Setting up a trigger for events within a time period

[ZummiGummi]

Hello,

I'm setting up a template to monitor an event log entry for a Windows host using the active agent.

The item for the template is as follows.


The logs are being detected correctly.

What I would like to setup is a trigger if the event is logged, but only log this once since this event can fire continuously.

If no new events are logged in 1 hour, then the problem should be marked as resolved.

At the moment, each server is reporting the same error multiple times.

Is the problem expression correct? I'm not filtering the data, since I'm doing that in the item.

Is the recovery expression the correct way to make something OK or should it be in the problem expression? e.g. trigger warning if there is an event and it's less than 1 hour old? Once it's been over 1 hour and there are no new events, it gets marked as resolved.

Thank you for your time.

[ZummiGummi]

I unlinked the template and data, and added it back again, it's now reporting only a single problem per server now instead of multiple problems.
The problem expression was also changed to the below, but it's still reporting entries older than 1 hour as a problem and hasn't resolved.

{Template Module Windows event logs by Zabbix agent active:eventlog[System,,"Warning","Resource-Exhaustion-Detector",2004,].count(1h)}>5

Any ideas?

[ZummiGummi]

Thank you for your help splitek.
I've ended up with this trigger, so it will activate if there is an entry, but will resolve itself if no new events occur in 15 minutes. The error seems to be logged every 5 minutes.

{Template Module Windows event logs by Zabbix agent active:eventlog[System,,"Warning","Resource-Exhaustion-Detector",2004,].logeventid()}=1 and {Template Module Windows event logs by Zabbix agent active:eventlog[System,,"Warning","Resource-Exhaustion-Detector",2004,].nodata(15m)}=0

The only problem is that the trigger is based on the timestamp instead of the time of the event, so old entries are picked up, but are resolved after 15 minutes. Not sure there is away around that.

[MikeBrosas]

Hi, Any update about here? I tried to follow your config here, and I can also monitor the 2004, but the problem is, it only monitor once, after I upload the template it will show in latest data then send a triggers, but after that nothing happens next. It didnt show new latest data and didnt send a resolve triggers.

[MikeBrosas]

Hi, Any update about here? I tried to follow your config here, and I can also monitor the 2004, but the problem is, it only monitor once, after I upload the template it will show in latest data then send a triggers, but after that nothing happens next. It didnt show new latest data and didnt send a resolve triggers.