Monitoring Windows Event Logs

[josh.rodriguez]

Can anyone provide some documentation on Monitoring Windows Event Logs from Nagios XI?

[rdedon]

Hello Josh,
I have emailed you some information that will hopefully help. Please respond here if that is not quite you you are after or have any additional questions.

Thanks!

[admin]

We just created a new document that describes how to monitor event logs on Windows systems using the NagEventLog agent. A new monitoring wizard was just created for this as well.

You can read the step-by-step guide for monitoring event logs at:

http://library.nagios.com/library/produ ... -nagios-xi

Hope that helps.

[josh.rodriguez]

Thanks. I will give this a try.

[rdedon]

Thank you and just contact us again if you require any additional assistance.

[josh.rodriguez]

I have followed the step by step guide and when I test NSCA daemon i receive

Error: could not connect to host 10.x.x.x on port 5667 (2)

I verified that the service is running and is not being blocked by a firewall.

Any ideas?

[mguthrie]

You'll need to make sure you've added your client machine to the list of allowed hosts under xinetd.

Edit
/etc/xinet.d/nsca

and add your client machine to the list of allowed addresses, then restart xinetd.

Make sure your nsca password and encryption method are set on both the send_nsca.cfg (client) and the nsca.cfg (server).


http://library.nagios.com/library/produ ... -nagios-xi

[josh.rodriguez]

Thanks for the reply. I have done those things already.

here is my nsca config
# default: on
# description: NSCA (Nagios Service Check Acceptor)
service nsca
{
flags = REUSE
socket_type = stream
wait = no
user = nagios
group = nagios
server = /usr/local/nagios/bin/nsca
server_args = -c /usr/local/nagios/etc/nsca.cfg --inetd
log_on_failure += USERID
disable = no
only_from = 10.0.199.145
{

Also, password on the client (10.0.199.145) matches the nsca.cfg file.

[rdedon]

I noticed on the end there you have a "{", could you please invert that to a "}" (no quotes) if that is how it appears in the code. And respond with results?

Thank you.

[josh.rodriguez]

Made that change and still the same result.

{
flags = REUSE
socket_type = stream
wait = no
user = nagios
group = nagios
server = /usr/local/nagios/bin/nsca
server_args = -c /usr/local/nagios/etc/nsca.cfg --inetd
log_on_failure += USERID
disable = no
only_from = 10.0.199.145
}