0

I am using CheckEventLog of NSClient++ 0.5.0.62 2016-09-14

how to use syntax for , if particular event id is not generated with in 24 hours i need critical alert , if event id generated i need status OK.

My Syntax :

./check_nrpe -H 192.168.63.1 -c check_eventlog -a "scan-range=-24h" "crit=count=<0"  "filter=id=1" "ok=count>0" "warn=none"

Output : 

OK: No entries found

for above syntax , event id 1 is not generated with in 24 hours , I'm getting OK status. but i need Critical

Please help me on above syntax .

Drifter104
  • 3,693
  • 2
  • 22
  • 39
Gopinath Kadaveru
  • 11
  • 3

1 Answers1

0

The easy way is to set empty-state and use count much like you did this overrides the default which is "ok" when nothing is found.

Nothing found:

check_eventlog scan-range=24h "filter=id=1008 and written < 24h" warn=none "crit=count=0" empty-state=critical
L        cli CRITICAL: CRITICAL: No entries found
L        cli  Performance data: 'count'=0;0;0

Something found:

check_eventlog scan-range=24h "filter=id=1008 and written < 24h" warn=none "crit=count=0" empty-state=critical
L        cli OK: OK: Event log seems fine
L        cli  Performance data: 'count'=12;0;0

You might wanna clean up the syntax a bit using:

  • show-all
  • empty-syntax

Like so:

Something found:

check_eventlog scan-range=24h "filter=id=1008 and written < 24h" warn=none "crit=count=0" empty-state=critical show-all "empty-syntax=Nooooohhhh"
L        cli CRITICAL: Nooooohhhh
L        cli  Performance data: 'count'=0;0;0

Nothing found:

check_eventlog scan-range=24h "filter=id=1008 and written < 24h" warn=none "crit=count=0" empty-state=critical show-all
L        cli OK: OK: 12 message(s) .....)
L        cli  Performance data: 'count'=12;0;0

Please also note that event-id is NOT globally unique, instead they are unique per source so using only event id will most likely not work as expected if another application (source) happens to use the same event id...

P.S. This was tested on 0.5.1 not 0.5.0 but should in theory work on 0.5.0 as well...

Michael Medin
  • 605
  • 3
  • 5