Unknown command: $ in using check_eventlog with check_nrpe

[scottwilkerson]

Ok so this command works, can you share your current service configuration? Because it should be working now.

[scottwilkerson]

Oh I see before you had this

Code: Select all

define service{
use generic-service
host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04,
service_description Applications errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'"
}

it should be this
define service{
use generic-service
host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04,
service_description Applications errors
check_command check_nrpe!check_eventlog!"filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'"
}

[raydx]

I up-dated check_command and some services worked, while others didn't. Then I had an issue with Nagios not starting. Only when I commented the nrpe service checks, did Nagios start.

File is attached.

[scottwilkerson]

Ok, looking at this config you likely want to make the check_nrpe command

Code: Select all

$USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$

and make the services look like this

Code: Select all

define service{
use generic-service
host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04,
service_description Applications errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'"
}

[raydx]

I made the change to commands.cfg and ICS.cfg. I can only get Nagios to run when all check_nrpe services are commented.

[raydx]

I have in commands.cfg:
# 'check_nrpe' command definition
define command{
command_name check_nrpe
command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$
}

The following services do work:
define service{
use generic-service
host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04
service_description Data Loader errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'SLNIService' and id = 3 and message like 'query execution failed'"
}


#define service{
use generic-service
host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04,
service_description .NET Runtime errors
check_command check_nrpe!check_eventlog!"filter=provider = '.NET Runtime' and id = 1026 and message like 'unhandled exception'"
}


define service{
use generic-service
host_name per310-05
service_description Print Service errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'SLMD Print Service' and id = 0"
}

define service{
use generic-service
host_name per310-05
service_description ENI errors in the event log
check_command check_nrpe!check_eventlog -a "filter=provider = 'Spacelabs Healthcare Event Notification Interface' and id = 0"
}

define service{
use generic-service
host_name per310-10
service_description 12 Lead Interface errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'SpacelabsHealthcare12 Lead ECG Interface' and id = 0"
}

define service{
use generic-service
host_name per720-01
service_description Purge Data Status
check_command check_nrpe!check_mssql -a "-CheckType PurgeDataDuration -InstanceName icsdb"
}


But, this service causes Nagios not to start:
define service{
use generic-service
host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04
service_description Applications errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'Application Error' and id = 1000 and message like
'Spacelabs.SLNIService.exe'"
}

Nagios will start after I comment out the service.

[tgriep]

Edit the commands.cfg file and update the check_nrpe command to the following.

Code: Select all

# 'check_nrpe' command definition
define command{
	command_name check_nrpe
	command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$ $ARG2$
}

I edited the commands and posted them below. When creating a command, you need to have a ! between the command name (For example check_eventlog, $ARG1$) and the -a xxxxxxxxxxxxxxxxx for $ARG2$


Then change the service commands to the following.

Code: Select all

define service{
	use generic-service
	host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04
	service_description Data Loader errors
	check_command check_nrpe!check_eventlog!-a "filter=provider = 'SLNIService' and id = 3 and message like 'query execution failed'"
}


define service{
	use generic-service
	host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04,
	service_description .NET Runtime errors
	check_command check_nrpe!check_eventlog!-a "filter=provider = '.NET Runtime' and id = 1026 and message like 'unhandled exception'"
}


define service{
	use generic-service
	host_name per310-05
	service_description Print Service errors
	check_command check_nrpe!check_eventlog!-a "filter=provider = 'SLMD Print Service' and id = 0"
}

define service{
	use generic-service
	host_name per310-05
	service_description ENI errors in the event log
	check_command check_nrpe!check_eventlog!-a "filter=provider = 'Spacelabs Healthcare Event Notification Interface' and id = 0"
}

define service{
	use generic-service
	host_name per310-10
	service_description 12 Lead Interface errors
	check_command check_nrpe!check_eventlog!-a "filter=provider = 'SpacelabsHealthcare12 Lead ECG Interface' and id = 0"
}

define service{
	use generic-service
	host_name per720-01
	service_description Purge Data Status
	check_command check_nrpe!check_mssql!-a "-CheckType PurgeDataDuration -InstanceName icsdb"
}


define service{
	use generic-service
	host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04
	service_description Applications errors
	check_command check_nrpe!check_eventlog!-a "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'"
}

[raydx]

In using:
# 'check_nrpe' command definition
define command{
command_name check_nrpe
command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARGS$
}
I was able to tweak the services and except for the Application errors service, all of the services now functionally normally.

For the the Application errors service, I'm seeing:
different errors in re to Application Microsoft-Windows-Perflib.
The filter is "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'"

[tgriep]

Can you post the errors here when that service check is ran so we can view them?

[raydx]

CRITICAL: 6 message(s) Application SLNIService ([ProcID] = 1636 ThreadId = 37] Cannot connect to the database on attempt #1 Error number: 50000), Application Microsoft-Windows-Perflib (The Open Procedure for service "BITS" in DLL "C:WindowsSystem32bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.), Application Microsoft-Windows-PerfNet (Unable to read performance data for the Server service. The first four bytes (DWORD) of the Data section contains the status code, the second four bytes contains the IOSB.Status and the next four bytes contains the IOSB.Information.), Application Microsoft-Windows-PerfNet (Unable to read performance data for the Server service. The first four bytes (DWORD) of the Data section contains the status code, the second four bytes contains the IOSB.Status and the next four bytes contains the IOSB.Information.), System Microsoft-Windows-Time-Service (Time Provider NtpClient: No v

CRITICAL: 17 message(s) Application ESENT (sqlservr (1312) Error -1032 (0xfffffbf8) occurred while opening logfile C:Windowssystem32LogFilesSumApi.log.), Application ESENT (msmdsrv (1288) Error -1032 (0xfffffbf8) occurred while opening logfile C:Windowssystem32LogFilesSumApi.log.), Application ESENT (sqlservr (1312) An attempt to open the file "C:Windowssystem32LogFilesSumApi.log" for read only access failed with system error 5 (0x00000005): "Access is denied. ". The open file operation will fail with error -1032 (0xfffffbf8).), Application ESENT (msmdsrv (1288) An attempt to open the file "C:Windowssystem32LogFilesSumApi.log" for read only access failed with system error 5 (0x00000005): "Access is denied. ". The open file operation will fail with error -1032 (0xfffffbf8).), Application ESENT (msmdsrv (1288) Error -1032 (0xfffffbf8) occurred while opening logfile C:Windowssystem32LogFilesSumApi.log.), Application ESENT (sqlservr (1312) Error -1032 (0xfffffbf8) occurred while opening

CRITICAL: 6 message(s) Application VMware Tools ([ warning] [vmsvc:autoUpgrade] vmx returned Autoupgrade is not supported for guest.initiateUpgradeAtShutdown. ), Application Microsoft-Windows-Perflib (The Open Procedure for service "BITS" in DLL "C:WindowsSystem32bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.), System Microsoft-Windows-Iphlpsvc (Unable to update the IP address on Isatap interface isatap.etlabnet.local. Update Type: 1. Error Code: 0x490.), System AFD (A TDI filter (Drivervnetflt) was detected. This filter has not been certified by Microsoft and may cause system instability.), System Microsoft-Windows-WinRM (The WinRM service is not listening for WS-Management requests. User Action If you did not intentionally stop the service, use the following command to see the WinRM configuration: winrm enumerate winrm/config/listener), System Microsoft-Windows-WindowsUpdateClient (Unable to