Windows event 4672

[klarter]

I am trying to capture privileged logins to Windows 10. I am using items constructed thus:
item Name-- LogEvent 4672
type -- Zabbix agent(active)
key -- eventlog[Security, Information,,4672,,all]
trigger name -- {HOST.NAME}Event 4672
expression -- {MSEBCADMSMB001:eventlog[Security,,Information,,5672,,all].last()}=4672
I do not get any action when I login to that computer as a privileged user.
Logs tell me that I have an unsupported item key.
Probably an error in syntax for the item.
Please help.

[tim.mooney]

It seems like you have probably have multiple typos in the information you provided. The "key" you show doesn't match the item part of the expression in 2 different ways:

1. Information is in a different field (2nd field in key, which is probably wrong, but 3rd field in the item part of the expression, which is probably correct)
2. the item part of the expression uses 5672, not 4672.

So, which one is actually what you're using?

Also, what happens if you anchor the regular expression for the event id, changing it to: ^4672$

Finally, the last() function probably returns the entire event, not just the event id, so matching just against 4672 likely won't happen. You probably want to look at a different trigger function. It appears that logeventid() might be exactly what you want (not sure, have not used it), but if it's not, either str() or regexp() allow you to match on partial strings in item data.

[klarter]

Sorry, I see the typos and here is what I really have:
key -- eventlog[Security,,Information,,4672,,all]
trigger name -- {HOST.NAME}Event 4672
expression -- {MSEBCADMSMB001:eventlog[Security,,Information,,4672,,all].last()}=4672
will try logeventid().
thanks

[klarter]

I have tried the following with no good result.

Key event4672 eventlog[Security,,Information,,^4672$,10,all]

Trigger 1

{MSEBCADMSMB001:eventlog[Security,,Information,,^4672$,10,all].str(4672)}=1

Trigger 2

{MSEBCADMSMB001:eventlog[Security,,Information,,^4672$,10,all].logeventid(4672)}=1

Any more ideas?

[klarter]

My event expression started to work when changed to
event4672 eventlog[Security,.,,^4672$]
I think "Information" was not proving true in the expression.
I cannot seem to formulate a trigger which will fire more than once (or have I stumbled on the right expression and then undone it?).
I can see the item captured in the "latest data" window.