Check event ID on a Task Schedule

[nerdgz]

Hello Everyone,

on specific task schedule there is an event id that it needs to be monitor. to see the events of this Task schedule I go on the windows server to:
Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> TaskScheduler >> Operational to view the logs I would see from the Task Scheduler Library.

if i run manually the command on Nagios nothing happend. ( The event ID 101 is as error on the path i described before so the Nagios message should be ok

This is my configuration but is not working , any suggestion ?

./check_nrpe -H host.domain.com -p 5666 -c CheckEventLog -a filter=new file=Microsoft-Windows-TaskScheduler/Operational MinWarn=0 MinCrit=0 filter-generated=\>1d filter+eventID=="101"

result> eventlog: 0 < critical|'eventlog'=0;0;0

Thank you in advance!

[Box293]

Have you seen this article?

https://outsideit.net/real-time-eventlog-monitoring/

Does it help?

[nerdgz]

Hello

this only checks the windows logs but not Event Viewer >> Applications and Services Logs >> Microsoft >> Windows >> TaskScheduler >> Operational

CheckEventLog seems that only looks at the logs from Windows log:

Application
Security
Setup
System

[rkennedy]

Do you have an assignment setup in task scheduler to monitor this or? This might help - https://outsideit.net/check-ms-win-tasks/

[Box293]

Perhaps the NSClient++ task scheduler module might be able to do what you want:

http://sites.box293.com/nagios/guides/c ... uled-tasks

http://docs.nsclient.org/reference/wind ... Sched.html

[nerdgz]

Hello Everyone,

Unfortunately all the solutions are not looking into this event logs. At least I know that the event log error 101 is that the task failed however there are two warning errors that I would like to have monitored.

error Event ID 101 Task Start Failed
Task Scheduler failed to start "\Test01\Test import" task for user "user1230". Additional Data: Error Value: 2147750687.

warning event ID 323 Launch request acknowledged, current instance stopped.
Task Scheduler stopped instance "{0057a12e-013e-4f3b-8e99-f82e11e11189}" of task "\Test01\Test import" in order to launch new instance "{49d6a0c3-2be6-495d-aa18-baa2ebcd4f93}" .

warning event ID 322 Launch request ignored, instance already running.
Task Scheduler did not launch task "\Test01\Test import" because instance "{3914ebed-513d-43d4-80e1-6e75ab350bdc}" of the same task is already running.

[tmcdonald]

I know you're asking this in the Core section of the forum, so a commercial solution might not be possible but I would be remiss if I didn't mention Nagios Log Server:

https://www.nagios.com/products/nagios-log-server/

It was designed to solve exactly the problem we're running into here, and it makes log monitoring much more enjoyable. We offer a fully-functional 60-day trial if you're interested, and I would highly recommend at least testing it out.