Event view is getting loadded with Nagios error

[naranant]

Team,

I have installed the Nagios event log application to monitor the specific event in the windows event logged and it was working fine. But recently the event viewer is getting loaded with errors generated by the Nagios application. Need your help in troubleshooting this issue. Below is the error getting capture in the event log.
_____________________________________________________________________________________________________________________
The description for Event ID 0 from source NagiosEventLog cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Connection refused or timed out


The specified resource type cannot be found in the image file
_____________________________________________________________________

[benjaminsmith]

Hi @naranant,

We recently migrated the Windows Event Log Wizard ( version 1.3.4) to use NCPA instead of NagEventLog. I believe you'll find NCPA much easier to install and configure.

If so, you can upgrade to the latest version of the wizard from Admin > System Extenstions > Manage Config Wizards. Let me know. Thanks.

[naranant]

Thank you Benjamin. I will give a try.. Do i need to install any new agent on the target machine..

If you have any documentation on this please share the same.

Thank you..

[benjaminsmith]

Helo @naranant,

If you have any documentation on this please share the same.

Here's the guide for installing NCPA. Just let me know if you have questions.

NCPA Agent Installation Instructions

[naranant]

Hello,

I can follow the steps for installation of NCPA and it seems to be installed successfully. Currently what i am looking is to monitor the application event log for a specific error. I didnt find this configuration on the NCPA documentation can you please help me with that details.

Please find the below documentation i had earlier followed for the installation of event log monitoring.

https://assets.nagios.com/downloads/nag ... entLog.pdf

I need similar documentation for the NCPA.

[lmiltchev]

You can type in the browser:

Code: Select all

https://<client ip>:5693/gui/api

substituting the <client ip> with the actual IP address of your Windows machine. This way, you will be able to select "logs" from the API Endpoint drop-down menu, and review the syntax.

example01.PNG

You can experiment/play with different log filter serttings, select Run as a Nagios check check-box, and click on the Reload button to view the output. You can also view your check in "alternate format" as an active and passive check. Keep in mind, that the check format won't be displayed correctly for logs in particular. This option works fine for other end points. This should be fixed in future versions of NCPA. If you wanted to use passive checks, you could look at the URL that is used in active checks, and figure out the syntax.

Example:

Code: Select all

%HOSTNAME%|Application Logs = /logs?name=Application&event_id=0&check=true&warning=100&critical=400

You can add this line to the config that you are using for passive checks, e.g. etc/ncpa.cfg.d/example.cfg, and restart NCPA services, so that changes can take effect.

https://www.nagios.org/ncpa/help.php#pa ... onfiguring

Once the check result is sent to Nagios XI, you will find them in the Unconfigured Objects, and will be able to configure this service.

Hope this helps.

[naranant]

after the installation of ncpa when i try to launch using the url: https://<NCPA IP Address>:5693/

I am getting the page can't be displayed error..I have followed the steps for the installation and firewall rule is also completed

I have the nsclient already installed on the target machine do i need to uninstall before installing NCPA?.. I couldnt find any line item for NCPA in the windows services..

[lmiltchev]

Make sure that you have the following line in the ncpa.cfg file:

Code: Select all

ip = 0.0.0.0

Save, exit, and restart NCPA Listener and NCPA Passive services. Try to access this URL again:

Code: Select all

https://<NCPA IP Address>:5693/

Note: To make sure that port 5693 is open, run the following command from the command line on the Nagios XI server:

Code: Select all

nmap <client ip> -p 5693