Need help with Absence of EventLog eventID generation Item/Trigger creation

[rhin0stopp3r]

Hello,

I need to monitor Eventlog in windows for event ID 2102 ( Event Viewer: "Application and Services Logs>Microsoft>Windows>DriverFrameworks-UserMode> "Operational), and if a new event for eventID 2102 hasn't been generated in before 7 days, trigger.
how can I go about making both a item to monitor, and trigger to send alert??

I've already tried adding the item to the Windows by Zabbix agent template, and then tested disconnecting. I see an eventviewer log created, but Zabbix doesn't see it with the settings in the attached images below. Anyone have an idea??

[PeterZielony]

Try turning remote commands on agent to be allowed.
AllowKey=system.run[*]

If you don't want to have it then you can setup windows scheduler to trigger it for this Event ID and pass execute process zabbix_sender to send info to trapper in zabbix
action for it like

program/script:
cmd.exe

args:
/E:ON /C "cd /d "C:\Program Files\Zabbix Agent 2" && zabbix_sender --config "zabbix_agent2.conf" -k winbackupAzure.status -o "Finished successfully""


For missing data (or absent in this case) you can use
nodata(/host/key,sec,<mode>)


https://www.zabbix.com/documentation...history#nodata

For example for missing Azure backups for 7 days (in template):
nodata(/Agent Trapper Windows Backup/winbackupAzure.status,604800s)=1