Uploaded image for project: 'ZABBIX FEATURE REQUESTS'
  1. ZABBIX FEATURE REQUESTS
  2. ZBXNEXT-7943

Missing info and examples on how to specify certain Windows Event logs

XMLWordPrintable

    • Icon: New Feature Request New Feature Request
    • Resolution: Unresolved
    • Icon: Medium Medium
    • None
    • None
    • Documentation (D)
    • None

      I wanted to monitor a Windows Event log: "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"

      I wasn't sure how to specify the name correctly. I went to the Zabbix Windows event log documentation page
      The description of the name parameter just said: "name of event log". The event log above has spaces in the name. I wasn't sure whether quotes were necessary. I tried including quotes and it worked, but from other examples online, it would seem quotes aren't necessary.

      The provided examples only dealt with the "classic" event logs, like "Application" or "System".
      But with the newer style event logs, sometimes the log name in the Event viewer GUI doesn't match the file name on disk. For instance, in the example below, within the Event Viewer GUI, the Log Name field differs from the File name on disk. Which one does the agent expect for the Name parameter?
      GUI: Microsoft-Windows-Windows Remote Management/Operational
      File on disk: Microsoft-Windows-WinRM%4Operational.evtx

      From my research, you are supposed to use the file on disk, but with the "%4" replaced with '/'.

      To summarize, the documentation would be improved by:

      1) Clarifying whether quotes are required when the log name contains spaces

      2) Clarifying whether the agent expects the actual file name, or the name shown within the Event Viewer GUI (which is often the tool people will be using to view the logs, and so naturally may think the logname displayed within it is the one to use)

      3) Adding an example where the item key is using a newer-style Windows Event log

      Thanks!

      Matt

       

            martins-v Martins Valkovskis
            Matthew.Steeves2 Matthew Steeves
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: