NSClient ++ 0.3.9
Prerequisites
- The NSClient++ monitoring agent version 0.3.9 installed on the target host
- Permissions to add check commands and services in op5 Monitor
Adding the check command
- Hover over the "Manage" menu and select "Configure"
- Click on "Commands" in the "Core Configuration" section
-
Add a new command with the following settings:
Option Value command_name check_nrpe_windows_eventlog_id command_line $USER1$/check_nrpe -H '$HOSTADDRESS$' -c checkEventLog -a file='$ARG1$' MaxWarn='$ARG2$' MaxCrit='$ARG3$' filter-generated'=\>$ARG4$' filter=out filter=all filter+eventID=='$ARG5$' truncate=1000 unique descriptions "syntax=%type%: %source%: (%count%)"
- Click the "Submit" button and save the configuration changes.
Using the check command in a service
The check command that we created above takes 5 user supplied arguments:
Argument | Description |
---|---|
$ARG1$ | Event log file ("Application", "Security", "System" or similar) |
$ARG2$ | Warning threshold for number of events |
$ARG3$ | Critical threshold for number of events |
$ARG4$ | Look-back time interval ("15m", "3h", "5d" or similar) |
$ARG5$ | Event ID |
Example use case 1
In the following example we will add a service monitoring an event ID telling us that the system encountered issues while loading a users profile.
This event has the ID "1505" and is located in the "Application" file.
Configuration instructions:
- Open up your target host in the configuration utility, go to the services section and select "Add new service".
-
Change the following configuration options:
Option Value service_description Profile problems check_command check_nrpe_windows_eventlog_id check_command_args Application!1!1!2h!1505 - Click on the "Submit" button and save the configuration changes
-
Tags:
- NSClient
- NSClient++
- check_nrpe
- check_eventlog
- windows logs
- event logs
Comments
0 comments
Please sign in to leave a comment.