Windows2008R2

seems to be similar to ZBX-2837

zalex_ua hmm, I don't see how they can be similar.
It's not similar, IMO!

Could it be this was fixed in ZBX-8595? At least it looks like the error message might have been improved. If so, would it be possible to try agent version 2.2.7 or later?

Hi dimir,

In ZBX-8595 zbx_format_message has been fixed.
It is called from zbx_get_eventlog_message.

ZBX-9183 has occurred in the zbx_get_eventlog_message6.
I believe this issue is not same as ZBX-8595.

Best Regards,
KAZ

I could reproduce the problem.

1)Launch a command prompt. (Run as Administrator)
2)Add eventlog [Application] to item
3)Output a message to event log in eventcreate command.

eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "TEST TEST TEST"
eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "TEST %20 TEST"

Zabbix could get "TEST TEST TEST" message collectly, but Zabbix got the message below in "TEST %20 TEST" case.

The description for Event ID: 100 in Source:... 'Test' can not be found Either the component that raises this event is not installed on your local computer or the installation is corrupted You can install or repair the component on the local computer If the event originated on another computer, the display information had to be saved with the event.

Best Regards,
KAZ

Hi dimir,

I did a check on Zabbix agent 2.2.8.

Output a message to event log in eventcreate command.

eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "----"
eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "----%1----"
eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "----%2----"
eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "----%5----"
eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "----%10----"
eventcreate /ID 100 /L APPLICATION /SO Test /T Information /D "----%20----"

Zabbix could get "----" message correctly.
Zabbix got the message below in

"----%2----","----%5----","----%10----","----%20----"

case.

The description for Event ID: 100 in Source:... 'Test' can not be found Either the component that raises this event is not installed on your local computer or the installation is corrupted You can install or repair the component on the local computer If the event originated on another computer, the display information had to be saved with the event.

When eventlog is

"----%1----"

, Zabbix got a an incorrect message

"------------%1------------"

.

Best Regards,
KAZ

Yeah, I could reproduce the issue with the commands you specified. And it was the same with 2.2.6 and 2.2.8 . Thanks.

Could you please test the development branch (copy of current 2.2 branch):

svn://svn.zabbix.com/branches/dev/ZBX-9183

or if you don't want to compile just use the zabbix_agentd binary attached as

zbx-9183-fixed-zabbix_agentd.exe

I'm also attaching the screenshots. The message with %1 was incorrectly translated but it was also so in the "general" tab in event viewer. In "details" tab it was shown as original. So zabbix was acting the same way as event viewer. Other messages were processed correctly.

kazuo.ito, could you please read my previous comment? Would it be possible for you to try the attached zabbix agent and see if the problem goes away?

Could you please test the development branch (copy of current 2.2 branch):

svn://svn.zabbix.com/branches/dev/ZBX-9183

or if you don't want to compile just use the zabbix_agentd binary attached as

zbx-9183-fixed-zabbix_agentd.exe

I will try zbx-9183-fixed-zabbix_agentd.exe, please wait.

I'm also attaching the screenshots. The message with %1 was incorrectly translated but it was also so in the "general" tab in event viewer. In "details" tab it was shown as original. So zabbix was acting the same way as event viewer. Other messages were processed correctly.

It is you're right.
The message with %1 has been incorrectly converted, but it was acting the same way as event viewer.

Hi dimir

I tried zbx-9183-fixed-zabbix_agentd.exe.
Zabbix was properly collected a message!

Thank you,
KAZ

Thank you!

Fixed in development branch svn://svn.zabbix.com/branches/dev/ZBX-9183

Successfully tested

Fixed in 2.2.9rc1 (r51955), 2.4.4rc1 (r51956), 2.5.0 (r51957)

(1) [D] Documented:

• https://www.zabbix.com/documentation/2.2/manual/introduction/whatsnew229#daemon_improvements
• https://www.zabbix.com/documentation/2.4/manual/introduction/whatsnew244#daemon_improvements

<sasha> CLOSED

(2) ChangeLog is incorrect:

• (2.2, 2.4, trunk) new entries should be located in the upper part
• (trunk) the new entry appears in 2.5, 2.4 and 2.2 sections - it should not be listed in the 2.5 section

<dimir> RESOLVED in r51958, r51959, r51960

<sasha> CLOSED