another topic that I try to wrap my head around. I'm trying to get alarms on different windows events. For the moment I just want a warning message.

So, I have configured Windows Event Log to be pushed to NetXMS server. Does work.
I have configured the Windows Event Parser like this:

<parser trace="0" name="WindowsEventLog">
   <macros/>
   <rules>
      <rule name="SQL Login failed">
         <match repeatInterval="0" reset="false">(.*)</match>
         <event>WIN_EVENT_RECORD_MATCHED</event>
         <id>18456</id>
         <logName>Application</logName>
         <agentAction action=""></agentAction>
      </rule>
      <rule name="SQL Login failed">
         <match repeatInterval="0" reset="false">(.*)</match>
         <event>WIN_EVENT_RECORD_MATCHED</event>
         <id>18452</id>
         <logName>Application</logName>
         <agentAction action=""></agentAction>
      </rule>
   </rules>
</parser>

A couple of questions already:

• The parser is asking for a name, but it seems like you only can have one. So why does it ask for a name and what does the name matter?
• For templates you can define Agent Policies and within a Log Parser. The UI looks similar. Is this a place where Windows Event Parser can be defined as well?

Ok then I defined the Event WIN_EVENT_RECORD_MATCHED with severity of Warning and a message of: Windows event ID %3: "%1"
As I understood the documentation n+2 (= %3) should be the EventID - but it is just empty.

Furthermore, in Event Processing Policy I created an alarm with Message "%m" and Alarm key of "WIN_EVT_%i_%3" to group id by Event ID. But as %3 is empty all events from a single machine are merged.

What am I doing wrong?

Cheers