Windows eventlog (4800, 4801) monitoring and trigger

[alientm]

Windows event ID:

4801 The workstation was unlocked
4800 The workstation was locked


Key: eventlog[Security,,,,4800|4801]

Trigger now: {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4801)}=1

send me alert PROBLEM when workstation is unlocked - work fine.

I want that the problem go from PROBLEM to OK when workstation is now locked (ID=4800), how to do it ?

[DmitryL]

Hello alientm!

Try this trigger

({TRIGGER.VALUE}=0 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4801)}=1) or ({TRIGGER.VALUE}=1 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4800)}=1)

{TRIGGER.VALUE}=0 Trigger status Problem
{TRIGGER.VALUE}=1 Trigger status OK

[alientm]

Thank you for your answer.

when i use:

({TRIGGER.VALUE}=0 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4801)}=1) or ({TRIGGER.VALUE}=1 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4800)}=1)

Zabbix still displays the Problem (Problem does not change to OK when the workstation is locked (eventid 4800))

but when changed to:

({TRIGGER.VALUE}=0 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4801)}=1) or ({TRIGGER.VALUE}=1 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4800)}=0)

it seems that is working properly

but I do not know whether it is correctly ?

[DmitryL]

Hi!

Yes, your example is right, mine is not

Thing is that,

({TRIGGER.VALUE}=0 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4801)}=1) or ({TRIGGER.VALUE}=1 and {BS_VNC:eventlog[Security,,,,4800|4801].logeventid(4800)}=0)

If trigger.value = 0 ( off ) and eventid 4801 appears in eventlog - trigger fires

or

If trigger.value = 1 ( on ) and eventid 4800 appears in eventlog - trigger goes to OK state, because condition .logeventid(4800)=0 terms are not met.

[alientm]

thank You, without Your help could not do that