Stop replication of Hyper-V VM (Eventlog and logsource)

[elvis.pompeu]

Good morning to all staff,

The thing is, I'm trying to do with any form that manages the Zabbix alert when stopping the replication of Hyper-V generated by the alert in Event Viewer, but tried the two ways, according to the official documentation, and neither worked ... If I put only one System or Application, for example, it will generate ALL of these alerts, and that's not what I want, but the specific, as in the case of this situation that I generates Source: Hyper-V VMMS the Event ID 32088, which is the ID corresponding to the event ERROR replication Hyper-V ... I tried both models of triggers:

{Template_test:eventlog[System,,"Error","Hyper-V-VMMS",32088].logseverity(4)}=4

{Template_test:eventlog[System].logsource(Hyper-V-VMMS)}=4

And unfortunately it will not, but if I use the Event Viewer default template that has the actual site of Zabbix, it monitors in a generic way, ie monitors in General!!
For example: {Template_test: eventlog [System]. LogSeverity (4)} = 4
But this type of trigger will return me ALL ERRORS events generated by system and do not want it, I just want this Event ID specified Hyper-V ...

If someone digs this and part of monitoring Event Viewer in Windows Server, I'd be grateful, because the monitoring with Unix / Linux to me is more quiet, but I monitor Heterogeneous environments, so it takes me pay attention to these details ...

Thanks and regards,

Sorry for my english ...

[elvis.pompeu]

Guys, help me... =/

[Heilig]

Do I understand correctly that you can not find an expression for the trigger?
Have you tried the trigger with the operator "&" or "|" (https://www.zabbix.com/documentation...s/expression)?

[elvis.pompeu]

using the "|" or "&" would not be the problem, the question would be how to filter only the desired EventLog?

Thanks and regards!

[Heilig]

Please, describe the conditions under which the trigger must change the status.

[elvis.pompeu]

When the Eventlog logeventid with the "Admin" equals 32088, for example:
{server: eventlog [Admin]. logeventid ()} = 32088
But unfortunately this condition is not working, I generate the Event log for testing purpose, and unfortunately it does not alarm as defined ...

Sorry my bad english..