Hello, Fabian

What zabbix_agent version do you use? Have you any other eventlog checks on that host that works correctly?

Can you attach the screenshot of item configuration and zabbix_agent.conf file?

Regards,

Elina

Hello Elina

We use the Zabbix Version 3.2

The 1000 event is just for a test. Right now it is not able to attach the config file.

Best regards

Is there any other active checks of eventlog[] on the host that work?

And can you attach full view of item configuration? not only the key

This one works on the server e.g. 

Here is the full config of the one which does not work:

Thank you, I need time to check whether $ affects on items regex

I'm sorry to have kept you waiting. $ don't affects on items regex and zabbix works correctly.

Can you try to cach this error string manually?

from power shell:

> New-EventLog -LogName Application -Source 'MSSQL$SOURSE'
> Write-EventLog

LogName: Application
Source: MSSQL$SOURSE
EventId: 9001
Message: "TEST"

from cmd:

eventcreate /ID 901 /L APPLICATION /T INFORMATION /SO MSSQL$SOURCE /D "Test string"

but here you can not specify sourceid over 1000, so you need to change the key

HI Elina

I tried that already but nothing changed.

Without the Source 'MSSQL' in the item it works but not with the source.

Can you provide output from powershell:

 Get-EventLog Application -InstanceId 9001 | ?{$_.source -like "MSSQL*"}

?

That's the output

There are no events that match your key in the event log, so Zabbix does not receive any values.

Please check the event parameters that you want to catch. Because it's not a bug, I'l close this ticket.

Regards,

Elina

It works with the following command:

get-eventlog Application -Source "MSSQL*" -Message "The log for database*"

There is condition in your key for eventid ^(9001)$, but events you want to catch have another id. 

please try

eventlog[Application,,,^MSSQL,,,]

instead

eventlog[Application,,,^MSSQL,^(9001)$,,]

Regards,

Elina