Windows event Log - exception (not monitor specific error in Windows event log)

[mzeman81]

Hi,

please someone help me to make an exception for specific Windows event log error which generates our mailserver?
We don't want to monitor specific error in Windows event log


We turned of one specific service but other part of mailserver asking if the service is running. We want ta have the specific service turned off.
The other part of the mailserver find out that the service is not running and creates the Warning record in Event viewer.

I need to make an exception on addicted text "documents will not be indexed:" in "Operational data" in Zabbix field "Message/Command".
We don't know how to solve it.


Trigger is in attachment and the message also.

Thank you.

[andris]

Maybe item Preprocessing can be used with a step "Does not match regular expression."?

[mzeman81]

Yes, I put to "Expression" this:

{ZU_Windows_logs_error_15.3:eventlog[Application,,"Warning|Error",,,,skip].logseverity()}=2 and
{ZU_Windows_logs_error_15.3:eventlog[Application,,"Warning|Error",,,,skip].logeventid(^3$|^100$|^1011$|^1094$|^1530$|^12293$ )}=0


And it looks quite well. Is this what you ment "Maybe item Preprocessing can be used with a step "Does not match regular expression."?

[mzeman81]

Yes, I put to "Expression" this:

{ZU_Windows_logs_error_15.3:eventlog[Application,,"Warning|Error",,,,skip].logseverity()}=2 and
{ZU_Windows_logs_error_15.3:eventlog[Application,,"Warning|Error",,,,skip].logeventid(^3$|^100$|^1011$|^1094$|^1530$|^12293$ )}=0


And it looks quite well. Is this what you ment "Maybe item Preprocessing can be used with a step "Does not match regular expression."?"?

[andris]

Nice that you found a solution!
With preprocessing I meant what is described in https://www.zabbix.com/documentation...ssing_examples and https://www.zabbix.com/documentation...essing_details - to drop unwanted values, without storing them in Zabbix database.