Event Monitoring

[StephenJ]

I have setup a template to monitor windows event logs. I just want to check and make sure my trigger and item are correct. We monitor a customers servers via a proxy installed at their end, with server active IP set up along with the standard server IP. Both the IP's are pointing to the proxy server.

The item details are:

Agent Type: Zabbix Agent Active
Key: eventlog[System,,Error,,7]
Update internal: 30s

Trigger:
Expression: {Surrey Storage Nodes:eventlog[System,,Error,,7].logeventid("System,,Error,,7")}=1

I just want to make sure this is correct.

[StephenJ]

Bumping to check trigger and item, just to make sure its right.

[StephenJ]

So I have been able to get it to read the event log and fire the trigger out. I had to change the trigger to {Surrey Storage Nodes:eventlog[System,,Error,,7].logeventid()}=1 and it works perfectly.

My question now is, Can we auto close the alert after it sends the email? We would like it to send an alert, each time the event is generated in the event viewer.

[Mathieu.T]

Hi,

Change your trigger "Problem event generation mode" from "single" to "multiple".
Each time your trigger will catch the error, it will send a mail

[StephenJ]

Thanks, I have made the change. I have been doing a bit of testing and noticed an issue.

Item is setup as: eventlog[System,,"Error",,"7"]
Trigger is setup as: {XXXXXX:eventlog[System,,"Error",,"7"].logeventid()}=1

It does send out the alert, but one thing I have noticed is, it will send an alert if any eventID ends in 7. So It would send an alert for example 4447. Is there any way of only getting it to send if the EventID is "7" and ignore the other ones?

Also I would like it to auto close the alert once it sends the alert out.

[Mathieu.T]

use ^7$ to check only "7"

[StephenJ]

Ahh perfect, so ideally I would like to monitor eventlog - System, Level - Error, Source - disk. Event ID - 7 so my item would be setup as:

eventlog[System,,"Error",,"disk",,^7$]

[StephenJ]

Also I am planning on using {XXXXXXXXXXX:eventlog[System,,"Error",,"disk",,^7$].nodata(10)}=0 to auto close the event

[StephenJ]

So for an Item I went for: eventlog[System,,"Error",,^7$]

For a trigger Problem: {Surrey Storage Nodes:eventlog[System,,Error,,^7$].logeventid(7)}=1

Recovery: {Surrey Storage Nodes:eventlog[System,,Error,,^7$].nodata(1)}=0


This seems to work. I tested on another event ID. What I would like to do, is create a custom email alert for this and include:

Source
Time created
Description
Event ID