Nagios Support Forum

Hi,

I use NSClient++ - 0.4.3.131 for monitoring real time event log in windows client. But I find out a error messages display in nagios is not match in windows event viewer.

Refer to I attached screen dump. ID 6389 is logged in event viewer but in nagios get the alter but the message content does not to event viewer.

I try to filter this ID 6389 and it success. This result show ID 6389 can logged by nagios but message content not match.

Could you have any idea for this issue?

What does your check command look like on Nagios XI? Please look at the check under 'Configure -> Core Config Manage -> Services -> <servicename>' and send us the check command that is being used.

michaelli wrote:Refer to I attached screen dump. ID 6389 is logged in event viewer but in nagios get the alter but the message content does not to event viewer.

Just to be clear - are you sure you're not intermixing results? You stated that 6389 is logged, but you showed us 6398.

Hi jdalrymple,

Because the content are not match in nagios log and event log. So that I add the event ID to ignore list to make sure they are the same error.

michaelli,

Please get us the information I have listed above so that we can attempt reproduction on our end.

HI jolson,

kindly find attached nsclient ini for reference. This ini file enable to send real time system log into 2 nagios NSCA server.
You can see the error is triggered by MS sharepoint.

Most "application" log contain long error message and it cannot full display in nagios (max. display 3 rows in nagios). I think nsclient need to consider how to handle long error messages.

Please feel to contact me if any detail information need and we are the customer for XI enterprise subscription.

michaelli,

jdalrymple and myself have been testing real time event monitoring to try and get this working for you - and we would like to see your nsclient.log file. It should be located in the NSClient directory of your problem Windows Server.

Are any other Application logs being reported properly from your Windows Server - in other words, are the Sharepoint logs the only ones with issues?

This problem looks like it's caused by NSClient, and not the event log/nagios. NSClient reported the error "could not extract DLL for evensource etc" back to Nagios, which read and displayed the error message. Ultimately if the issue can't be traced by your nsclient.log, we may need you to attempt an upgrade of NSClient on that box.