Monitoring Windows Event ID's

[hodoros]

I'm having issues monitoring windows event ID's:
For a simple example I want to monitor user account creation which is ID 4720.

ITEM
Type: Zabbix agent (active)
Key: eventlog[Security]
Type of Information: Log

TRIGGER
Expression: {Template Windows Security.eventlog[Security].logeventid(4720)}

PROBLEM
This works if and only if the last log that was generated in the Security.evtx had the event ID of 4720. If an account was created, then a user changed their password(which creates another event ID) before the zabbix agent was queried it won't trigger.

Does anyone have a solution?

[shamrock20]

Have you set the event generation mode to multiple on the trigger ?

[AlyssaKane]

set to multiple in the trigger from event generation mode and then check.

[hodoros]

Thanks for the suggestions - Unfortunately no this didn't work. I think tjhe problem stems from how the trigger logeventid() works, "Event ID of the last log entry matching regular expression T" So whats happening here is I'm collecting the entire Security event log, every ~15m and then I only trigger on whatever the last log happens to be in that list and ignores the rest of it.


Another problem I'm having is if by chance I actually do manage to trigger on the event I wanted, again going with example of an account creation of 4720 - Once it polls/checks again, because that logid won't be at the top of the list the second time it will conclude that the problem has resolved and close out.

I'm not sure if theres a great solution for this simply because of how logeventid() works. I may have to use a different trigger function.