Monitoring Event ID's

[benhank]

We are monitorng 4 event ID's on 90 Citrix servers. All these are from the System log. Today we added two more, one from the system log and one from the application log. On 70 servers everything worked. On the 20 remaining servers the CPU spiked to 100% and the new event ID that Nagios was checking from the application log timed out. As it turns out, these 20 servers had been having connection issues which was why we were adding event ID 118 to the checks. At this point we don't know if the connection issue caused the timeout for only that specific event ID (the others continued to work fine) or if the check compounded the problem. So my question is has anyone run into any issues monitoring event ID's. Can a specific ID cause issues like we have seen or does it create a load on the system. We are only looking back 30 minutes into the log so it will report only a recent event and it will go away after 30 minutes if it doesn't reoccur.

Thanks for any insight.
Greg

[abrist]

I wish I had some insight on this, but we do not have any Citrix servers in house to test on. You may want to change your topic's title to something more citrix specific so as to attract more attention from someone who may have dealt with citrix and nagios in the past.