NRDS eventlog_nrpe_nt.exe configuration?

[matt.uebel]

I am having some difficulty with the eventlog_nrpe_nt.exe plugin.

I have the config as such

Code: Select all

command[nrpe_eventlog] = $PLUGIN_DIR$\eventlog_nrpe_nt.exe -m 7200

Which tells the plugin to examine the eventlog for the last 7200 minutes, or 5 days. Now I have a few questions.

• How does it determine the status code?

• So I should expect that, with this 5 day window, it will pick up events generated while the host is in a maintenance window? (This is the large problem at the moment)

• Should I expect any problem when setting the plugin to look back the last 3 minutes? This is the interval on which the NRDS task is set to run

[slansing]

Not sure on any of those questions, where did you find this plugin? Mind providing a link?

[matt.uebel]

The basic NRPE NT Plugins at:

http://exchange.nagios.org/directory/Pl ... ns/details

[slansing]

Have you considered using NSCLient++? NRPE_NT was abandoned in favor of it quite a while ago. NSClient++ is both easier to use, and easier to modify, with full support for event log monitoring:

http://www.nsclient.org/nscp/wiki/Check ... k_eventlog

[matt.uebel]

I haven't.

Do you know of any documentation for the eventlog_nrpe_nt.exe plugin? The executable itself responds to /? with a couple lines, and I have found very little documentation online. That would help me evaluate if we should start looking for another solution.

[matt.uebel]

Reading the NSClient++ Documentation (http://docs.nsclient.org/tutorial/core/index.html), I find for the Check Eventlog Module:

Check for errors and warnings in the event log. This is only supported through NRPE so if you plan to use only NSClient this won’t help you at all

We us passive checks with NRDS atm, and so this seems to be an issue.

Does NSClient++ allow for passive eventlog monitoring?

[slansing]

NRPE_NT uses NRPE the Nagios Remote Plugin Executor which is a active check. If you are looking for passive event log monitoring you may want to try out the Nag Event Log Monitor, though it is 3rd party:

http://exchange.nagios.org/directory/Ad ... og/details

[matt.uebel]

Well it seems that we actually do have passive service checks with NRDS setup atm.

I check the core config, find the xiwizard_passive_service template, which has passive checks enabled and active checks disable. The unconfigured object wizard uses this template when it creates services from the data the NRDS clients send in.

Am I missing something?

[slansing]

Sorry that was worded a bit strangely, yes NRDS is a passive protocol. I was pointing out that NRPE_NT uses active checking to accomplish it's goals. I would take a look at what I linked in the previous post.

[yancy]

How does it determine the status code?

The status code is determined by the number of "errors" in the event log over a given time period.

additionaly, you can exlude or include by service ID
usage: eventlog_nrpe_nt.exe -m minutes <-s "exluded service,..."> -i <"exluded eventid,..."> Do not include unnecesary white space it will not be removed
example: service_nrpe_nt.exe -m 20 -s "NRPE_NT,..." -i "7011,..."
example: service_nrpe_nt.exe -m 7200

So I should expect that, with this 5 day window, it will pick up events generated while the host is in a maintenance window? (This is the large problem at the moment)

I'm not sure what you mean by maintenance window. Can you clarify?

Should I expect any problem when setting the plugin to look back the last 3 minutes? This is the interval on which the NRDS task is set to run

I don't see this causing any issue. That makes sense to match the interval that NRDS to checks.

Nagevent log is also a great solution if the only check on the system you wish to perform is checking the event log. Unfortunately Nageventlog hasn't been maintained recently.