Zabbix. Task. Windows LOG EVENTS monitoring

Description

Zabbix Windows Eventlog monitoring at the Windows host

As example, the fact of Windows OS boot

Configuring

At the Windows host

Zabbix-agent

C:\ZA\conf\zabbix_agentd.conf

...
Server=192.168.166.149
...
ServerActive=192.168.166.149
...
Hostname=tmb_windows_17-77 # At the Zabbix-server there MUST be the same name of the Host in the Web-interface. HOSTNAME of this system can be different
...

Restart ZA service

At Zabbix-server

Create host "tmb_windows_17-77"

At the Windows host in ZA config there MUST be the same name (Hostname=...)

Create Item

For example, we need to get only logs with eventId 6005 (this is the fact of the Log Service running, and it means Windows OS boot)

Name: "Log of the system boot"

Type: Zabbix agent (active)

Key: eventlog[System,,,,6005,,]  # eventlog[System,,,,,,] - all events will be logged

Type of information: Log

Update interval: 1m

Test

Reboot Windows host for 2 times, we will get in the Latest data of the tmb_windows_17-77 Host:

04/24/2022 04:07:20 PM    03/04/2022 11:56:43 AM    EventLog    Information    6005    Запущена служба журнала событий.
04/24/2022 04:06:02 PM    02/24/2022 01:50:07 PM    EventLog    Information    6005    Запущена служба журнала событий.