Nagios Support Forum

One of the service check is in Unknown state.

Following is the check command.


[root@nagios server]# ./check_nrpe -H host1 -p 5666 -c CheckEventLog -a filter=new file=system MaxWarn=1 MaxCrit=1 filter-generated=\>5m filter+eventID=="10004" filter+eventType==error filter+eventSource==DCOM filter=in filter=all truncate=30
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).



[root@nagios server]# ./check_nrpe -H host1 -p 5666 -c CheckEventLog -a filter=new file=system
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).


[root@nagios server]# ./check_nrpe -H host1 -p 5666
I (0.3.5.1 2008-09-24) seem to be doing fine...

What could be the problem.

host1 is the windows server.

We are using Nagios core.

I'm not sure how you determined what string to use but your filters do not seem valid.

What do you get if you run Do you have CheckEventLog enabled in the .ini file?

Also, I'm not 100% sure when that was added to NSClient++ as that is not our project but the current version is 0.5.2

Here are the docs
https://docs.nsclient.org/reference/win ... kEventLog/

Following is the output we are getting.

[root@nagiosserver]# ./check_nrpe -H host1 -p 5666 -c CheckEventLog -a file=system
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).

Pratapa wrote:Do you have CheckEventLog enabled in the .ini file?

I don't see CheckEventLog=enabled or CheckEventLog=1 in nsc.ini file

Pratapa wrote: I don't see CheckEventLog=enabled or CheckEventLog=1 in nsc.ini file

You will definitely need to add that and then restart NSClient++

We will enable CheckEventLog and let you know.

This is fixed after enabling the CheckEventLog in .ini file.

Thank you for your help.

You may lock the thread.

Pratapa wrote:This is fixed after enabling the CheckEventLog in .ini file.

Thank you for your help.

You may lock the thread.

Great!

Locking thread