Monitoring Windows Updates via Event Log

[Tux Linuxson]

I would like to monitor Windows Updates via the Event Log and i have created the following trigger condition.

logeventid(/Windows by Zabbix agent/eventlog[Microsoft-Windows-WindowsUpdateClient/Operational,,,WindowsUpdateClient,26,,skip],,"[1-9] Updates")=1

Does anyone have an idea why it doesnt work ?

Thank you.

[cyber]

You are picking up events with eventid 26 and then you are trying to compare that to "[1-9] Updates". It will never match... 26 <> "[1-9] Updates"

logeventid (/host/key,<#num<:time shift>>,<pattern>)

Checking if event ID of the last log entry matches a regular expression.

[Tux Linuxson]

Ah okay, thanks for the explonation. The eventid that i am trying to track also triggers if there is no update available. Is there a way that it only triggers if there isnt the following phrase "0 Updates"

[cyber]

https://www.zabbix.com/documentation/6.0/en/manual/appendix/functions/history

find (/host/key,<(sec|#num)<:time shift>>,<operator>,<pattern>)