Windows Event Log Trigger Expressions

[csmall]

I am configuring a trigger for a windows event log entry and I am a little confused.

My goal is to get a single alert each time the event is detected in the log so I do not get overwhelmed with alerts.

This is what I have configured so far.

{servername:eventlog[System,,Warning,Tcpip,4231,,skip].logseverity(0)}=2 and {servername:eventlog[System,,Warning,Tcpip,4231,,skip].nodata(180)}<>1

I tested it by manually creating an entry that matched in the event log and it fired and sent me an email. I went and manually closed the problem. But then it fired again a couple of minutes later and auto closed. This time with manual closing greyed out.

Am I configuring this trigger correctly or is there a better way?

[csmall]

If it is (auto) closed already, then what do you want to close?

The first time it fired I acknowledged and manually closed it. Then it fired again, without a new entry in the event log. The second time it fired it auto closed and the option to manually close it was greyed out. I'm trying to understand this behavior and also understand if my trigger expression is correct.

[cyber]

If it is (auto) closed already, then what do you want to close?

[cyber]

If you manually close a problem, when problem condition is still true, it will fire again. I suppose if your manual close option was greyed out, it was already (auto)closed at that moment.
about your expression... I think first part is completely unnecessary... item already checks for "Warnings" so checking with logseverity is always true, I guess... the other half (nodata()) keeps your trigger active until there is no new values for 3 minutes (180 sec).