Filter out unwanted events

[John_kadet]

Hello.
I have NSClient++ (x64) on Windows Server 2008, and i need to filter some of errors on it. For example i don't want to get notification about error in system log with Event ID = 5. Could you please help me to configure my NSClient ?
I'm new to this

[rkennedy]

Can you show us the service definition, and related command definitions (from NSClient and Nagios) so that we can see how you have things defined currently?

[John_kadet]

Can you show us the service definition, and related command definitions (from NSClient and Nagios) so that we can see how you have things defined currently?

Where can i get this information ?

[rkennedy]

Navigate to Configure -> Core Config Manager -> Services -> Find the service that you're looking to change -> Click the 'View Text Config' (floppy disk) icon under 'Actions'.

Post this text config for us to look at.

[John_kadet]

I don't have access to Shinken server, but i have an access to configure nsclient.ini file on target server.
It is a nsclient.ini. What i should add to it, to filter by Event ID ?

Code: Select all

[/settings/default]
allowed hosts = host-01, host-02, host-03, host-04, host-05
bind to =
cache allowed hosts = 1
encoding =
inbox = inbox
password =
socket queue size = 0
thread pool = 10
timeout = 30

[/modules]
CheckSystem = 1
CheckDisk = 1
CheckExternalScripts = 1
NRPEServer = 1
CheckHelpers = 1
CheckEventLog = 1
CheckNSCP = 0
SimpleFileWriter = 0
PythonScript = 0
NSClientServer = 0
NSCAClient = 0
NRDPClient = 0
CommandClient = 0
CheckTaskSched = 0
NSCAServer = 0
CheckLogFile = 0
DotnetPlugins = 0
SyslogClient = 0
Scheduler = 0
NRPEClient = 0
GraphiteClient = 0
SMTPClient = 0
CheckWMI = 0
SimpleCache = 0

[/settings/NRPE/server]
allow arguments = true
allow nasty characters = true
port = 5666
verify mode = none
insecure = true

[/settings/NSClient/server]
allowed ciphers = ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
bind to=
ca = ${certificate-path}/ca.pem
cache allowed hosts = 1
certificate = ${certificate-path}/certificate.pem
certificate format = PEM
certificate key =
dh = ${certificate-path}/nrpe_dh_512.pem
password =
performance data = 1
port = 12489
socket queue size = 0
ssl options =
thread pool = 10
timeout = 30
use ssl = 0
verify mode = none

[/settings/log]
level = warning
file name = ${exe-path}/nsclient.log
date format = %Y-%m-%d %H:%M:%S

[/settings/log/file]
max size = 204800

[/settings/external scripts]
timeout = 60
allow nasty characters = 0
allow arguments = 1

[mcapra]

You can do some filtering with NSClient++, but the filtering is generally done on the Nagios end of things (not the remote machine). We need to first understand how the checks are being executed before we can offer much insight.
https://docs.nsclient.org/tutorial/chec ... ml#filters

If you are using CheckEventLog, the filter should be fairly simple. Perhaps something like "filter= id!= 5" added to the Service check arguments will give you the desired effect:
http://docs.nsclient.org/0.4.2/referenc ... log.filter

However, the information requested by @rkennedy is fairly important in terms of giving a definitive answer.

[bwallace]

I don't have access to Shinken server

Aha, I think we've identified the initial the stumbling block here - Shinkin is an entirely different product which we do not support, sorry. You'll have to contact Shinken support regarding this issue. I'll lock this thread now.