Email notification not working for alert

[RachelC]

Hi,

1. Email settings are correct, doneaemail test
2. Created a 'trigger' for Zabbix agent not responding - I get an email if I stop the Zabbix windows agent

Created a template called RDP Access (this is to see when a user or administrator RDP's onto a Windows Server)

1. Created the 'Item' with the following key:
eventlog[Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational,,,,1149,,skip]

2. Created a 'Trigger' with the following expression:
last(/Windows Eventlog - Administrator RDP Access/eventlog[Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational,,,,1149,,skip])=1

When someone RDP's I see via 'Latest Data' someone has RDP to server so that works fine.

Also see screenshots

The email notification is not working....

Created a 'Action' - Trigger
Set the 'Conditions' to either the Template or Trigger
Set myself as to receive the email but the emails are not sent..
...
The Action is enabled

See screenshots.

What am I doing wrong?
Is the Trigger incorrect?

[Markku]

Have you tried with just one condition?

I'm asking because someone just the other day experienced problems with actions, and he also had an "or" condition there. Just an idea.

Markku

[RachelC]

Hi Markku,

I tried just with one alert and still didn't work

[Markku]

Umm, not sure I understand what you meant. I was suggesting that you edit the action that you had in the first screenshot, and delete one of the conditions there, probably condition A because it is redundant (the trigger mentioned in B is in that template, and template by itself cannot trigger any action).

Anyway, now that I looked again at your trigger, that is maybe not correct. You are not expecting a value of "1" for the eventlog entry, are you?

Markku

[RachelC]

Hi Markku,

Sorry, maybe I didn't write it correctly....
I did remove one of the conditions and it still didn't work.

I figured out my problem...It was in the 'Expression'
I was using the wrong 'Function' - I was using 'time' instead of 'logeventid'

I've changed it to the following and now it's sends the emails

eventlogid/Windows Eventlog - Administrator RDP Access/eventlog[Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational,,,,1149,,skip])=1

Thank you for the help

[cyber]

Reminder for everyone... make sure your trigger works, before blaming action for not working..

[RachelC]

good one Cyber

Problem is, the trigger only works once... So there is still something missing, or I'm doing something wrong.
I think I have to add a extra expression to make sure it works all the time.
This is my first time using Zabbix etc.. so it's a learning curve

[cyber]

as you only pull out certain events with ID 1149, then your last() function will always have the matching one, thus, it works once and stays in problem state, as trigger expression is always true (in your case any value for event ID would be ok). That's the issue with Zabbix and log monitoring. What you can do, is add secondary condition. For example with nodata() function. if you have not received any new data for couple of minutes, your trigger condition becomes false and problem goes away.

"logeventid (/host/key,<#num<:time shift>>,<pattern>)=1 and nodata (/host/key,sec,<mode>)=0"

[RachelC]

Hi Cyber,

Thank you for the extra expression condition, seems to be working properly now. Will test over the next day or so
Happy Days