Monitor Event Log for Event ID 208 and auto-close problem

[TheCookieMonster]

Im trying to monitor the Windows Event Log for Event ID 208

I have a Item:
Name: Event Log: SQL Server Agent
Type: Zabbix agent (active)
Key: eventlog[Application,,,,208]

Which looks to work as expected.

And my trigger is currently:
Name: Event Log: SQL Agent Job Failure
Problem expression: {Server01:eventlog[Application,,,,208].logeventid(208)}=1

My only problem is that I want this 'Problem' to be marked as Resolved in Zabbix pretty instantly, because there wont be a resolved entry in Windows Event Log for it to pick up on, does anyone know how I could do this?

[[email protected]]

I have the same problem. I have this

{SERVER1:eventlog[Application,,,,15007,,skip].logeventid(15007)}=1
and

Recovery Expression
{SERVER1:eventlog[Application,,,,15007,,skip].nodata(30)}=1 In my case the trigger stays forever as a problem, never getting resolved.

[kernbug]

Im trying to monitor the Windows Event Log for Event ID 208


My only problem is that I want this 'Problem' to be marked as Resolved in Zabbix pretty instantly, because there wont be a resolved entry in Windows Event Log for it to pick up on, does anyone know how I could do this?

Hi

You can use Zabbix API in conjunction of the ability to close problems manually from this document: https://www.zabbix.com/documentation.../manual_close3

[Yvan]

Hi,

for the items, do you select log or text ?
I got an error saying not supported but the info message display the event logs..

Thanks

[singk]

you can try and put in this the Problem expression and do not use Recovery Expression.

{SERVER1:eventlog[Application,,,,15007,,skip].logeventid(15007)}=1 and

{SERVER1:eventlog[Application,,,,15007,,skip].nodata(30)}=0

[Yvan]

Hi,
This works : {servername:eventlog[Application,,,,15004].logeventid(15004)}=1

i tried to add that in recovery expression :

{servername:eventlog[Application,,,,15005].logeventid(15005)}=1

but it doesnt detect it so incident didnt close.

Thanks for your help,

[sinefile1]

Hi! I know this is old post, but did anyone finds working solution on these issue?