Event Log

[icol]

I am around this problem for a long time and i am not able to solve it. I have seem old topics of people who managed to have it working. But this not my case

I created an event log item and i can see its working by seeing the records in the zabbix agent log. But when i go and see the latest data for this item there is nothing there.

I have defined a trigger with logeventid and logseverity but nothing happen and i guess it is because there is no data in the item.

[Mike2K]

Perhaps you could share your configuration with us ?

[icol]

Its working !!!!
what i did :

Create an Item with eventlog[Security].
-Zabbix agent active
-Type of information log
- Update interval 15 s (Here I am not sure about the performance impacts)
-Log time format empty

And then i notice some activity in item latest data. I saw the event log records.

Then i have restricted the the amount of records collected : eventlog[Security,"some string"]

I saw less events coming.

The last thing i did was the trigger which is : <HOST>:eventlog... .logeventid(<id number>)=1

It is not perfect but windows is also a difficult and unnecessary complex OS