Details
-
Problem report
-
Resolution: Unresolved
-
Trivial
-
None
-
6.2.5
-
None
Description
Hello,
I'm having problems trying to reference a Dependent Item on the Event Name field of a trigger in a template.
It was working on version 6.0.x, and it stopped working since I updated my Zabbix Server to 6.2.x.
Steps to reproduce:
- Create a template (or use an existing one)
- Create an item (the 1102 ID says that some user deleted the Windows Security Logs):
Key: eventlog[Security,,,,1102,,skip]
Type: Zabbix Agent (active)
Type of information: Log
Update Interval: 1s - Create a dependent item (I want to get the specific user that deleted the logs, so I did it with a regular expression):
Key: WhoClearedSecurityLogs
PreProcessing (regexp): Security ID:\s+([^\n]+)
Master Key: (the item we created before this one) - Create a trigger:
Expression: last(/Log Monitoring/eventlog[Security,,,,1102,,skip])<>0
Event Name: User {?last(//WhoClearedSecurityLogs)} cleared all Security logs from the server {HOST.NAME}
Result:
The expression {?last(//Key)} does not translate {?last(/HostName/Key)} when I apply it to the host. It used to work on version 6.0, but it's not working anymore.
I can fix the problem going directly to the host, creating a copy and changing it to {?last(/HostName/Key)}.
Expected:
I was expecting that Zabbix would change the {?func(//...)} to {?func(/HostName/...)} when I apply the template to a host.