Windows Event Log Unique Triggered Problems

[jwrober]

Hi all, I'm new to Zabbix. I'm running a newly installed v7.4.15 setup on a CentOS Stream 10 Linux VM. I am wanting to use the windows agent to capture windows event logs. In the "Windows by Zabbix Agent Active" template I have created 3 new items with the following code:

Name: Application Event Log Events (Critical/Error/Warning)
Key: eventlog[Application,,"Critical|Error|Warning",,,,skip]

Name: Security Event Log Events (Critical/Error/Warning)
Key: eventlog[Security,,"Critical|Error|Warning",,,,skip]

Name: System Event Log Events (Critical/Error/Warning)
Key: eventlog[System,,"Critical|Error|Warning",,,,skip]

I then created three triggers to log problems on the console:

Name: Windows: Event Log: Application (Critical / Error / Warning)
Expression: length(last(/Windows by Zabbix agent active/eventlog[Application,,"Critical|Error|Warning",,,,skip]))>0
Ok Event Gen: None
Problem Event Gen Mode: Single
Allow Manual Close: Yes

Name: Windows: Event Log: Security (Critical / Error / Warning)
Expression: length(last(/Windows by Zabbix agent active/eventlog[Security,,"Critical|Error|Warning",,,,skip]))>0
Ok Event Gen: None
Problem Event Gen Mode: Single
Allow Manual Close: Yes

Name: Windows: Event Log: System (Critical / Error / Warning)
Expression: length(last(/Windows by Zabbix agent active/eventlog[System,,"Critical|Error|Warning",,,,skip]))>0
Ok Event Gen: None
Problem Event Gen Mode: Single
Allow Manual Close: Yes

The challenge I have is I am getting problems for new log events associated with closed/resolved problems. Here is a sample. The original event was for a DLL not have perfmon data. I acknowledged it with some update entries

and closed. Then today it "came back" with this new event that isn't a repeat of the first one.

Is there a way to change the trigger to add some kind of unique values to the problem so as I resolve things Zabbix finds, it doesn't bring back old problems as new?

Thanks in Advance

[cyber]

if you really "closed" the problem. ,it should not come back ever... There is no such feature to reopen any closed event. Suppressing is not closing...
you also have

Ok Event Gen: None
Problem Event Gen Mode: Single

Shouldnt you have event gen mode "Multiple" to have separate problem for each found line?

[jwrober]

Good point on the suppress vs close. However that isn't really the issue. The suppressed problem event was for a different event entirely, so why would it come back up? That's effectively the crux of my question. I'll give the event gen mode: multiple a try as well.

[thetinkergnome]

I close the Windows events after 60 seconds. I manage their history from an email folder rather than by looking at the Zabbix dashboards.

Here's a template I did over a decade ago. There are probably better weays to do this now, but it still works. It essentially uses a nodata(60) statement in the trigger so that after 60 seconds the trigger is no longer a problem, so it resolves.
https://github.com/TheTinkerGnome/zabbix/blob/master/templates/Windows-Eventlogs/zbx_eventlog_template.xml