Zabbix trigger recovery event log windows

[mackane]

Hello Hello,


I have configured an item to monitor windows sql logs(eventlog[Application,,,,18210,,skip])

Trigger:

logeventid(/Windows by Zabbix agent active/eventlog[Application,,,,18210,,skip])=1


It works fine, but I can't solve the problem with a recovery trigger.

Is there a solution other than closing it manually?

thanks in advance

[cyber]

Your item only picks up specific conditions, ie only events with specific ID.
Your trigger reacts to that specific condition (does not even look for pattern here, just reacts to "logeventid exists").
There is no easy option to resolve it as your item does not ever pick up any other events.
Recovery expression does not help you as it is additional evaluation that has to become true after problem expression has become false... your problem expression pretty much never becomes false, so recovery expression is not considered anyway.
You can add "and nodata(/host/key),Xm)=0" to your trigger expression, which allows automatic closing of that problem after X minutes of no new data coming in... This also prevents creating new problem while new data is coming in during that period..

[mackane]

Thank you Cyber,
for your very pertinent analysis.
I've tested it, and it works very well.
thank you