Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-7153

Active Item eventlog read full log at first activation (deploy)

    Details

    • Type: Incident report
    • Status: Closed
    • Priority: Critical
    • Resolution: Won't fix
    • Affects Version/s: 2.0.8
    • Fix Version/s: None
    • Component/s: Agent (G)
    • Environment:
      Zabbix 2.0.8 server/agent and Windows monitored server (from 2003)

      Description

      We are tring to use eventlog to check eventlog "Application" and "System" and report problems (Error level). We have configured item like this:

      eventlog[Application,,Error,,,100,all]

      Agent is configured with this parameters:

      ServerActive=zabbix01,proxy01
      BufferSend=90
      BufferSize=1000
      RefreshActiveChecks=3600

      Trigger associated with item is:

      {windows-basicschecks:eventlog[Application,,Error,,,100,all].logseverity(0)}

      =4 &

      {windows-basicschecks:eventlog[Application,,Error,,,100,all].nodata(180)}

      =0

      And an action (with multiple error report) that send a mail when trigger fireup ...

      When we apply template (windows-basicschecks) with eventlog item, zabbix sent many many notification about problems from the first row entry in eventlog (in my case from 2010!!!) ...

      Multiple error report setted is a must.

      Agent must have a "First Time Reading" option or an option in the item for reading only the last (for example) 100 rows or last day and not all log since it was created ...

      For us this is a bug ... can you confirm?

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              yayo yayo
            • Votes:
              1 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: