Trigger for 50 Event Log errors within 5 minutes?

[Luli]

Hello, I want to create a trigger / alarm for a server that alerts us when there has been over 50 errors in the Application section of the Event Viewer.

Can you help me figure this out?

[cyber]

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent/win_keys#eventlog

https://www.zabbix.com/documentation/current/en/manual/config/triggers/trigger

https://www.zabbix.com/documentation/current/en/manual is your friend...

[Luli]

We came up with this trigger. Not entirely sure yet if it will actually work:

changecount(/RV Eventlog Errors/eventlog[Application,,"Critical|Error"],5m)>=50

[cyber]

"changecount - Number of changes between adjacent values within the defined evaluation period." I think that might work only if all your values are different. If you get 50 identical ones, it does not count as changed...
ordinary count() would work better I think...

Ideal would be to have eventlog.count() item.. like for ordinary logfiles..

[Luli]

We tried count first, but that produces false positive alarms for no apparent reason. So we tried switching to changecount.

Yeah, eventlog.count would've been nice.