Windows eventlog + trigger but using localtime

[guille.rodriguez]

Hi, yesterday I had to create a new item to query the Windows log event looking for a specific event.

The Item works and I receive the data in Zabbix. The problem comes at the time of making the alarm because it takes into account the date and time of integration in Zabbix instead of the localtime of the machine (which is the one that interests me).

Item definition

eventlog[System,,,, "Application Popup",,,,skip]

with a preprocessing to filter only by the .exe that generates this popup.





Trigger definition

nodata(/Template DABS v2/eventlog[System,,,"Application Popup",,,skip],1h)=0

It works fine on computers that are all time connected, but when a computer was offline for a few ours and reconnects, if there was an Event that fires 4h ours ago, when Zabbix Server gets , fires the trigger... but the real time of event was 4h ago... so I want to force Zabbix to use "LocalTime" column



Example

Event was generated on Machine yesterday, last event at 23:40 but Zabbix saves with his timestamp at 7:37 AM (today)



And fires a Trigger



There is a way to tell in trigger something like "and event.localtime < 1h"

[Scanto]

I also want to set up triggers using the local time but couldn't find a way to do this so far.

[7neon7]

I join. I am also looking for a way to use local time.