eventlog item returning more than specified event id

[scorbin]

I am trying to monitor Windows event log to trigger on filesystem errors. The event ID for this is 52. It works, but it also returns event id 521 as well. My item is configured as below:

Item configuration:



The question is how do I get it to return ONLY event id 52. I have tried with and without quotes to no avail.. As per the manual it seems that it should return only event id 52 unless I use some form of regex.


Here is an example of an incorrect event id being picked up


Here is an example of a correct event id being picked up


These are different hosts but use the same item from the same template.

[gofree]

play with https://regex101.com/
eventid - regular expression describing the event identifier(s) - read docu ore carefully youll see some examples. guess your solution will be ^52$

[scorbin]

Thanks a lot gofree. That looks like it will definitely work. I just figured that it would only trap that exact event id by default and thought maybe I was doing something wrong.