Eventlog Monitor

[Agasef]

Hi,

I want to see logon failed logs based on Event ID 4776. For this, I wrote an item in the template:
eventlog[Security,,,,4776,,skip]

and I wrote the trigger:

logeventid(/BSEDC18/eventlog[Security,,,,4776,,skip])=1

If the trigger works, the action does not work. Mail does not receive an alert that there is a problem.

[kamil1]

Hi,
Couple of hints you might want to check:

• Modify the trigger to explicitly check for Event ID 4776 with logeventid: {BSEDC18:eventlog[Security,,,,4776,,skip].logeventid(4776)}=1
• Ensure the severity of the trigger matches the action’s conditions.
• Review action configuration and ensure email settings are correct.
• Check Zabbix server logs for any errors related to the action or trigger.
• Test with a known event to confirm the alerting system works.