Windows Eventlog Monitoring

[jay]

Hi everybody,

I'm a newbie on Zabbix and very bad in english, so be kind ;-)

I have several home made script (in VBS) that runs on my servers and workstations and information/warning/errors are written on a custom windows event log. It works fine!

Now I would like to retrieve some of this event on Zabbix to be informed of the problem through a triggers.

I am able to retrieve all my custom windows event log on Zabbix and to create a simple trigger (specific source and only warning event) :

{Template_Windows_Servers:eventlog["customeventlog"].logsource("source")}&{Template_Windows_Servers:ev entlog["customeventlog"].logseverity(2)}=2

-How can I specify an Event ID in the trigger (like eventlog["customeventlog"].eventID(300))
-If My vbs script write 3 warning event in 5 second for exemple. I received only 1 alert. How can I do to receive 1 alert per event?
-The alerts doesn't disappear after I acknowledge them. I have to create a new event in the event log that doesn't match the trigger to do that.
-How can I use event information in the alert?


Thanks in advance for you help

Jay

[jay]

Up! need help ;-)

[jay]

Anyone could help me please?

Thanks in advance and best regards

Jay

[jay]

up! I didnt't find any good solution for the moment!

Jay

[Robert Wagnon]

Not possible

I've been trying for years. Zabbix doesn't support Event IDs.

[jay]

Hi,

Thanks for the answer but It's not a good news! anybody use zabbix to manager home made script that running on servers? If yes, how do you do that?

Regards

Jay

[trikke]

Hi,

There are different possibilities:

1. use zabbix_send instead of logging to a windows Log
2. use Custom Agent items by letting your scripts print on STDOUT and get the response
3. use system.run[<vb-script_here>] and parse stdout
4. write a id to your eventlog text and put trigger on:
{Template_Windows_Servers:eventlog["customeventlog"].logsource("source")}&{Template_Windows_Servers:ev entlog["customeventlog"].logseverity(2)}=2 & {Template_Windows_Servers:eventlog["customeventlog"].iregexp(<your RE>) =1

just try some of those, be creative and check to manual for possibilities

Greets
Patrick

[zalex_ua]

-How can I specify an Event ID in the trigger (like eventlog["customeventlog"].eventID(300))
Jay

https://support.zabbix.com/browse/ZBXNEXT-448 created. Feel free to vote

-The alerts doesn't disappear after I acknowledge them. I have to create a new event in the event log that doesn't match the trigger to do that.
Jay

No solution now IMHO, but i want to seriously ask the developers to implement this.

-How can I use event information in the alert?
Jay

{ITEM.VALUE} or {ITEM.LASTVALUE} macros

[Robert Wagnon]

Now supported

BTW, with version 1.8.5, this is supported. Yea!

[zalex_ua]

Yes, trigger function logeventid() already is implemented and available starting from version 1.8.5
Thanks for all developers !!!