Nagios logging in windows event format

[cpetrus]

Hi all,
Is it possible to set Nagios to log the data in windows event format?

Thanks

Best regards,
CPetrus

[slansing]

So what you are asking, is if you can change the nagios.log file to handle event ID's, tree's, categorys, sources, etc? No, I'm sorry, that is not really possible. I'm not sure why you would want to do this, perhaps if you share your reasoning, we might be able to help find you a solution in some other manner.

[cpetrus]

Not necessarily changing nagios log. It could be for example additional logging which will generate windows log event format.
I need it to integrate with ECS monitoring solution. As far as I know it is processing only windows log event files (maybe it can process different format but I am aware only about it).

[slansing]

So you are trying to monitor Nagios with another application? Why not do it the other way around, since you will have to come up with some scripted solution that would copy out the nagios log and run some sort of parse and build on it. That is not really something we can help with. From the looks of it, ECS is not a infrastructure monitoring solution, it is a tool for monitoring pipe corrosion? Correct me if I'm wrong, but that is typically something which you would check from Nagios or send results up to Nagios passively, not the other way around.

[cpetrus]

It needs to be done in this way
Maybe some bash script to analyze the log and create new one in windows event format?
But how to interpret these numbers (for example: [1416346326] ) and convert to date and time ?

Regards,
CPetrus

[rhassing]

If you create a bash script you could do the follwing:

Code: Select all

# date -d @1416346326

The output is:

Code: Select all

Tue Nov 18 22:32:06 CET 2014

[slansing]

Yep, you'd need to script a solution to do it as mentioned, the numbers you are looking at are in unix timestamp format. You still have not yet answered the question though, of how deep into the windows event log format you are looking to translate. If you are just having trouble reading timestamps, that is easy enough, and definitely not restricted to "windows event format."

[cpetrus]

great
thank you very much both. You saved me and make my live easy

Best regards,
CPetrus