-
Incident report
-
Resolution: Duplicate
-
Major
-
None
-
None
-
Windows 2008 and 2008r2
Microsoft introduced the "critical" log level in the event viewer in windows.
At the moment the windows agent only has the following levels (copied from active.c):
case EVENTLOG_SUCCESS:
case EVENTLOG_INFORMATION_TYPE:
severity = 1;
zbx_snprintf(str_severity, sizeof(str_severity), INFORMATION_TYPE);
break;
case EVENTLOG_WARNING_TYPE:
severity = 2;
zbx_snprintf(str_severity, sizeof(str_severity), WARNING_TYPE);
break;
case EVENTLOG_ERROR_TYPE:
severity = 4;
zbx_snprintf(str_severity, sizeof(str_severity), ERROR_TYPE);
break;
case EVENTLOG_AUDIT_FAILURE:
severity = 7;
zbx_snprintf(str_severity, sizeof(str_severity), AUDIT_FAILURE);
break;
case EVENTLOG_AUDIT_SUCCESS:
severity = 8;
zbx_snprintf(str_severity, sizeof(str_severity), AUDIT_SUCCESS);
break;
Critical events are very important events to monitor to prevent disaster.
- is duplicated by
-
ZBX-2008 "Windows Eventing 6.0" not supported
- Closed