Exclude EventID Check_WMI

This support forum board is for support questions relating to Nagios XI, our flagship commercial network monitoring solution.
Locked
davide.bonicelli
Posts: 134
Joined: Thu Feb 13, 2014 5:12 am

Exclude EventID Check_WMI

Post by davide.bonicelli »

Hi, I have a problem checking the error on the event log with the check_wmi_plus; I'm trying to check the error on the system log in the last hour and if they're more than 50 it sends an alert; I've tried to add the exclusion of the event 10028 from the monitor but it does not seem to work; the Check WMI Plus version 1.60 and the same exclusion on another Nagios (with the same OS and Check WMI version) works perfectly.
The OS of the Nagios is CentOS release 6.9 (Final)

here's the command i launch
/opt/check_wmi_plus.pl -H 192.168.1.132 -A /etc/authfile -t 45 -m checkeventlog System -w 50 -4 id_10028

here's what's inside the events.ini on /usr/local/nagios/libexec/events.ini
# LSL -------------------------------------------------------------------
[id_10028]

ec=10028
# -----------------------------------------------------------------------

can someone help me understand if I'm doing something wrong?
Thanks
Top
dchurch
Posts: 858
Joined: Wed Oct 07, 2020 12:46 pm
Location: Yo mama

Re: Exclude EventID Check_WMI

Post by dchurch »

What's the exact output from running the plugin from the command line?
If you didn't get an 8% raise over the course of the pandemic, you took a pay cut.

Discussion of wages is protected speech under the National Labor Relations Act, and no employer can tell you you can't disclose your pay with your fellow employees.
Top
davide.bonicelli
Posts: 134
Joined: Thu Feb 13, 2014 5:12 am

Re: Exclude EventID Check_WMI

Post by davide.bonicelli »

that's the output i get from command line

WARNING - [Triggered by _ItemCount>50] - 162 event(s) of Severity Level: "Error", were recorded in the last 1 hours from the System Event Log. (List is on next line. Fields shown are - Logfile:TimeGenerated:EventId:EventCode:SeverityLevel:Type:SourceName:Message)|'Event Count'=162;50;
System:20210820162439.057636-000:10016:10016:Errore:Microsoft-Windows-DistributedCOM:Le impostazioni delle autorizzazioni impostazioni specifiche dell'applicazione non concedono l'autorizzazione di Attivazione in Locale per l'applicazione server COM con CLSID {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} e APPID {F72671A9-012C-4725-9D2F-2A4D32D65169} all'utente NT AUTHORITY\SID SYSTEM (S-1-5-18) dall'indirizzo LocalHost (tramite LRPC) in esecuzione nel SID del contenitore di applicazioni Non disponibile (Non disponibile). Per modificare tale autorizzazione di sicurezza, Þ possibile utilizzare lo strumento amministrativo Servizi componenti.
System:20210820162323.251750-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.17 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820162313.704063-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.17 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820162302.230396-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.17 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820162252.681497-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.17 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820162231.658860-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.17 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820162210.632598-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.17 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161659.313186-000:1073741828:4:Errore:Microsoft-Windows-Security-Kerberos:Client Kerberos: ricevuto errore KRB_AP_ERR_MODIFIED dal server cm-srvdc02$. Nome di destinazione utilizzato: cifs/SRVMASCHIO. Tale errore indica che il server di destinazione non Þ stato in grado di decrittografare il ticket fornito dal client. Ci‗ pu‗ accadere quando il nome dell'entitÓ server (SPN) di destinazione Þ registrato in un account diverso da quello utilizzato dal servizio di destinazione. Verificare che l'SPN di destinazione sia registrato solo nell'account utilizzato dal server. Questo errore pu‗ verificarsi anche quando la password dell'account del servizio di destinazione Þ diversa da quella configurata nel Centro distribuzione chiavi (KDC) Kerberos per tale servizio di destinazione. Verificare che il servizio sul server e il KDC siano configurati in modo da utilizzare la stessa password. Se il nome del server non Þ completo e il dominio di destinazione (RIUNITE.IT) Þ diverso dal dominio client (RIUNITE.IT), verificare che in entrambi i domini esistano account server con nomi identici oppure utilizzare il nome completo per identificare il server.
System:20210820161651.250852-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.4 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161650.633950-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.4 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161650.016922-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.4 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161649.412935-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.4 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161648.793963-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.4 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161648.176168-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.4 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161647.690637-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.3 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161646.825916-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.3 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161646.171225-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.3 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161645.301941-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.1 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161645.085210-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.3 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161643.519715-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.3 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161642.217453-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.3 utilizzando i protocolli configurati. Richiesta PID a4c (C:\Users\admin.darior\AppData\Local\Programs\Python\Python36\lib\site-packages\win32\PythonService.exe).
System:20210820161640.429386-000:10028:10028:Errore:Microsoft-Windows-DistributedCOM:DCOM: impossibile comunicare con il computer 192.168.32.1 utilizzando i protocolli configurati[root@nagiosxi ~]#
Top
dchurch
Posts: 858
Joined: Wed Oct 07, 2020 12:46 pm
Location: Yo mama

Re: Exclude EventID Check_WMI

Post by dchurch »

What is the output from

Code: Select all

check_wmi_plus.pl --debug -H 192.168.1.132 -A /etc/authfile -t 45 -m checkeventlog System -w 50 -4 id_10028
If you didn't get an 8% raise over the course of the pandemic, you took a pay cut.

Discussion of wages is protected speech under the National Labor Relations Act, and no employer can tell you you can't disclose your pay with your fellow employees.
Top
dchurch
Posts: 858
Joined: Wed Oct 07, 2020 12:46 pm
Location: Yo mama

Re: Exclude EventID Check_WMI

Post by dchurch »

Can you try a different way of excluding (events.ini):

Code: Select all

# LSL -------------------------------------------------------------------
[id_10028]

ei=10028
# -----------------------------------------------------------------------
If you didn't get an 8% raise over the course of the pandemic, you took a pay cut.

Discussion of wages is protected speech under the National Labor Relations Act, and no employer can tell you you can't disclose your pay with your fellow employees.
Top
davide.bonicelli
Posts: 134
Joined: Thu Feb 13, 2014 5:12 am

Re: Exclude EventID Check_WMI

Post by davide.bonicelli »

Hi Dchurch, I've tried doing the exclusion inside the event.ini as you suggested but the error 10028 still get caught by the monitor

Here's a .txt file with everything it wrote with the --debug message (sorry but in the beginning, it was a little truncated by putty because there were too many lines to show)
https://www.screencast.com/t/2GlWQqwYVxpJ

let me know if you need something else
Top
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Exclude EventID Check_WMI

Post by ssax »

I labbed it up and only works if I add --inifile:

Code: Select all

/opt/check_wmi_plus.pl -H 192.168.1.132 -A /etc/authfile -t 45 -m checkeventlog System -w 50 --inifile /usr/local/nagios/libexec/events.ini -4 id_10028
I think you would need to put it in the check_wmi_plus.ini file for it to work without the command line inifile argument.
Top
davide.bonicelli
Posts: 134
Joined: Thu Feb 13, 2014 5:12 am

Re: Exclude EventID Check_WMI

Post by davide.bonicelli »

Hi, ssax,
thanks; by adding the --inifile the exclusion works fine.
I've modified the check_wmi_plus.ini as suggested and now it works perfectly
Top
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Exclude EventID Check_WMI

Post by ssax »

That's great to hear! Let us know when we're okay to lock this up and mark it as resolved.
Top
davide.bonicelli
Posts: 134
Joined: Thu Feb 13, 2014 5:12 am

Re: Exclude EventID Check_WMI

Post by davide.bonicelli »

yup; you can mark the thread as resolved.
thanks for the help
Top
Locked

Return to “Nagios XI”