tracked in Zabbix. What would be the best way to do this? Can it be done on the client side?

Thanks for any help.

[donjjones]

I'm interested in seeing if there's a way to do this as well...

[HullZabbix]

You do this in your trigger setup (on the server)

For example:

{TemplateABCDServers:eventlog[Application].logseverity(0)}=4 & {TemplateABCDServers:eventlog[Application].nodata(10)}#1 & {TemplateABCDServers:eventlog[Application].str("BusinessObjects.Licensing.KeycodeDecoder.dll , cannot be loaded.")}#1


So that's picking up all error in the application log, excluding ones with "BusinessObjects.Licensing.KeycodeDecoder.dll, cannot be loaded." in the string (description). You can change this to whatever you like e.g.

{TemplateABCDServers:eventlog[Application].logeventid(1006|1106|1107|1116)}#1