Critical if no eventlog has been generated (check_nrpe)

[Dobi]

Hello,

I have a question about a nagios plugin (check_nrpe & nsclient++):
There is a script that generates an eventlog every x minutes. If it is not generated, than Nagios should change the status to critical.
Till now I have no idea to do this with those “MinCritical” and “MaxCritical” values.

(Btw., sry if I’m on the wrong subforum…)

Greetings,
Cédric

[slansing]

You may be in the correct sub forum, but without seeing the script we can't really help you that much, can you provide more information? If you are talking about the built in event log checking module, nsclient has documentation on this here:

https://nsclient.org/nscp/wiki/CheckEve ... k_eventlog

[Dobi]

Thanks for the link, but I have already looked at that page but till now nothing found on sth. like this “problem”.
The events that are generated have to do with a script that checks some stuff on the mail server. At the current time it is not possible to do it another way.

What is known are the EventID and the Source. E.g. all 30 minutes has to be checked if the event has is existing or not. If not: Status -> Critical

[abrist]

You may be in the correct sub forum, but without seeing the script we can't really help you that much, can you provide more information?

Any chance that you could link us to the script and also post the command/check configuration?

[Dobi]

You may be in the correct sub forum, but without seeing the script we can't really help you that much, can you provide more information?

Any chance that you could link us to the script and also post the command/check configuration?

I spoke with the other guys and there is no chance that I’m allowed to do some changes on the script or to put it on the web.

With the version 0.4.2 of the NSC++ we can do the check like that:
alias_event_log = check_eventlog file=application "filter=source='Alarmtilt' AND id='100'" "crit=count<1" "scan-range=-15m"
But the 0.4.2 version isn’t a stable release.

We just need sth. in Nagios to check if a Windows eventlog is missing.

[sreinhardt]

In all fairness, no version of nsclient is considered stable, all are in alpha or beta at all times, per the developer, just to make sure you are aware. Otherwise, you are purely looking to verify that an event, has been placed in the log, within x minutes? If so, this would be a relatively easy powershell or vbs script to write, although I know of nothing that would do it out of the box, generally people wish to see that items are not in the event log.