Hello everybody!
I would like to introduce myself, here Daniel, sysadmin of a company in Andorra. I just received my ZCS and I'm struggling since a few days looking for a solution to a small problem, could you enlighten me with your wisdom?
I am trying to make a template to be able to monitor Veeam B&R results by reading the Windows eventlog. I've been trying two approaches, but I'm trying to do it in the most professional way possible.
Veeam stores the events I want to log through 4 eventid's (150, 190, 450 and 490), but each eventid has its own result in the description (Success, Warning and Failure).
I know both approaches may not be the best, but as I said I am still learning? could you please give me a hand?
Thanks!
I would like to introduce myself, here Daniel, sysadmin of a company in Andorra. I just received my ZCS and I'm struggling since a few days looking for a solution to a small problem, could you enlighten me with your wisdom?
I am trying to make a template to be able to monitor Veeam B&R results by reading the Windows eventlog. I've been trying two approaches, but I'm trying to do it in the most professional way possible.
Veeam stores the events I want to log through 4 eventid's (150, 190, 450 and 490), but each eventid has its own result in the description (Success, Warning and Failure).
- Option one (the easy one)
- Create an item for each eventid including the status:
- eventlog[Veeam Backup,(?i)Failed,,,^150$,,skip]
- And then 12 triggers (3 states x 4 eventids):
- find(/Veeam/eventlog[Veeam Backup,,,,^150$,,skip],1,"like","Failed")=1
- Create an item for each eventid including the status:
- Second option (the cooler way?)
- Create an item with all eventtids:
- eventlog[Veeam Backup,,,,^150|190|450|490$,,skip]
- And then the same 12 triggers, but with a double condition:
- logeventid(/Veeam/eventlog[Veeam Backup,,,,^150|190|450|490$,,skip],,"150")=1 and find(/Veeam/eventlog[Veeam Backup,,,,^150|190|450|490$,,skip],#1,"like","Failed")=1
- Create an item with all eventtids:
I know both approaches may not be the best, but as I said I am still learning? could you please give me a hand?
Thanks!
Comment