How to monitor a specific Microsoft windows eventid

Question

How to monitor a specific Microsoft windows eventid with OP5 Monitor?

Answer

You can use a function builtin to NSClient. The function is called check_eventlog. Download the latest version of NSClient++ from this page:

When you have installed the agent you only have to create a new check command like this:

$USER1$/check_nrpe -H $HOSTADDRESS$ -c check_eventlog -a "filter=id=$ARG1$"

Create a service that uses the check command above:

check_command_args: 903

This service will now check for event-id 903 in the and warn you if it finds any events with that id during the latest 24 hours.

The complete documentation for check_eventlog can be found here:

https://docs.nsclient.org/reference/windows/CheckEventLog/

It's highly recommended that you read through the official NSClient++ documentation above and build your own check command based on the official documentation and your own needs. Many advanced options are available.

Articles in this section

How to monitor a specific Microsoft windows eventid

Question

Answer

Comments

Articles in this section

Question

Answer

Related articles