Understanding Windows eventlog triggering

[fischerdr]

All,
I have look at most of the window event log forum question and I am still not understanding how to setup my triggers and actions.
My problems is this:
1) event log triggers are not really off/on type events. How can I insure that i trigger upon every event log entry?

2) I have created triggers that check ".eventid()" for only those events is there a way to clear the "PROBLEM" right after a action (e.g. email) is sent?

3) In the Dashboard->Last 20 issues all I see are my Eventlog alerts is there a way to exclude theses?

Any help on these would be real great. If you need more information please feel free to contact me

Thanks
David Fischer

[slemons]

Hi David,
I too am working my way through getting Win Event Log triggering working. I use this expression:

{VC Windows EventLog:eventlog[Application,,,,,,skip].logseverity(0)}=4 & {VC Windows EventLog:eventlog[Application,,,,,,skip].nodata(10)}#1

I modeled it after HullZabbix's response in this thread:

https://www.zabbix.com/forum/showthread.php?t=23402

Good luck.
Sam

[fischerdr]

Sam Thanks For the update I will look into the snipet you gave.

Thanks