Page 1 of 1

NSclient++ check_eventlog

Posted: Wed Sep 27, 2017 7:36 am
by very_best
Hello!

I want to check the Windows Event log but I don't want to get out performance-date. Their is a possibilty with perf-config. Default: perf-config=level(ignored:true)

If I set the value to false I also get the perf-data:

Code: Select all

/usr/lib/nagios/plugins/check_nrpe -t 50 -H <Servername/IP> -c check_eventlog -a file=application scan-range=-50m "filter=id=2009 or id=2937" "warning=id=2009 or id=2937" "critical=none" "top-syntax=%(status): %(count) message(s) found for id(s) 2009, 2937" "perf-config=level(ignored:false)"
WARNING: 3 message(s) found for id(s) 2009, 2937|'Application_MSExchange Mid-Tier Storage_id'=2009;2009;0 'Application_MSExchange Mid-Tier Storage_id'=2009;2009;0 'Application_MSExchange Mid-Tier Storage_id'=2009;2009;0
I have 2 questions:
- 1) What can I do that I don't geht perf-date out?
- 2) If I get PerfData out the perf-Name should have the Name of the Counter and the Id. Example: Application_MSExchange Mid-Tier Storage_id_2009'=3;10;20.
What do I have to change that I get this output?

Re: NSclient++ check_eventlog

Posted: Wed Sep 27, 2017 2:29 pm
by dwasswa
For,
1) What can I do that I don't geht perf-date out?

Code: Select all

change perf-config=level(ignored:true)
to

Code: Select all

perf-config=level(ignored:false)

Re: NSclient++ check_eventlog

Posted: Thu Sep 28, 2017 7:39 am
by very_best
Hello!

1) thank for answer!

does anyone can give me an answer for 2nd question?

rg
Hansi

Re: NSclient++ check_eventlog

Posted: Thu Sep 28, 2017 12:39 pm
by mcapra
The NSClient++ forums are likely a better place to discuss specifics.

perf-syntax is most likely the appropriate directive for such changes. The documentation for the check_eventlog command shows the available key/value pairs:
https://docs.nsclient.org/reference/win ... erf-syntax

Re: NSclient++ check_eventlog

Posted: Thu Sep 28, 2017 4:22 pm
by tgriep
Thanks @mcapra for the help.
@very_best, if have any more questions, post them here.