Nagios Support Forum

Change this in the /etc/mod_gearman/module.cfg: eventhandler=no to: eventhandler=yes A copy of the handler should exist on the mod gearman workers - it usually needs to be under /usr/local/nagios/libexec or wherever the plugins are stored. Restart the modgearman service after making the change and v...

I'd like to take a closer look at this over a remote if possible. Please open a ticket and reference this forum post and we can get the ball rolling on that.

support.nagios.com/tickets

Step through https://support.nagios.com/kb/article/a ... n-600.html to enable authentication debugging. The debug output is written to the apache files.

Let us know if that has improved things. If not, please provide a directory listing: ls -alh /var/log/logstash as well as copy of /var/lib/logrotate/logrotate.status Also, logstash.log should be relatively small unless there is a reoccuring error. What do you see if you run: tail -f /var/log/logstas...

It sounds like there has been success.

Per the doc a minimal install is recommended: https://assets.nagios.com/downloads/nag ... Server.pdf

What OS is NLS installed on? Please provide a copy of /etc/logrotate.d/nagioslogserver.

Go ahead and remove the log and allow it to be recreated:

Thanks for the update. I believe I've been able to reproduce with the data provided and am currently looking into it, but let me know how the memory change goes.

Sounds good. Keep us posted!

It uses the $HOSTSTATETYPE$ and $SERVICESTATETYPE$ macros to indicate a SOFT or HARD state: https://assets.nagios.com/downloads/nag ... olist.html

You can see this macro in use in the /usr/local/nagios/var/nagios.log.

A logstash filter like this will drop an event if the sourcename matches: if [SourceName] == 'Microsoft-Windows-StorPort' { drop{} } Can you provide the raw log containing the event that caused the encoding message? It looks like logstash had an issue with the name found in the message field: ... Na...