Page 1 of 1
Filter out unwanted events
Posted: Wed Aug 03, 2016 5:00 am
by John_kadet
Hello.
I have NSClient++ (x64) on Windows Server 2008, and i need to filter some of errors on it. For example i don't want to get notification about error in system log with Event ID = 5. Could you please help me to configure my NSClient ?
I'm new to this
Re: Filter out unwanted events
Posted: Wed Aug 03, 2016 10:20 am
by rkennedy
Can you show us the service definition, and related command definitions (from NSClient and Nagios) so that we can see how you have things defined currently?
Re: Filter out unwanted events
Posted: Thu Aug 04, 2016 4:28 am
by John_kadet
rkennedy wrote:Can you show us the service definition, and related command definitions (from NSClient and Nagios) so that we can see how you have things defined currently?
Where can i get this information ?
Re: Filter out unwanted events
Posted: Thu Aug 04, 2016 9:39 am
by rkennedy
Navigate to Configure -> Core Config Manager -> Services -> Find the service that you're looking to change -> Click the 'View Text Config' (floppy disk) icon under 'Actions'.
Post this text config for us to look at.
Re: Filter out unwanted events
Posted: Fri Aug 05, 2016 5:15 am
by John_kadet
I don't have access to Shinken server, but i have an access to configure nsclient.ini file on target server.
It is a nsclient.ini. What i should add to it, to filter by Event ID ?
Code: Select all
[/settings/default]
allowed hosts = host-01, host-02, host-03, host-04, host-05
bind to =
cache allowed hosts = 1
encoding =
inbox = inbox
password =
socket queue size = 0
thread pool = 10
timeout = 30
[/modules]
CheckSystem = 1
CheckDisk = 1
CheckExternalScripts = 1
NRPEServer = 1
CheckHelpers = 1
CheckEventLog = 1
CheckNSCP = 0
SimpleFileWriter = 0
PythonScript = 0
NSClientServer = 0
NSCAClient = 0
NRDPClient = 0
CommandClient = 0
CheckTaskSched = 0
NSCAServer = 0
CheckLogFile = 0
DotnetPlugins = 0
SyslogClient = 0
Scheduler = 0
NRPEClient = 0
GraphiteClient = 0
SMTPClient = 0
CheckWMI = 0
SimpleCache = 0
[/settings/NRPE/server]
allow arguments = true
allow nasty characters = true
port = 5666
verify mode = none
insecure = true
[/settings/NSClient/server]
allowed ciphers = ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
bind to=
ca = ${certificate-path}/ca.pem
cache allowed hosts = 1
certificate = ${certificate-path}/certificate.pem
certificate format = PEM
certificate key =
dh = ${certificate-path}/nrpe_dh_512.pem
password =
performance data = 1
port = 12489
socket queue size = 0
ssl options =
thread pool = 10
timeout = 30
use ssl = 0
verify mode = none
[/settings/log]
level = warning
file name = ${exe-path}/nsclient.log
date format = %Y-%m-%d %H:%M:%S
[/settings/log/file]
max size = 204800
[/settings/external scripts]
timeout = 60
allow nasty characters = 0
allow arguments = 1
Re: Filter out unwanted events
Posted: Fri Aug 05, 2016 9:47 am
by mcapra
You can do some filtering with NSClient++, but the filtering is generally done on the Nagios end of things (not the remote machine). We need to first understand how the checks are being executed before we can offer much insight.
https://docs.nsclient.org/tutorial/chec ... ml#filters
If you are using
CheckEventLog, the filter should be fairly simple. Perhaps something like
"filter= id!= 5" added to the Service check arguments will give you the desired effect:
http://docs.nsclient.org/0.4.2/referenc ... log.filter
However, the information requested by
@rkennedy is fairly important in terms of giving a definitive answer.
Re: Filter out unwanted events
Posted: Fri Aug 05, 2016 10:17 am
by bwallace
I don't have access to Shinken server
Aha, I think we've identified the initial the stumbling block here - Shinkin is an entirely different product which we do not support, sorry. You'll have to contact Shinken support regarding this issue. I'll lock this thread now.