nsclient send passive check real time system event log

[michaelli]

Hi,

Anyone have idea to configure windows nsclient agent send real time system event log to 2 nagiosxi (primary and redundant server).

According to nsclient documentation, this part is in "TODO" status.

http://docs.nsclient.org/0.4.3/tutorial ... log-checks

I have try to configure a new "server2" and don't use the "default" server but it is not to update the status to nagios xi NSCA server.

;[/settings/NSCA/client/targets/default]
;address=nsca://172.31.4.166:5667
;encryption=none
;password=password

[/settings/NSCA/client/targets/server2]
address=nsca://172.31.4.166:5667
encryption=none
password=password

from "nscp test" console, it always prompt below messages when a new error comes.
D eventlog Reading eventlog messages...
D eventlog Processing: 00000000004273A0
E core No handler for channel: server2
D:\source\nscp\service\NSClient++.cpp:1214
E eventlog Failed to submit 'system: 1 (error: testing critical error warning)

D:\source\nscp\include\parsers/filter/realtime_helper.hpp:12
1
D eventlog Next miss time is in: 259196s



Thank for who can provide the sample of configuration file and attached my "un-work" configuration file for reference.

[lmiltchev]

Were you able to send real-time system event-logs via NSCA to 1 server successfully? Did you follow the steps, outlined here?

[michaelli]

Hi lmiltchev,

Yes, nsclient is able to send the alert log to primary NSCA server which is configured in "[/settings/NSCA/client/targets/default]".

I would like to create multiple target server and then added to filter but there is no mention in documentation or any sample of configuration find in the internet.

[Box293]

I think they should be defined like this:

By default 5667 is the standard port, so it will work without defining it.

Code: Select all

[/settings/NSCA/client/targets/server1]
address = 172.31.4.165
encryption = 0
password = password

[/settings/NSCA/client/targets/server2]
address = 172.31.4.166
encryption = 0
password = password

[/settings/scheduler/schedules/server1]
interval = 1m

[/settings/scheduler/schedules/server2]
interval = 1m

I believe that
[/settings/scheduler/schedules/server1]
[/settings/scheduler/schedules/server2]

Will both use the checks in:
[/settings/scheduler/schedules]

I have some NSCA guides here, however I have not played with multiple targets:
http://sites.box293.com/nagios/guides/nsca

[michaelli]

Hi lmiltchev and Box293,

I also ask NSCLient Michael Medin this question and he is very helpful to give me the sample of configuration file.
This configuration works with NSClient++ - 0.4.3.131 version.

Thank you all help me to solve many nagios problem.

Below is his setting for reference
http://www.nsclient.org/answers/i-am-us ... swer-31339

What we do is add two NSCAClients (n1, n2) one for each server and then bind them to different “channels” (NSCA1, NSCA2).
These are the channels we can target later: in the filters.

[/modules]
n1 = NSCAClient
n2 = NSCAClient

CheckEventLog = enabled

[/settings/NSCA/n1]
channel = NSCA1

[/settings/NSCA/n1/targets/default]
host=IP1
encryption=none
password=password

[/settings/NSCA/n2]
channel = NSCA2

[/settings/NSCA/n2/targets/default]
host=IP2
encryption=none
password=password

[/settings/eventlog/real-time]
enabled = true
log = application,system
startup age = 30m

[/settings/eventlog/real-time/filters/EVT_Application]
log= application
filter=1=1
severity= ERROR
ok message= Autoreset, found no records in application eventlog
target=NSCA1,NSCA2
maximum age=10s

[ssax]

Thank you for posting the solution, marking this as resolved and locking it.