Zabbix EventID trigger

[drakeca]

Total newbie here, but I've been trying to get my way through this.

I have a backup application which writes Information data to a log file on a Windows server. I want to send an email when a certain EventID is written to the log. So far I have created the following Item:

eventlog[BACKUPSW,,,,6003,,]

This works, and I can see data being logged if I check the Latest Data link for that server. I next tried to create a trigger and tried to save the following:

{BACK-SRVR:eventlog[BACKUPSW].logeventid(6003)}=1

The system won't allow me to save this and says the Key is incorrect. I tried to use the Expression Constructor and it came up with the following:

{BACK-SRVR:eventlog[BACKUPSW,,,,6003,,].last(0,60)}=1

This allows me to save the trigger, but when it collects the data I see an error message, with information "Format error or unsupported operator".

Any suggestions on how I can get the trigger to kick in?

Any feedback would be appreciated.

[steveboyson]

Try that one:

{BACK-SRVR:eventlog[BACKUPSW,,,,6003,,]}.last(0,60)=1

[drakeca]

Thanks for your quick response. I try to add the trigger, as you quoted, but receive the error message "Incorrect trigger expression. Check expression part starting from "{BACK-SRVR:eventlog[BACKUPSW,,,,6003,,]}.last(0,60)=1".

It doesn't seem to like me moving the brace within the trigger statement.

[steveboyson]

Hmmm you're right, the curly brackets are enclosing the last... statement.
Sorry, my fault.

Maybe something like

{BACK-SRVR:eventlog[BACKUPSW,,,,6003,,].str("Some Error string:")}#0

where "Some error string" is in your eventlog text could help.

[drakeca]

Thanks mate, that seems to have fixed the problem!