We monitor the windows event log on a Windows Server 2012 machine (also effects 2008 r2). Details below. We have zabbix setup to send an email to a user when error messages appear in the application log, of source axMonitoring.

The issue we're having is we'll get duplicate emails. Watching the dashboard whilst this happens, I can see that the trigger fires, the email gets sent. The trigger will then clear after about 35 seconds (nodata(30)) and then it will fire again for another 35 seconds.

I've attached the latest data of SERVER application log, you can see it's correctly reading and not getting duplicates.

Item:
eventlog[Application]
Interval 5 (also tried 10, 30, 60)

Trigger:

{SERVER:eventlog[Application].nodata(30)}

#1 &

{SERVER:eventlog[Application].logsource(axMonitoring1)}

=1
(also tried nodata(45) and nodata(60)

Action:
Trigger value = Problem
Trigger = SERVER: axMonitoring
Date/Time:

{EVENT.DATE}

{EVENT.TIME}

Description:

{ITEM.VALUE}

Send message to users (email only)