Event Log Counts

[mpureka]

I am looking for a means of creating an item that tracks the number of a certain type of event log entry.

Right now, it's easy for me to say "Return a log with all entries that match these criteria" and then build a trigger that will fire if there are more than X of those entries in the last Y seconds, which is fine, but doesn't give me the ability to graph those errors. What I would like instead is an item that returns the number of event log entries matching my criteria in the last Y seconds, and then I can build a trigger to fire if the value of that item exceeds my threshold. This would give me both triggering and tracking of this value, and it would, I believe, have the advantage of not having to store all the event log entries in the Zabbix database.

Is this possible? I tried doing some items with the count function, but I have been unable to get them to work. Has anyone had any luck with this sort of exercise?

[ghoz]

count only works in the triggers afaik.

I was looking for the same thing as you, as i don't realy need to get the actual log in zabbix, I just want to know if a specific error ocndition is firing too fast...

The only solution i'm seeing is some kind of WMI script, but i'm not sure on how to avoid reading the whole eventlog everytime though without replicating zabbix agent functionality (keeping track of last query time or whatever)

[mpureka]

Well, section 19.9 of the documentation seems to indicate that you can do some sort of "aggregated check" that will create a count, but I've been unable to implement this. Maybe you'll have better luck.

[ghoz]

Hi,
The wiki page and the examples seem to indicate it's supposed to aggregate values over a group of hosts ...

Think average / max of CPU usage for web servers , sum of net input for multiple links...

I'll post something if I get around the counting events problem... for now i'll skip this ...

Ghoz

[mpureka]

Oh, I see. I was not reading the first portion of that section thoroughly - apparently one HAS to use one of the "group functions" and it takes an "item function" as an argument.

That's unfortunate, because it means I'm really out of ideas on how to approach this.

[carl]

The only way I can find to-do it at the moment (tested on 2003 only) would be a new item like:

eventquery.vbs /L system /FO CSV /fi "Datetime gt 06/18/2011,10:00:00AM" | find /c /v "~~~"

You would need to change the time with every query, maybe run it every 5 minutes and the graph item in usual way. I will update when I get time to finish the command properly for zabbix_agentd.conf method.

I could not find a perfmon counter for eventlog volume

[carl]

http://blog.commandlinekungfu.com/20...6-log-jam.html looks like an interesting method too via powershell.

[Tractorboy]

Count Values

Has this been made possible yet. It would be a very powerful solution if it has been?