A
A
Anton Teremshonok2020-09-04 06:02:30
Zabbix
Anton Teremshonok, 2020-09-04 06:02:30

How to make trigger eventlog with exceptions in zabbix?

Hello!
For several days I have been trying to set up the trigger that I need:
- I need to receive windows eventlog, compare it with global exceptions and ignore the global exception if specified in local (host), and work according to the logic:
the trigger always fires if:
a) there is a global simultaneous exclusion by code and source (code and source are different global variables);
b) if there is a global simultaneous exception by code and source and there is a local exception from the exception (simultaneous)

Here is what the logic looks like:
https://www.wolframalpha.com/input/?i=(C+or+D)+or+. ..

In zabbix, Regular expressions , created:
eventlogid -^(7040|100|999|5003[1-9]|2457[7,9],19|4[3-4])$ - [Result is TRUE]
eventsource - ^(Microsoft-Windows-WindowsUpdateClient|Zabbix test event)$ - [Result is TRUE]
created item:
eventlog[System,,,,,,skip]
and trigger to it:

(
(
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logsource({$EVENTSOURCE})}
or
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logeventid({$EVENTLOGID})}
)
or not
(
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logsource(@eventsource)}
and
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logeventid(@eventlogid)}
)
) <> 0


I do a check on the observed host (via posh I create problems in the log):
eventcreate /t ERROR /id 999 /l system /so "Zabbix test event" /d "Test ERROR event 999 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")"
eventcreate /t ERROR /id 998 /l system /so "Zabbix test event1" /d "Test ERROR event 998 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")"

and I get both problems, although logically the first request should be ignored due to the ignoring condition.

Is this even possible to do?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question