Windows Eventlog Monitoring - Error-Message: "Accessible only as active check."

[andreas777]

Hi Guys!

Information:
Zabbix-Server Version: 6.0.5
Zabbix-Agent-Version: Zabbix Agent (6.2.4)


I want to do Windows-Eventlog monitoring with Zabbix.

I think that I created the items the right way as I followed the zabbix-guidelines in their documentation.

Anyway, here my configuration:

Zabbix-Frontend Configuration
Host = test01

Item Configuration:
Name = Special access logon
Type = Zabbix agent
Key = eventlog[security,,,,^(4672|4624),,skip]
Type of information = Log
Update interval = 10s

Zabbix-Agent config
Server=IP_of_Server
Hostname=test01


I get the following error-message: "Accessible only as active check."

In the Zabbix-agent log were no entries regarding this problem.

Did I do soemthing wrong or is this a zabbix-bug?

Thank you for your help in advance!

Andreas

[Hamardaban]

The agent can operate in two modes, active and passive (and both at the same time). EventLog metrics are available when working in active mode.

https://www.zabbix.com/documentation...s/zabbix_agent

https://www.zabbix.com/documentation/current/en/manual/appendix/items/activepassive

https://www.zabbix.com/documentation/6.2/en/manual/config/items/itemtypes/zabbix_agent/win_keys#windows-specific-items

[andreas777]

Hello Hamardaban!

Thank you for the information. I know about the active and passive agent.

Do you really think that the Windows Eventlog can only be retrieved through the active agent?


I found a quite old posting about this topic where the comment from Alexei Vladishev states the following:
(The question was: Why are log-items limited to active-checks only?)
There are no technical reasons behind this. I believe the limitation will disappear at some point.

https://www.zabbix.com/forum/zabbix-help/8951-zabbix-agent-log-only-accessible-as-an-active-check



As this posting is from 2008 I would assume that in the meantime it is possible to create log-items as passive checks.

[Hamardaban]

Hello [URL="https://www.zabbix.com/forum/core/"]
Do you really think that the Windows Eventlog can only be retrieved through the active agent?

I'm not guessing, but I know for sure.
active agent only.