Page 2 of 3
Re: NagEventLog alert truncated at 192 Char
Posted: Fri Mar 15, 2019 9:04 am
by tgriep
The nagEventLog application is written in Visual C++.
During the installation of the application, there is an option to install the Source Code. If you select that, the code should be in this folder.
Code: Select all
C:\Program Files (x86)\Monitoring\source
You do not have to do anything in XI it is set to accept up to 8192 characters.
Re: NagEventLog alert truncated at 192 Char
Posted: Mon Mar 18, 2019 1:22 pm
by brucej543
I have checked the source code and the Max_PLUGINOUTPUT_LENGTH is set to 512, which rules out that part of the code. There is another defined limit of 128 Char for MAX_DESCRIPTION_LENGTH in the Code. Could these be truncating the message to Nagios and if it is, can it be changed?
Re: NagEventLog alert truncated at 192 Char
Posted: Mon Mar 18, 2019 1:55 pm
by tgriep
Take a look at this line from the event.c file in the nagevlog folder.
From what I read, that is what is limiting the data to 256 characters.
The nagEventLog application was not developed by Nagios so you would have to setup an environment to recompile the Agent to create a larger buffer.
Re: NagEventLog alert truncated at 192 Char
Posted: Thu Mar 21, 2019 9:38 am
by brucej543
After discussing this with the developer of nagEventLog, we may not use this because it has not been touched or updated by him for over long period of time and is not sure it will function correctly on the newer Windows servers. Do you know if Nagios will be updating this or if some sort of NCPA plugin is being developed as a replacement?
Re: NagEventLog alert truncated at 192 Char
Posted: Thu Mar 21, 2019 12:07 pm
by tgriep
No, we are not maintaining the nagEventLog application.
The NCPA agent does have ability to send event log data. I posted these examples earlier.
Code: Select all
%HOSTNAME%|EVT_Application = /logs --name Application --logged_after 5m --severity ERROR --check true --event_id 1 --warning 10 --critical 20
%HOSTNAME%|EVT_Security = /logs --name Security --logged_after 200m --severity AUDIT_FAILURE --event_id 4776 --check true --warning 3 --critical 5
For more details on the NCPA log settings, take a look at this link.
https://www.nagios.org/ncpa/help.php#api-modules-logs
Re: NagEventLog alert truncated at 192 Char
Posted: Fri Mar 22, 2019 1:01 pm
by brucej543
Thanks for your help again. I did configure the agent to send the log data and it was received. But there must be something on how windows puts the data to the log because even thought I got a larger amount of data, I was getting the field name, but now the data in that field.
Thanks
Re: NagEventLog alert truncated at 192 Char
Posted: Fri Mar 22, 2019 2:51 pm
by tgriep
Can you provide a screen capture of what the data looks like in the XI interface.
Do you only want the data to be displayed but not the field name?
Re: NagEventLog alert truncated at 192 Char
Posted: Mon Mar 25, 2019 9:37 am
by brucej543
I have attached two documents of the Service Status Detail Overview screen that show what was received.
Re: NagEventLog alert truncated at 192 Char
Posted: Mon Mar 25, 2019 1:47 pm
by tgriep
Are you saying that you do not want the data to say
Security Logs
Time: Computer: Severity: Event ID: Source: Message?
-----------------------------------
In the XI interface?
Re: NagEventLog alert truncated at 192 Char
Posted: Thu Mar 28, 2019 12:25 pm
by brucej543
Sorry for late response to your request. another higher project issue came along. I have attached the screen shot of the XI interface that show logs have been received.