Monitor Custom view from Event Viewer

[Jeff54]

Hi everyone,

I would like to sort Event system that I receive from a server with a Custom view on the Windows Event viewer, in order to only receive System data that I want (Error and Criticial).
I know that I can filter with an Item on the Template but I would like to just send the data that I want from the proxy to the server, and not send evrything and filter on the server.

I simply created a custom view to display the errors (that is functionnal), but It return the error : "EvtQuery channel missed:[0x00003A9F] The specified channel could not be found"




Hope that someone could help me.

Regards,

Jeff

[Markku]

a Custom view on the Windows Event viewer, in order to only receive System data that I want (Error and Criticial)

I think you should use the actual event log name and then use the severity filter in the eventlog item, instead of a custom view:

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent/win_keys#eventlog

Markku

[Jeff54]

Hi,

Thanks for you answer.
I know, but I want to only have, for example, the error on the System Event viewer, and not touch to the default System Windows Logs define in the system.
I find that weird that it's so difficult to collect a custom view.

If someone have an idea how to do that.

Regards

[Markku]

I'm not suggesting you edit anything in the Windows side. When you look at the eventlog configuration options (linked above), you'll see that you can filter the Error and Critical events in the item. That filtering happens in the agent.

eventlog[System,,"Error|Critical"]

But maybe I misunderstood something that you are trying to achieve?

Anyway, the custom views seem to be a feature of the Event Viewer application, not of the Windows event logging system, so that's why Zabbix agent has its own filtering.

Markku