Warning state when critical event

[tmvision]

Hi,

I have this alias configured in nsclient.ini

CheckEventLog file=application "filter=generated gt -20h AND (level eq 'error' or level eq 'warning') and source eq 'MSSQLSERVER' and message like 'backup'" unique descriptions "top-syntax=${count} message(s): ${problem_list}"

Is it possible to return only a warning state when state is critical? I've tried with the warn filter but did not work.

Any help much appreciated.

[scottwilkerson]

I think you need to set the crit level to blank and change the warning levels

Code: Select all

CheckEventLog file=application "filter=generated gt -20h AND (level eq 'error' or level eq 'warning') and source eq 'MSSQLSERVER' and message like 'backup'" unique descriptions "top-syntax=${count} message(s): ${problem_list}" "warn=level in ('warning', 'error', 'critical')" "crit=level in ()"

By default they are

Code: Select all

warning 	level = ‘warning’, problem_count > 0
critical 	level in (‘error’, ‘critical’)

[tmvision]

I think you need to set the crit level to blank and change the warning levels

Code: Select all

CheckEventLog file=application "filter=generated gt -20h AND (level eq 'error' or level eq 'warning') and source eq 'MSSQLSERVER' and message like 'backup'" unique descriptions "top-syntax=${count} message(s): ${problem_list}" "warn=level in ('warning', 'error', 'critical')" "crit=level in ()"

By default they are

Code: Select all

warning 	level = ‘warning’, problem_count > 0
critical 	level in (‘error’, ‘critical’)

Thanks for the reply, however nagios shows failure:

Code: Select all

Failed to validate filter see log for details: Warning expression is not valid: count>=level in ('warning', 'error', 'critical')

[scottwilkerson]

Their documentation is terrible, the only way I would see to get it to only give a warning is to set crit= to a really high value in the version I am running

for example

Code: Select all

CheckEventLog file=application "filter=generated gt -20h AND (level eq 'error' or level eq 'warning') and source eq 'MSSQLSERVER' and message like 'backup'" unique descriptions "top-syntax=${count} message(s): ${problem_list}" "crit=999999"

[tmvision]

Their documentation is terrible, the only way I would see to get it to only give a warning is to set crit= to a really high value in the version I am running

for example

Code: Select all

CheckEventLog file=application "filter=generated gt -20h AND (level eq 'error' or level eq 'warning') and source eq 'MSSQLSERVER' and message like 'backup'" unique descriptions "top-syntax=${count} message(s): ${problem_list}" "crit=999999"

Yes we are using huge amounts of time to setup nagios.

Your example helped a lot, thanks.

I had to add "crit=999999" "warn=1" though, otherwise no warning would show.

[scottwilkerson]

Yes we are using huge amounts of time to setup nagios.

Your example helped a lot, thanks.

I had to add "crit=999999" "warn=1" though, otherwise no warning would show.

Great!

Locking thread