Ad Widget

Collapse

How to set up trigger for Windows User sign in and sign out

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Person
    Junior Member
    • Apr 2025
    • 14

    #1

    How to set up trigger for Windows User sign in and sign out

    Hello,

    I'm still rather new to Zabbix and was trying to set up triggers for when a user signs into and out of windows I have already created the items for this and they are working.
    So far I have been using this expression to try and get notifications.
    Name: User sign in
    Severity: Information
    Expression: change(/Template name/eventlog[Security,,,,4624,,])>=1
    Name: User sign out
    Severity: Information
    Expression: change(/Template name/eventlog[Security,,,,4634,,])>=1
    I was able to get it to send an alert that a problem has been started but then it will not send any other notifications after that, I was able to go in and manually resolve the issue.
    I was wondering if there is a better way of setting up these triggers.

    Thanks
  • cyber
    Senior Member
    Zabbix Certified SpecialistZabbix Certified Professional
    • Dec 2006
    • 4841

    #2
    If you want one trigger to close another, you should probably look for Event Correlation. Tag your evnts properly and set up correlation.

    Comment

    • Person
      Junior Member
      • Apr 2025
      • 14

      #3
      Hi

      I have been messing around with the triggers and Event correlation like you recommended and now I have the an issue when create the first trigger and it creates a problem and then after I trigger it again in order to resolve the problem
      Zabbix will immediately create another problem as soon as I resolve first one, I have since disabled the event correlations that I created and deleted and recreated the triggers from scratch.
      I'm sure it is probably something I did when messing around with the trigger and Event Correlation any ideas no how to fix it or better ways to set up the triggers and event correlation to work together?

      Thanks

      Comment

      Working...