Unable to get eventlog key working on Zabbix 2.0.2 and Ubuntu 12.04

[Ksloan]

Hey hopefully someone has a solution to this. I've been trying to get systemlog working on Windows 7 64bit, but keep getting a "zabbix not supported" status and under the error column it reads "ZBX_NOTSUPPORTED". I tried the same thing with Windows XP 32bit - I don't get any errors in the WEB UI, but none of the event logs are showing.
I've tried using eventlog[system], eventlog[application], and eventlog[security] to no avail. All of the other keys I've tried work perfectly, I just can't get this active check working (I haven't tested any other active checks yet). the type column has been set to Zabbix agent (active) for all of them. If anyone has any information or could point me in the right direction, I'd greatly appreciate it. I can post logs or config files if that would help. This is the second day I've been struggling with this problem and it would be a shame to abandon this since everything else works perfectly.

[Ksloan]

working

I managed to get eventlog working. Does anyone know how to set triggers so that I'll only receive logs that are from after a certain date?

[elvar]

I managed to get eventlog working. Does anyone know how to set triggers so that I'll only receive logs that are from after a certain date?

I'm having the same errors that you did. How did you resolve them?

[davideg]

I'm having the same errors that you did. How did you resolve them?

Same error in windows zabbix agent 2.0.6, anybody solved it?

[elvar]

Same error in windows zabbix agent 2.0.6, anybody solved it?

I did finally get it working. Below are my item and trigger syntaxes.

eventlog[Application,"Faulting application EXAMPLE\.EXE"]

{EXAMPLE:eventlog[Application,"Faulting application EXAMPLE\.EXE"].count(60)}>0&{DFRUN:eventlog[Application,"Faulting application EXAMPLE\.EXE"].now(0)}>0

Does this help?

[davideg]

I did finally get it working. Below are my item and trigger syntaxes.

eventlog[Application,"Faulting application EXAMPLE\.EXE"]

{EXAMPLE:eventlog[Application,"Faulting application EXAMPLE\.EXE"].count(60)}>0&{DFRUN:eventlog[Application,"Faulting application EXAMPLE\.EXE"].now(0)}>0

Does this help?

No, i'm still get the same error:

# zabbix_get -s 192.168.1.2 -k "eventlog[Application]"
ZBX_NOTSUPPORTED

The strange thing is that it seems that the agent doesn't support the whole "eventlog" item, because if run

zabbix-agentd.exe -p

i get:

log                                           [m|ZBX_NOTSUPPORTED]
logrt                                         [m|ZBX_NOTSUPPORTED]
eventlog                                      [m|ZBX_NOTSUPPORTED]

thank you

[elvar]

Are you running that agent in Active mode and not passive?

[davideg]

Are you running that agent in Active mode and not passive?

Here it's the configuration:

LogFile=C:\Program Files\Zabbix Agent\Zabbix_agentd.log
DebugLevel=2
EnableRemoteCommands=1
Server=monitor.network.lan
ListenPort=10050
Hostname=FILESRV01

I've tried to add DisableActive=1 but i get the error:

zabbix_agentd.exe [2732]: unknown parameter [DisableActive] in config file [C:\P
rogram Files\Zabbix Agent\zabbix_agentd.conf], line 5

[Michael0]

Same here!

I just want simply to trigger a Windows Event ID in the System log:

eventlog[System,,,,1234]

Does anyone have a solution for this?

I´m running Zabbix 2.0.4

[nail]

You need to run it as active check.
Also you Can't get it using zabbix_get.
Use this to setup agent correctly: https://www.zabbix.com/documentation.../zabbix_agentd

ServerActive	no 			List of comma delimited IP:port (or hostname:port) pairs of Zabbix servers for active checks. No spaces allowed.
If port is not specified, default port is used.
IPv6 addresses must be enclosed in square brackets if port for that host is specified.
If port is not specified, square brackets for IPv6 addresses are optional.
If this parameter is not specified, active checks are disabled.