Windows Event Viewer - Email Alert

[cjwallace]

Guys.

Ok so i am on the right path i feel now. I have Zabbix installed under Ubuntu and things are starting to look good. I finally have zabbix doing what i want apart from this small issue

I have an item that is checking the Windows Security Event Logs

eventlog[security]

Type Log

And i have a trigger

{LNDC02:eventlog[security].str(Security Enabled Global Group Member Added)}=1

Now i if i add a user to a domain group i can see Zabbix is picking this up and is alerting me to the fact.....Great this is what i have been trying to do for a month now.

Now what i would like to happen is for Zabbix to email me the compleate Windows Event for that item for example this is what i see in the latest data and i would like this to be sent to me via email

2008-10-18 15:29:32 1224340172 Security Enabled Global Group Member Added:

Member Name: SOME TEST USER NAME

Member ID: %{S-1-5-21-2338766963-1452910375-1844977326-11951}

Target Account Name: SECURITY GROUP THAT WAS CHANGED

Target Domain: DOMAIN NAME HERE

Target Account ID: %{S-1-5-21-2338766963-1452910375-1844977326-1293}

Caller User Name: USER WHO CHANGED THE GROUP

Caller Domain: DOMAIN NAME HERE

Caller Logon ID: (0x0,0x821A7)

Privileges: -

Can someone please help me fix this last little problem as i am now so dam close

Thanks

Craig

[cjwallace]

Guys.

Still cant get this to work.

I thought {ITEM.LASTVALUE} would work and it almost does.

I am monitoring the Security event log. Say my trigger goes off at 13:30 now between that time and when the email is sent if more item hit the security event and i use {ITEM.LASTVALUE} then i get in the email that item and not the information want from what caused my trigger to go off.

Can anyone please help me as i am so close to having this working

Craig

[cjwallace]

Guys.

Anyone confirm if the above is possible?

Craig

[[email protected]]

I can confirm that. Found several similar issues in the forum.
I consider this a bug.
Don't know if there are any plans to fix ?
Alexei ?