Trigger fire only when certain IP address is in Windows event id 21 logs

[vijayk]

I have created the Item in Zabbix on default Windows by Zabbix agent template to get the logs from Event ID 21.
And also created the Trigger with
Expression: logeventid(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip]**)=1 and nodata(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip],20)**=0.

This is working fine.

Now I need that Trigger only fire when the IP address of Event Log 21 is not within the local network range IP.

How can I do it?

[vijayk]

Configured the find function as below but not fire the trigger. Is there anything missing?

Trigger Expression : find(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip],,"iregexp","@LocalIP")=0

Note: LocalIP is global regular expression.

[Hamardaban]

Use the FIND function and react to the absence of a line with a local network address.

https://www.zabbix.com/documentation/current/en/manual/appendix/functions/history#find

[vijayk]

Configured the find function as below but not fire the trigger. Is there anything missing?

Trigger Expression : find(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip],,"iregexp","@LocalIP")=0

Note: LocalIP is global regular expression.

[Hamardaban]

I'm not sure if you need to use double quotes around the global regex and I can't say anything more without seeing the global regex itself.

[vijayk]

That filled automatic during the construct the Expression via Add button.

Here is my Global Regx:

Name: LocalIP

1 ⇒ ^192\.168\.(168\.([1-9]|[1-9]\d|[12]\d\d)|175\.([1-9]?\d|1\d\d|2[0-4]\d|25[0-4])|(169|17[0-4])\.([1-9]?\d|[12]\d\d))$ [Result is TRUE]

[Hamardaban]

Everything seems to be fine...
Can you give an example from the "latest data" containing an "incorrect" address?

[vijayk]

Bingo..!!! It's works...I have just checked with incorrect address... Thanks Hamardaban...

Can you please help me on one more query? The status of the trigger is remain as Problem. How can I change it with Resolved?

[vijayk]

It's resolved with nodata function. Thanks.