Monitor Windows event logs

[amitshmil]

Hi,
I'm trying to monitor a Windows 2008 Domain controller for specif event id

I want to to fire alarm when event 13508 occurs on the server but clear the alarm when 13509 occurs (this event says that everything is fine).

is it possible?

[alientm]

For me it works something like this:

Items:
Name: PC unlock
Type: Active
Key: eventlog[Security,,,,4800|4801]
Type of information: log

Triggers:
Name: Dektop unlock !
Expression: ({TRIGGER.VALUE}=0 and {PC_NAME:eventlog[Security,,,,4800|4801].logeventid(4801)}=1) or ({TRIGGER.VALUE}=1 and {PC_NAME:eventlog[Security,,,,4800|4801].logeventid(4800)}=0)

[onallion]

Just trigger when event 13508 occurs, and then use recovery expression to recover only when event 13509 occurs. Easy as pie

[amitshmil]

Let me try that...

[emz]

What about the following trigger:

eventlog[System,,"Error",,^6008$,10,skip].logeventid(^6008$)}=1 and eventlog[System,,"Error",,^6008$,10,skip].nodata(300)}=0

I face the following issue - if I use nodata(300)}=0, the trigger is not activated at all. If I use nodata(300)}=1, the alarm never disappears (no recovery).
Can you recommend how to deal with the situation?

[Cpt. Lunchbox]

emz

Give this a try:

.nodata(300[B]s[/B])}=0 or .nodata([B]5m[/B])}=0

Worked for me

[emz]

Yes, thank you! I get the result I want!

[Mitesh Patel]

Can you please help me regarding how to windows server event viewer log monitoring in Zabbix server.