Windows Account Lockout

[jwatson]

Hi,

On our windows server 2008 r2 we have a custom view log in our events log window. This is put event id 4740 (User Lockout) from Security log to a custom view named "Account Lockout".

Is there a way for me to create an item that get zabbix to get this custom view log entries?

In the past I did create a key with the follow statement "eventlog[Account Lockout,,"Information",,,,all] but wasn't getting any results. And the zabbix agent logs showed that the agent couldn't find the event log.

Here is what the agent log said =

active check "eventlog[Account Lockout,,"Information",,,,all]" is not supported: Unknown error.
cannot open eventlog 'Account Lockout':[0x00003A9F] The specified channel could not be found. Check channel configuration.

I did try another method by only getting the Security log by event ID but i am unsure if i got the key right "eventlog[Security,,,,^4740$]" but again not getting results.

Thanks in advance.

[jwatson]

Hey,

I have managed to figured the problem out. The key "eventlog[Security,,,,^4740$] works it just took time for the zabbix to gather data.

So I have changed the time frequency and it works perfectly.