Monitoring backup with event log.

[PiotrIr]

Hi,
I’m trying to monitor backup using event log with requirements:

1.Zabbix shows backup status as Information (backup job successful), warning (with exemptions), disaster (no backup in last 72 hours or backup failed)
2.Last log is shown in system status, whichever of them is in even log in last 24 hours.

So created template as follow on print screens below but they don’t work at all. Could you advise where I made a mistake please?

[johansen]

Hello,

What does that mean that it doesn't work at all? Do you see nothing in latest data or the trigger do not work?

I had a similar issue but I had a problem with zabbix agent (active) checks at all so can you double check that other zabbix agent active checks are working?
The hostname (not visilble name) in zabbix must match with the computername (case sensitive!) of the server you are trying to monitor.

[PiotrIr]

johansen,

Thank you for your reply. I've just realized the logs are coming so I can see them in "Latest data". They just don't display in "system status".

Could you advise how to get them displayed for around 24 hours please?

[johansen]

you mean system status in dashboard view?
This does only display current alerts but nothing in the past.
To see older alerts, either go to monitoring->latest data and enable filter view (7d,14d,1m,....) or go to monitoring->triggers and apply a filter as well.

[PiotrIr]

Hm, I had impression trigger correctly designed can show the item in system status. "Latest data" show only items so how can I check if trigger actually is working? How to correctly design the trigger to show status when event is present for 24 hours?

[johansen]

it depends. in case you have an eventlog check you have to check X number of lines depending on how many changes you have in your eventlog.

In the monitoring->trigger view you can filter to show anything happened with a specific servername in the past 24hrs or whatever you like.(this is where you normally look at the check the trigger )

within monitoring->latest data yes, you can also see items but in case for eventlogs as long as there is not text you check does either not work or there is no related eventID.

[PiotrIr]

Johansen,

Thank you for reply.

Possibly I wasn't clear enough. What I'm really looking for is status of last backup on Dashboard "System status" table. If it failed I want to see this as disaster. I don't want to go to any other option as we have many servers which take backup so it won't be practical.

[johansen]

First of all you need to be sure that your item works.
So we need to know if there is an output of the eventlog in latest data.
Can you send a screenshot of the related view?

[PiotrIr]

Yes, the item is working. Please see screen shot.

[johansen]

Ok now you need to force the backup to fail and check if the trigger is executed. Then the alert should be displayed within system status as well.

[PiotrIr]

Unfortunately this doesn't show. Looking at mine trigger you can see also successful backup should be shown but is not.

[PiotrIr]

Eventually I figured it out mine self.
If somebody needs to monitor backup exec triggers can look like:

Backup Exec - job completed successfully

{ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,34112,,].logseverity(0)}=1&{ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,34112,,].nodata(259200)}#

Backup Exec - job completed with exceptions

{ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,57755,,].logseverity(0)}=2&{ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,57755,,].nodata(259200)}#1

Backup Exec - job failed

{ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,34113,,].logseverity(0)}=4&{ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,34113,,].nodata(259200)}#1

Backup Exec - no backup for last 72 hours

{ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,34112,,].nodata(259200)}#0 & {ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,34113,,].nodata(259200)}#0 & {ACTIVE BACKUP EXEC:eventlog[Application,,,Backup Exec,57755,,].nodata(259200)}#0