NagEventLog alert truncated at 192 Char

[tgriep]

The nagEventLog application is written in Visual C++.
During the installation of the application, there is an option to install the Source Code. If you select that, the code should be in this folder.

Code: Select all

C:\Program Files (x86)\Monitoring\source

You do not have to do anything in XI it is set to accept up to 8192 characters.

[brucej543]

I have checked the source code and the Max_PLUGINOUTPUT_LENGTH is set to 512, which rules out that part of the code. There is another defined limit of 128 Char for MAX_DESCRIPTION_LENGTH in the Code. Could these be truncating the message to Nagios and if it is, can it be changed?

[tgriep]

Take a look at this line from the event.c file in the nagevlog folder.

Code: Select all

char nscamsg[256];

From what I read, that is what is limiting the data to 256 characters.

The nagEventLog application was not developed by Nagios so you would have to setup an environment to recompile the Agent to create a larger buffer.

[brucej543]

After discussing this with the developer of nagEventLog, we may not use this because it has not been touched or updated by him for over long period of time and is not sure it will function correctly on the newer Windows servers. Do you know if Nagios will be updating this or if some sort of NCPA plugin is being developed as a replacement?

[tgriep]

No, we are not maintaining the nagEventLog application.

The NCPA agent does have ability to send event log data. I posted these examples earlier.

Code: Select all

%HOSTNAME%|EVT_Application = /logs --name Application --logged_after 5m --severity ERROR --check true --event_id 1 --warning 10 --critical 20
%HOSTNAME%|EVT_Security = /logs --name Security --logged_after 200m --severity AUDIT_FAILURE --event_id 4776 --check true --warning 3 --critical 5

For more details on the NCPA log settings, take a look at this link.
https://www.nagios.org/ncpa/help.php#api-modules-logs

[brucej543]

Thanks for your help again. I did configure the agent to send the log data and it was received. But there must be something on how windows puts the data to the log because even thought I got a larger amount of data, I was getting the field name, but now the data in that field.
Thanks

[tgriep]

Can you provide a screen capture of what the data looks like in the XI interface.
Do you only want the data to be displayed but not the field name?

[brucej543]

I have attached two documents of the Service Status Detail Overview screen that show what was received.

[tgriep]

Are you saying that you do not want the data to say

Security Logs
Time: Computer: Severity: Event ID: Source: Message?
-----------------------------------

In the XI interface?

[brucej543]

Sorry for late response to your request. another higher project issue came along. I have attached the screen shot of the XI interface that show logs have been received.