Monitoriza Event View for Windows with zabbix

[jjmanez]

Hello

I want monitorize the event log from a windows machine with zabbix, this is possible?

The idea is that when a warning or error event takes place, zabbix sends a mail to me.


thanks for all.

[ReeD]

http://www.zabbix.com/wiki/doku.php?...itoringwindows

[jjmanez]

event view monitorize

Thanks for its answer.

I don't understand the last part of the document, the utility Symantec Enterprise Vault is not free. It's not possible with free software?

I create ITEM, the TRIGGER, and the ACTION but doesn't show anything.

That I must make in the agent in the machine Windows so that send the events to the server zabbix?

greetings

[ReeD]

Be sure that on Windows machine zabbix_agentd.conf has the same "Hostname" defined as Host in Zabbix.

Try clear Eventlog on target windows machine and restart zabbix agent.

[jjmanez]

event view monitorize

This is my zabbix_agentd.conf in my windows machine:
Server=10.150.1.204
ServerPort=10051
Hostname=10.150.1.123
ListenPort=10050
StartAgents=5
RefreshActiveChecks=120
DebugLevel=3
PidFile=c:\tmp\zabbix_agentd.pid
LogFile=c:\tmp\zabbix_agentd.log
Timeout=3

When I start the service ZABBIX Agent the log is this:
5532:20071218:124710 zabbix_agentd started. ZABBIX 1.4.3.
2120:20071218:124710 zabbix_agentd collector started
4100:20071218:124710 zabbix_agentd listener started
5468:20071218:124710 zabbix_agentd listener started
1628:20071218:124710 zabbix_agentd listener started
3540:20071218:124710 zabbix_agentd active check started [10.150.1.204:10051]

In my server zabbix I add a computer with the parameters:
Name:alatar
DNSname:alatar.midominio.es
IpAddress:10.150.1.123
Port:10050
Status: Monitored
Link with template: Template_Windows

I recived a message with test unknown

[ReeD]

Server=10.150.1.204
ServerPort=10051
Hostname=alatar.midominio.es <---- That is the problem. Fix it. =)
ListenPort=10050
StartAgents=5
RefreshActiveChecks=120
DebugLevel=3
PidFile=c:\tmp\zabbix_agentd.pid
LogFile=c:\tmp\zabbix_agentd.log
Timeout=3

Ur "hostname" in agent config must match "DNS name" in item.

[jjmanez]

event view monitorize

sorry the correct parameters is:

DNS name: alatar.midominio.local

The server zabbix resolve perfect when I make a ping to the name alatar.midominio.local

[ReeD]

I mean, that IN YOUR zabbix_agentd.conf on Windows machine "Hostname" must match the "DNS Name" in zabbix item.

In your windows zabbix_agentd.conf:
Hostname=10.150.1.123(here is mistake)

And in item:

DNS name: alatar.midominio.local (here its allright)
--------------------
You must correct your zabbix_agentd.conf:

Hostname=alatar.midominio.local (allright everywere)

[jjmanez]

event view monitorize

Ok I change this and I clean the event view.

I uninstall de service ZABBIX Agent and reinstall whit the new values.

I restart the service ZABBIX Agent

My trigger:
({alatar:eventlog[System].logsource(W32Time)}=1)&({alatar:eventlog[System].str(synchronisiert)}=1)&({alatar:eventlog[System].nodata(30)}#1)

My Item:
with the ZABBIX Agent active
with the key eventlog[System]

My Acction:
event source: triggers
conditions: HOST = alatar
operations: send message to user admin
message: {alatar:eventlog[System].last(0)}

I don't recive anything.

[jjmanez]

monitorice evnet log

I now recive a mail when an error in the event view takes place.

The body of the message is unknown.

I need something to make in the machine Windows or the server zabbix.?¿?¿?

In the file /tmp/zabbix_server.lod shows the following one:

1956:20071218:135940 Host [alatar]: first network error, wait for 15 seconds
1956:20071218:135940 Parameter [perf_counter[\Physical Disk(_Total)\Avg. Disk Read Queue Length]] will be checked after 120 seconds on host [alatar]
1957:20071218:140416 Query returned empty result
1957:20071218:140416 Query returned empty result
1972:20071218:140856 Executing housekeeper
1972:20071218:140858 Deleted 0 records from history and trends
1972:20071218:150958 Executing housekeeper
1972:20071218:150959 Deleted 0 records from history and trends

but this problem isn't the error of event view.

not what to do.