Answer the question
In order to leave comments, you need to log in
How to make trigger eventlog with exceptions in zabbix?
Hello!
For several days I have been trying to set up the trigger that I need:
- I need to receive windows eventlog, compare it with global exceptions and ignore the global exception if specified in local (host), and work according to the logic:
the trigger always fires if:
a) there is a global simultaneous exclusion by code and source (code and source are different global variables);
b) if there is a global simultaneous exception by code and source and there is a local exception from the exception (simultaneous)
Here is what the logic looks like:
https://www.wolframalpha.com/input/?i=(C+or+D)+or+. ..
In zabbix, Regular expressions , created:
eventlogid -^(7040|100|999|5003[1-9]|2457[7,9],19|4[3-4])$ - [Result is TRUE]
eventsource - ^(Microsoft-Windows-WindowsUpdateClient|Zabbix test event)$ - [Result is TRUE]
created item:
eventlog[System,,,,,,skip]
and trigger to it:
(
(
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logsource({$EVENTSOURCE})}
or
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logeventid({$EVENTLOGID})}
)
or not
(
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logsource(@eventsource)}
and
{Template OS Windows Active Eventlog:eventlog[System,,,,,,skip].logeventid(@eventlogid)}
)
) <> 0
eventcreate /t ERROR /id 999 /l system /so "Zabbix test event" /d "Test ERROR event 999 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")"
eventcreate /t ERROR /id 998 /l system /so "Zabbix test event1" /d "Test ERROR event 998 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")"
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question