I having a strange problem with windows log monitoring.
I followed the "cook book" to create windows log monitoring system, and it woks for most part, except I do not get emails when there is a problem:
Here is the configuration:
Item:
Type "Zabbix Agent (active)"
key "eventlog[application]"
Type of information "log"
Trigger:
({Template_Windows:eventlog[application].logsource(SMVI)}=1)&({Template_Windows:eventlog[application].str(ERROR com.netapp.smvi.task.vmware.snapshot.VmSnapshotCre ateDelay)}=1)&({Template_Windows:eventlog[application].nodata(30)}#1)
Action:
Subject {TRIGGER.NAME}: {STATUS}
Message {HOSTNAME}: {ITEM.LASTVALUE}
Conditions Host = srqsanmgmt AND Trigger value = "PROBLEM"
Trigger works, but actions do not. Here is what I see in under Events:
009.Jun.11 11:05:12 srqsanmgmt: VMWare Snapshot did not compelete sucsesfully OK High 56m 30s No
-
2009.Jun.11 11:05:12 srqsanmgmt: VMWare Snapshot did not compelete sucsesfully PROBLEM High 0s No
-
If you notice, both of these events happen at the same time, and I believe that's the problem. The trigger supposed to set to "PROBLEM" when there is new data within 30 seconds, and set to "OK" where no new events are detected.
However, in this case, it sets to "PROBLEM", and then get set back to OK right-away, so action never get a chance to be kicked off.
What I am missing?
I would appreciate any help!
----------------------
Zabbix 1.6.4
80 clients
----------------------
I followed the "cook book" to create windows log monitoring system, and it woks for most part, except I do not get emails when there is a problem:
Here is the configuration:
Item:
Type "Zabbix Agent (active)"
key "eventlog[application]"
Type of information "log"
Trigger:
({Template_Windows:eventlog[application].logsource(SMVI)}=1)&({Template_Windows:eventlog[application].str(ERROR com.netapp.smvi.task.vmware.snapshot.VmSnapshotCre ateDelay)}=1)&({Template_Windows:eventlog[application].nodata(30)}#1)
Action:
Subject {TRIGGER.NAME}: {STATUS}
Message {HOSTNAME}: {ITEM.LASTVALUE}
Conditions Host = srqsanmgmt AND Trigger value = "PROBLEM"
Trigger works, but actions do not. Here is what I see in under Events:
009.Jun.11 11:05:12 srqsanmgmt: VMWare Snapshot did not compelete sucsesfully OK High 56m 30s No
-
2009.Jun.11 11:05:12 srqsanmgmt: VMWare Snapshot did not compelete sucsesfully PROBLEM High 0s No
-
If you notice, both of these events happen at the same time, and I believe that's the problem. The trigger supposed to set to "PROBLEM" when there is new data within 30 seconds, and set to "OK" where no new events are detected.
However, in this case, it sets to "PROBLEM", and then get set back to OK right-away, so action never get a chance to be kicked off.
What I am missing?
I would appreciate any help!
----------------------
Zabbix 1.6.4
80 clients
----------------------
Comment