Service check in Unknown state

[Pratapa]

One of the service check is in Unknown state.

Following is the check command.


[root@nagios server]# ./check_nrpe -H host1 -p 5666 -c CheckEventLog -a filter=new file=system MaxWarn=1 MaxCrit=1 filter-generated=\>5m filter+eventID=="10004" filter+eventType==error filter+eventSource==DCOM filter=in filter=all truncate=30
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).



[root@nagios server]# ./check_nrpe -H host1 -p 5666 -c CheckEventLog -a filter=new file=system
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).


[root@nagios server]# ./check_nrpe -H host1 -p 5666
I (0.3.5.1 2008-09-24) seem to be doing fine...

What could be the problem.

host1 is the windows server.

We are using Nagios core.

[scottwilkerson]

I'm not sure how you determined what string to use but your filters do not seem valid.

What do you get if you run

Code: Select all

./check_nrpe -H host1 -p 5666 -c CheckEventLog -a file=system

Do you have CheckEventLog enabled in the .ini file?

Also, I'm not 100% sure when that was added to NSClient++ as that is not our project but the current version is 0.5.2

Here are the docs
https://docs.nsclient.org/reference/win ... kEventLog/

[Pratapa]

Following is the output we are getting.

[root@nagiosserver]# ./check_nrpe -H host1 -p 5666 -c CheckEventLog -a file=system
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).

[Pratapa]

Do you have CheckEventLog enabled in the .ini file?

I don't see CheckEventLog=enabled or CheckEventLog=1 in nsc.ini file

[scottwilkerson]

I don't see CheckEventLog=enabled or CheckEventLog=1 in nsc.ini file

You will definitely need to add that and then restart NSClient++

[Pratapa]

We will enable CheckEventLog and let you know.

[Pratapa]

This is fixed after enabling the CheckEventLog in .ini file.

Thank you for your help.

You may lock the thread.

[scottwilkerson]

This is fixed after enabling the CheckEventLog in .ini file.

Thank you for your help.

You may lock the thread.

Great!

Locking thread