Ad Widget

Collapse

Trouble with Windows Eventlog Triggering

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • AJW
    Junior Member
    • Jul 2022
    • 5

    #1

    Trouble with Windows Eventlog Triggering

    Having some issues with getting a trigger to work as I would like for Windows Eventlog check
    Every day a script is run that will put 'x' number of entries into a windows eventlog and I need to create a problem for each one of these entries and then automatically resolve these after 1 hour (could be any value really as long as less than 24 hours)
    I've created a test scenario the same as the one that does not work as I want and this is below;
    Item = logeventid(/999 - Windows Eventlog Testing/eventlog[Application,,Information,ZabbixTest,^(987)$,,skip])=1
    Currently set to Update Interval as 10 minutes

    By using 'eventcreate' I can simulate what is being created and test the trigger
    Trigger = logeventid(/999 - Windows Eventlog Testing/eventlog[Application,,Information,ZabbixTest,^(987)$,,skip])=1 and nodata(/999 - Windows Eventlog Testing/eventlog[Application,,Information,ZabbixTest,^(987)$,,skip],10m)=0

    What happens is, even though the latest data shows only (eg) 10 entries created in the eventlog, problems are repeatedly created (the same 10 over) until the 10m in the nodata part expires. If this was say 20m, then it would keep happening for 20 minutes and so on.
    The problems do not resolve after this time either.

    Tried all sorts of permutations, and looked at the different examples and nothing seems to want to give me what I am looking for

    Any suggestions and assistance greatly appreciated
  • cyber
    Senior Member
    Zabbix Certified SpecialistZabbix Certified Professional
    • Dec 2006
    • 4807

    #2
    nodata() is recalculated every 30 seconds, IIRC, so if you have "Multiple problem generation" allowed, then with each recalculation you will have another set of problems created.
    But I am still too much in vacation mode to give any suggestions.. :P

    Comment

    • AJW
      Junior Member
      • Jul 2022
      • 5

      #3
      Thank you for the explanation with the nodata() - didn't realise this. Explains the multiple repeat events. We have the Zabbix Console working in a lights-out scenario where effectively no one would be watching the problems, so they build up over time (every day, repeating) unless someone goes in and manually resolves them.
      Have now tried JSON suggestion here; https://blog.zabbix.com/close-proble...bix-api/12461/
      However, this does not resolve the problems (copied verbatim from blog) - it does trigger, just problem does not resolve
      Then, I have read somewhere that you cannot update a problem via the API

      Comment

      Working...