Zabbix false trigger, how to write an expression correctly?

Question

Windows

I receive an event log from the windows server and look for an error using the expression:

{Windows AD SEC:eventlog["Microsoft-Windows-Backup",,,].logeventid(19)}=1

And it works great. But today I received a false positive - event 192 appeared and the trigger worked on it. How to set exact search by logeventid?

Answer 1

The result is this.
If the zabbix server version is 3.4 or higher, POSIX won't work (it doesn't respond to it at all). You need to use PCRE. This is what I did now, and it works great.
To compose my regular expression, I found a good service for this https://regex101.com/ , quite convenient.

Answer 2

logeventid accepts a regular expression, I can't vouch for the accuracy, maybe something like this:

{Windows AD SEC:eventlog["Microsoft-Windows-Backup",,,].logeventid(\b1[19]\b)}=1

Answer 3

I'm not sure, but maybe this is the problem - logeventid(19) ?
Have you tried specifying 192 instead of 19 ?