[ZBX-5646] Critical level in Windows 2008 eventlog processed incorrectly as Information level Created: 2010 Jun 23 Updated: 2017 May 30 Resolved: 2013 Nov 08 |
|
Status: | Closed |
Project: | ZABBIX BUGS AND ISSUES |
Component/s: | Agent (G) |
Affects Version/s: | None |
Fix Version/s: | None |
Type: | Incident report | Priority: | Major |
Reporter: | Ruud Boersma | Assignee: | Unassigned |
Resolution: | Duplicate | Votes: | 5 |
Labels: | eventlog, logmonitoring, windows | ||
Remaining Estimate: | Not Specified | ||
Time Spent: | Not Specified | ||
Original Estimate: | Not Specified | ||
Environment: |
Windows 2008 and 2008r2 |
Attachments: |
![]() |
||||||||
Issue Links: |
|
Description |
Microsoft introduced the "critical" log level in the event viewer in windows. case EVENTLOG_SUCCESS: Critical events are very important events to monitor to prevent disaster. |
Comments |
Comment by Oleksii Zagorskyi [ 2010 Aug 07 ] |
From agent debuglog - zabbix agent returns "severity":1 for critical events. |
Comment by Oleksii Zagorskyi [ 2010 Aug 07 ] |
when making this request, please see here ZBXNEXT-470 |
Comment by Oleksii Zagorskyi [ 2012 Dec 10 ] |
This issue is not fixed long time because the Critical level used only in "Windows Eventing 6.0" log. And there are problems with this new format. |
Comment by Andrei Gushchin (Inactive) [ 2013 Feb 13 ] |
I tested beta-binares. I suppose we have same problem. 1664:20130213:133847.796 In process_value() key:'zwin08:eventlog[System]' value:'Система перезагрузилась, не завершив полностью работу. Эта ошибка может быть результатом того, что система перестала отвечать, произошел критический сбой, или неожиданно отключилось питание.' 1664:20130213:133852.468 JSON before sending [{ "request":"agent data", "data":[ { "host":"zwin08", "key":"eventlog[System]", "value":"Система перезагрузилась, не завершив полностью работу. Эта ошибка может быть результатом того, что система перестала отвечать, произошел критический сбой, или неожиданно отключилось питание.", "lastlogsize":2342, "timestamp":1360741047, "source":"Microsoft-Windows-Kernel-Power", "severity":1, "eventid":41, "clock":1360741127}, { |
Comment by Alexey Pustovalov [ 2013 Jul 31 ] |
information about event levels (severities): http://msdn.microsoft.com/en-us/library/aa382793%28v=VS.85%29.aspx |
Comment by Alexey Pustovalov [ 2013 Jul 31 ] |
function get_item_logtype_description($logtype) { switch ($logtype) { case ITEM_LOGTYPE_INFORMATION: return _('Information'); case ITEM_LOGTYPE_WARNING: return _('Warning'); case ITEM_LOGTYPE_ERROR: return _('Error'); case ITEM_LOGTYPE_FAILURE_AUDIT: return _('Failure Audit'); case ITEM_LOGTYPE_SUCCESS_AUDIT: return _('Success Audit'); default: return _('Unknown'); } } |
Comment by Alexander Vladishev [ 2013 Nov 08 ] |
It's a duplicate of |