Monitoring Windows Eventviewer

[Tim Van Caeyzeele]

Thanks for the info,

Great that it can be done with the NSClient++ as I have it installed on all our servers.

What do I need to define in the NSClient++ agent and where ?
Is it in the .ini file or elsewhere ?

Regards,

Tim.

From: Frater, Greg J [mailto:GJFRATER at bechtel.com]
Sent: maandag 2 juni 2008 21:41
To: Tim Van Caeyzeele
Cc: nagios-users at lists.sourceforge.net
Subject: Re: [Nagios-users] Monitoring Windows Eventviewer


>Dear All,

>Would anyone have experience in checking the windows eventviewer for certain events, or turning nagios red in case of ERRORs ?

>What script are you using ? preferably something that can simply interact with NSClient

We do this using the NSClient++ agent (www.nsclient.org<file:///\\www.nsclient.org>).  It checks the event logs and filters them based on criteria you define, alerting when the number of hits you specify is reached (i.e. when the system log has 1 or more events with an ID of XXXX within the last 10 minutes send alerts).  Here is an example we use to monitor for a specific Oracle error.  In the example we check the "application" log of the server every "60" minutes for events with an ID of "20" with event type of "Error" containing a string in the text of the message "Can not allocate log", check turns critical after 1 matching event is found that is time stamped within the last "65" minutes.


Checkcommands.cfg:
define command{
        command_name    check_eventlogs
        command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -p 5666 -c checkEventLog -a filter=new $ARG1$ MaxWarn=$ARG2$ MaxCrit=$ARG3$ filter-generated=\$ARG4$ $ARG5$ truncate=$ARG6$

# Desc:
#       $ARG1$ = event logs to check (i.e. file=system file=application)
#       $ARG2$ = Warning level (i.e. number of hits to generate a warning response)
#       $ARG3$ = Critical level (i.e. number of hits to generate a critcal response)
#       $ARG4$ = Time period (i.e. 1 day is '1d' 30 hours is '>30h')
#       $ARG5$ = Filters (i.e. filter-eventID==9009 filter-eventSource=Tcpip) see http://www.nsclient.org/nscp/wiki/CheckEventLog/CheckEventLog for detailed info

#       $ARG6$ = Amount of data to return in characters (i.e. truncate=150)
#       Example: check_nrpe -H server_name_here -p 5666 -c checkEventLog -a filter=new file=system MaxWarn=1 MaxCrit=1 filter-generated=\>30h filter+eventID==10002 descriptions truncate=138

        }

Services.cfg:
define service{
        use                             standard-srv
        service_description             eventlog: Oracle archive log errors
        check_command                   check_eventlogs!file=application!1!1!>65m!filter+eventID==20 filter+eventType==error filter+message=substr:"Can not allocate log"!100

        normal_check_interval           60
        notification_options            w,c
        contact_groups                  apps
        host_name                       server1, server2
        }

HTH,

-greg

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.monitoring-lists.org/archive/users/attachments/20080603/e954a1cf/attachment.html>
-------------- next part --------------
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
-------------- next part --------------
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null