Cannot get preprocessing for item eventlog in Zabbix 7.2 to work

[luca.cavana]

Hello,

I'm trying to have Zabbix ignore a value by using a preprocessing rule in Zabbix 7.2.

I'm collecting (by using a trigger defined in the AD DS Health and Perfomance template) all of the Events with a severity warning and error from an Event Log channel in Windows; like this: eventlog[DFS Replication,,"Warning|Error"]. So far, so good.

What I was not able to do is to have the item ignore the events that are generated every time a backup is running, as they are warning events and fall into the item scope.
All of these events contains a specific text so they are easily identifiable.

This is the event value I want discarded:
""
The DFS Replication service is stopping communication with partner %Server_Name% for replication group Domain System Volume due to an error. The service will retry the connection periodically.



Additional Information:

Error: 9036 (Paused for backup or restore)

Connection ID: CA9134E1-29DA-43FA-8E97-7E771DD25919

Replication Group ID: 28129658-A290-4F29-A803-43838FF6CD80
""

This is the preprocessing rules I've been using:
Name: Does not match regular expression
Parameters: .*Paused for backup or restore.*
Custom on fail: discard value

When I test the item it looks like it correctly discards the value, but then on the monitored hosts these events are still collected and firing the relevant triggers.

Can anybody help me in understanding where I'm wrong?

Thank you,
Luca

[bbonno]

This sounds odd. Are you sure your triggers are based on the items that have this preprocessing, and not a master item to the one with these steps?

The documentation for preprocessing details clearly states triggers should be processed after, so I imagine that there is an oopsie somewhere. Your description is sound, but you should try checking thats its NOT working in a different way.

It sounds like you are applying this to lots of hosts at once... if there is Discovery involved, then you should run it again manually before checking that your changes are ok..

[luca.cavana]

if there is Discovery involved, then you should run it again manually before checking that your changes are ok..

Thank you for the suggestion, after I waited some I could see that the items were not collecting the unwanted log entry.
Probably I just had to rerun the discovery as you stated; I'm quite new to Zabbix and I didn't see that possibility.

[bbonno]

Yeah, templates and discovery make zabbix very mighty, but the complexity that comes from it makes it harder to check things. Also, setting good discovery intervals is surprisingly hard. I previously had some that only ran once a day... until i realised that once an hour is slow enough to be easy on performance, and I do actually like new things to appear soon.