EventLogs, Templates, Items, Triggers, Actions, and Emails

[bill.unger]

I have been wrestling with Eventlog monitoring for a couple of weeks now and am not having much luck. I am running Zabbix 1.4 on Ubuntu and here is what I have done so far:

- Created a new template called Template_WindowsRegistry

- Created 2 new items in template
Name: EventLog-Application
Type: Zabbix agent
key: eventlog[Application]
Type of Information: Log
note: left all other fields at default

Name: EventLog-System
Type: Zabbix agent
key: eventlog[System]
Type of Information: Log
note: left all other fields at default

- Created 2 new triggers in the template
Name: EventLog-SystemError
Expression: {Template_WindowsRegistry:eventlog[System].logseverity(4)}=4
<No Dependencies>
Severity: High
Comments: <Blank>

Name: EventLog-ApplicationError
Expression: {Template_WindowsRegistry:eventlog[Application].logseverity(4)}=4
<No Dependencies>
Severity: High
Comments: <Blank>

- Created 2 new actions as follows:
Name: EventLog-ApplicationError
EventSource: Triggers
Conditions: Trigger = "EventLog-ApplicationError"
Operations: Send message to user "Admin"
Message Subject: {TRIGGER.NAME}: {STATUS}
Message: {HOST} {TRIGGER.NAME}: {STATUS}

Name: EventLog-SystemError
EventSource: Triggers
Conditions: Trigger = "EventLog-SystemError"
Operations: Send message to user "Admin"
Message Subject: {TRIGGER.NAME}: {STATUS}
Message: {HOST} {TRIGGER.NAME}: {STATUS}

I then assigned the template to 2 windows servers and have been watching them for a couple of days. I seem to have 2 problems:
1. The triggers don't seem to fire consistently. UNLESS... will the trigger still fire if the subsequent error conditions are from the same source in the Event Log?

2. Even when the triggers do fire, it never sends an email message.

Any thoughts, suggestions, or offers to give me a labotomy would be very much appreciated!

tia,
Bill

[bill.unger]

Time for an update:

- I upgrade the zabbix install to v1.4.4 and still no go.

- If I view Triggers under the Monitoring section for a particular host, they triggers are listed (I assume because they have fired?)... but their Status is FALSE.

- Still no listing whatsoever under Actions...

tia,
Bill

[bill.unger]

Someone please help?!

[trikke]

Hi,

Don't know if it's a Typo, but try: Type: "Zabbix agent (active)"

Also my key is: eventlog[Application,Error] or eventlog[Application,Warning] if u already want to narrow it down at the Item level !!!

Trigger and actions seem to be OK!

Hope this will help u,

greets
Patrick

[bill.unger]

Don't know if it's a Typo, but try: Type: "Zabbix agent (active)"

It actually wasn't a typo, I had selected the wrong type! Unfortunately, no actions/emails are sent even after the change. I can see a trigger being generated (see below), but nothing is in the Actions view and no entries are in my sendmail log.

I should also note that Status is always FALSE and never changes, even when the trigger fires or has fired..

[trikke]

Yes the Status does stay as False, but my actions are being fired ( ok I fire on Status False und Status True).

The Reason of this Trigger status staying on False might be, that there is no "Corresponding True Message/Trigger" on a Logfile Entry. Logfile monitoring as somewhat different then traditional Threshold Monitoring!


Greets
Patrick

[bill.unger]

Patrick - do you have any of the configs (items or triggers) in a template? I am wondering if that isn't causing some issues for as both the items and the triggers are defined in a template, and then the template is assigned to various servers...

[trikke]

Hi bill,

yes those are in a Template. I exported the Template (triggers and items), maybe it's to any help to u,

Greets
Patrick

[bill.unger]

Hi bill,

yes those are in a Template. I exported the Template (triggers and items), maybe it's to any help to u,

Greets
Patrick

Holy crap!!! Those worked!!! I have no idea why those did and mine didn't, but I don't care... as long as it's working!

I do have a question about your Action though - what are you sending through in the message body to have more detailed information?

Thanks again for all of the help!!!

[trikke]

Hi Bill,

happy it works!!!

Here is what i have in my actionmessage : {TRIGGER.SEVERITY},{TRIGGER.NAME},{TRIGGER.KEY},{{ HOSTNAME}:{TRIGGER.KEY}.last(0)},{{HOSTNAME}:{TRIG GER.KEY}.prev(0)}

I have only 1 action, which sends this information to an EventManagement and Alarming Tool. So this is quit a generic message.

I also use this as a Subject:{HOSTNAME}.{TRIGGER.ID}.{TRIGGER.VALUE}
this indicates which host send a message and if it's a "raising" or "falling" issue!

Greets
Patrick

[bill.unger]

Patrick -

I am having an issue where the trigger won't fire more than once if an event log error occurs again. I am guessing this is because the previous trigger fire is still showing TRUE, but there doesn't seem to be a way to reset it.

Any thoughts?

By the way... thanks again for the help!
Bill

[noxis]

I'll add my thanks as well, imported the template and saved me a few hours of research/work

[trikke]

Sorry bill,
can't help u there. I switched to zabbix 1.5 (Agent and server) and I know (reading from the change log) that things have changed concerning Eventlog "handling".
But just to check, do u get the "new"/latest Event in your "Latest values/data" History. Just to be shure the event actually reaches the Server ;-)

sorry & greets

Patrick

P.S. hope someone else will be able to help u!!!

[fredfire]

I have this error in my server log agentd 1.4.4 :

3676:20080307:132840 zabbix_agentd active check started [10.131.56.26:10051]
3704:20080307:133000 Call to PdhCollectQueryData() failed: 3. MSG 0x00000102 - Unable to find message text [3. MSG 0x0000013D - Unable to find message text [0x57]]
3796:20080307:133001 PdhLookupPerfNameByIndex failed: The wait operation timed out.


I used the template provided on page 1.

That's installed on a windows 2000 server. I have no problem with my server 2003.