Event[log] in windows 2008 r2

[antho]

Hello team,

Someone can explain to me how to add eventlog of windows 2008 r2 on zabbix.
I use the item "Event[log]" but it doesn't work...

Thansk in adavance for your help,

Regards

Antho

[HullZabbix]

If you're still looking for an answer you need to add the name of the log into the brackets:

eventlog[Application]
eventlog[System]
eventlog[Security]

I don't believe it works for applications and services logs, e.g. DNS server, File replication service.

[BrentN]

Here's what I'm using and it "mostly" works. I say mostly because I cannot get the timestamp to work correctly. I don't know how the Zabbix agent "sees" the timestamp when it reads from the event log so I don't know the correct timestamp template to use. If anybody figures that one out I'd love to know.

Note that I'm using Zabbix version 2 RC1. You might need to remove one of the commas in the string as the placeholder it represents didn't exist in previous releases. Also, I believe these have to be done as active checks.

Name: $1 Event Log
Type: Zabbix agent (active)
Key: eventlog[System,,"Warning|Error",,,,]
Type: Log
Units: (empty)
Timestamp: yyyy:MM:dd:hh:mm:ss

If you didn't want to filter it out to just warning and error events, eventlog[System] should be all you need. And again - the timestamp I listed doesn't work; I still don't know how to set that correctly. :-/

Brent

[merphisellis]

Only works for System

I can only get it to work for the system log, I want to watch the backup log for errors. Has anyone gotten that to work.????