EventLog description truncated

[maxwatt]

Hi all, we are evaluating Nagios XI 2009R1.4B trial edition to hopefully replace our Microsoft MOM. I am using NagEventLog agent to pull Warning and Error alerts on the EventLog of my monitored server. My issue is that the description that I get from the alert email is not complete or truncated. Is there a setting I can change to get the full description?

Thanks,

F. Lacson

[tonyyarusso]

After how many characters is it getting cut off? Is there a pattern to either the length or a character that it cuts off at? Could this be related to http://tracker.nagios.com/view.php?id=146?

[maxwatt]

Hi thanks for your response. Here is what is emailed out:

********************************************************************************************************
From: Root User [mailto:[email protected]]
Sent: Friday, June 03, 2011 9:53 AM
To:
Subject: PROBLEM Service Alert - ZZZ01/EventLog Ads Hub Windows Service is WARNING


***** Nagios XI Alert *****

Notification Type: PROBLEM

Service: EventLog Ads Hub Windows Service
Host: ZZZ01
Address: 192.168.66.36
State: WARNING
Info:
Application [warning] [Ads Hub Windows Service #502]: Cause:An error occurred while the hub was attempting to sync it cache with the system cache located on the central server. Resolution:Normally this is due to a network error, server error or the server
Date/Time: 2011-06-03 09:53:14

Nagios URL: http://192.168.233.66/nagiosxi/
********************************************************************************************************

And here is what is on the server:

********************************************************************************************************
Log Name: Application
Source: Ads Hub Windows Service
Date: 6/3/2011 9:51:43 AM
Event ID: 502
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: ZZZ01.prd.alldir.net
Description:
Cause:An error occurred while the hub was attempting to sync it cache with the system cache located on the central server.
Resolution:Normally this is due to a network error, server error or the server was being updated. Any other error should be raised to a developer.
Hub cache update failure

Teligence.Ads.Hub.Application.CacheTimer
NDC:(null)
System.Net.WebException: The remote server returned an error: (404) Not Found.
at System.Net.WebClient.OpenRead(Uri address)
at System.Net.WebClient.OpenRead(String address)
at Teligence.Ads.Hub.Cache.Downloader.RetrieveAdsIndex()
at Teligence.Ads.Hub.Application.CacheTimer.CacheDownload()

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ads Hub Windows Service" />
<EventID Qualifiers="0">502</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-06-03T16:51:43.000Z" />
<EventRecordID>85046</EventRecordID>
<Channel>Application</Channel>
<Computer>ZZZ01.prd.alldir.net</Computer>
<Security />
</System>
<EventData>
<Data>Cause:An error occurred while the hub was attempting to sync it cache with the system cache located on the central server.
Resolution:Normally this is due to a network error, server error or the server was being updated. Any other error should be raised to a developer.
Hub cache update failure

Teligence.Ads.Hub.Application.CacheTimer
NDC:(null)
System.Net.WebException: The remote server returned an error: (404) Not Found.
at System.Net.WebClient.OpenRead(Uri address)
at System.Net.WebClient.OpenRead(String address)
at Teligence.Ads.Hub.Cache.Downloader.RetrieveAdsIndex()
at Teligence.Ads.Hub.Application.CacheTimer.CacheDownload()
</Data>
</EventData>
</Event>
********************************************************************************************************

We have a lot of alerts that have long descriptions to give aid to the tech. Could there be a setting somewhere we can tweak? BTW, i just signed up to that tracker and haven't gotten a response.

Regards,

F. Lacson

[mguthrie]

From talking to another member of our team, the cutoff is at 4k worth of data, and changing this can be done, but it involves some work under the hood since some of the Nagios Core files will need to be recompiled. Currently this value is hard-coded into Nagios Core.

Here's instructions quoted from our customer forum:

Start with the Upgrade Instructions. After you have unpacked the update tarball and before you run the upgrade script, create a patch file in /tmp/nagiosxi/subcomponents/nagioscore/patches/ with your changes and add it to /tmp/nagiosxi/subcomponents/nagioscore/apply-patches, then run the upgrade script and proceed as usual. (This assumes you know how to make a patch file - there are other more direct but less "correct" ways to do this that will work too.)

Here's an example of the patch process:

Code: Select all

    [root@demo nagioscore]# pwd
    /tmp/nagiosxi/subcomponents/nagioscore
    [root@demo nagioscore]# cat patches/output-length.patch
    diff -rau nagios-3.2.3/include/common.h /root/nagios-3.2.3/include/common.h
    --- nagios-3.2.3/include/common.h       2010-10-03 22:56:55.000000000 -0500
    +++ /root/nagios-3.2.3/include/common.h 2011-06-02 15:15:56.000000000 -0500
    @@ -471,7 +471,7 @@
    #define MAX_FILENAME_LENGTH                    256     /* max length of path/filename that Nagios will process */
    #define MAX_INPUT_BUFFER                       1024    /* size in bytes of max. input buffer (for reading files, misc stuff) */
    #define MAX_COMMAND_BUFFER                      8192    /* max length of raw or processed command line */
    -#define MAX_EXTERNAL_COMMAND_LENGTH             8192    /* max length of an external command */
    +define MAX_EXTERNAL_COMMAND_LENGTH             16384    /* max length of an external command */

    #define MAX_DATETIME_LENGTH                    48

    diff -rau nagios-3.2.3/include/nagios.h /root/nagios-3.2.3/include/nagios.h
    --- nagios-3.2.3/include/nagios.h       2008-12-14 08:52:23.000000000 -0600
    +++ /root/nagios-3.2.3/include/nagios.h 2011-06-02 15:15:44.000000000 -0500
    @@ -43,7 +43,7 @@
        of MAX_EXTERNAL_COMMAND_LENGTH in common.h to allow for passive checks results received through the external
        command file. EG 10/19/07
    */
    -#define MAX_PLUGIN_OUTPUT_LENGTH                8192    /* max length of plugin output (including perf data) */
    +define MAX_PLUGIN_OUTPUT_LENGTH                16384    /* max length of plugin output (including perf data) */



    [root@demo nagioscore]# cat apply-patches
    #!/bin/sh

    pkgname=$1


    # Apply our patches
    echo "Applying Nagios XI patches to Nagios Core..."

    # Already in Nagios Core 3.2.3
    #patch $pkgname/base/events.c < patches/nagios-schedulingstatus.patch

    patch $pkgname/cgi/Makefile.in < patches/cgi-makefile.patch
    patch $pkgname/base/checks.c < patches/nagios-passivehostcheckbroker.patch
    patch $pkgname/base/checks.c < patches/nagios-passivehoststatusupdate.patch

    patch -p0 < patches/output-length.patch

    # Custom CGIs
    cp patches/cgi/*.c $pkgname/cgi

    [root@demo nagioscore]#

[maxwatt]

Thanks for the information. I have no experience doing a patch but I'll try it later. In your example, are those the values I need to achieve what I want to happen?

Is this something that a paid support can do for us once we go fully licensed?

Regards,

F Lacson

[mguthrie]

What you're needing at the moment is outside of a typical supported install. Typically status output from plugins returns much shorter amounts of data, but what you're saying does make sense in terms of helping your techs be able to identify the issue from the logs.