nrpe & checkeventlog

[robert.anderko]

Hi guys,
i trying get errors from application log in Windows server. When i try:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H ru-aur-p-602 -c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 "filter=generated > -1d AND level = 'error'"

i get:

Code: Select all

Test(error, 6005, success)[test, ], MSSQL$RU_AUR_P_602(error, 6005, success)[test, ], MSSQL$RU_AUR_P_607(error, 6005, success)[test, ], eventlog: 3 > critical|'eventlog'=3;1;1

but with command:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H ru-aur-p-602 -c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 "filter=generated > -1d AND source='MSSQL$RU_AUR_P_607'"

i get

Code: Select all

Eventlog check ok|'eventlog'=0;1;1

Any idea how can i get errors for logsource MSSQL$RU_AUR_P_602 ? and with another check only for MSSQL$RU_AUR_P_607 ?
thx for help

[ssax]

Try it with this:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H ru-aur-p-602 -c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 'filter=generated > -1d AND source=\'MSSQL$RU_AUR_P_607\''

And this:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H ru-aur-p-602 -c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 'filter=generated > -1d AND source=\'MSSQL\$RU_AUR_P_607\''

Or this:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H ru-aur-p-602 -c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 "filter=generated > -1d AND source='MSSQL\$RU_AUR_P_607'"

Let us know the results.


Thank you

[robert.anderko]

Hi ssax,
last example seems work OK. thx for reply & for usefull help. This thread can be locked.

[robert.anderko]

hi guys,
maybe, i have question - from bash, is all ok:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H host -c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 "filter=generated > -5m AND source='MSSQL\$RU_AUR_P_601' AND lev
Eventlog check ok|'eventlog'=0;1;1

But from, GUI:

Code: Select all

COMMAND: /usr/local/nagios/libexec/check_nrpe -H host -t 60 -c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 "filter=generated \> -5m AND source=\'MSSQL\\\$RU_AUR_P_601\' AND level = \'error\'"
OUTPUT: Parsing failed: generated \> -5m AND source=\'MSSQL\$RU_AUR_P_601\' AND level = \'error\'

any idea?
thx

[Box293]

Due to some issues with how PHP escapes characters the "Test Check Command" does not work in these situations and should be ignored.

So for all further testing of this service you need to:

Make the changes to the service
Save the Service
Apply Configuration
Go back to the home screen and find the Service
When viewing the Service Status Details page click the Schedule a forced immediate check link

Just to re-iterate, for all further testing for this service DO NOT use the "Test Check Command" button, follow the steps above.

[robert.anderko]

Box,
was tested your "process" but results are:

Code: Select all

Parsing failed: $

[Box293]

In your Service Definition you'll need MSSQL\$$RU_AUR_P_601

https://support.nagios.com/kb/article.php?id=168

[robert.anderko]

Box239,
all works! thx for fast reply and for interesting manual.

[Box293]

Excellent, glad to help you get it working.