Changeset 1d53fe0 in nscp for modules/CheckEventLog

Timestamp:

02/12/09 20:28:56 (4 years ago)

Author:

Michael Medin <michael@…>

Branches:

master, 0.4.0, 0.4.1, 0.4.2, stable

Children:

b1ac2fa

Parents:

04f2743

Message:

2009-02-11 MickeM

• Fixed so that performance data is always(?) renderd regardless of if we have bounds or not. This was primarily to fix issues where we have might not "unexpectedly" get performance data (might still be some issues here so let me know).

2009-02-06 MickeM

• Fixed so that arguments ($ARG1$) are parsed properly for alias in CheckExternalScript?

2009-02-05 MickeM

• Fixed so the error message for "to small eventlog buffer" specifies the required size.
• Changed so that event log buffer problems are "ignored in the result" (still logged in the error log).

2009-02-03 MickeM

• Added support for changing the time when using NSCA with the time_delay in NSC.ini time_delay=+4h or time_delay=-1h etc should can now be used when system time not the same as NSCA time.

2009-01-30 MickeM

• Added support for changing name and description of service from the /install command line NSClient++ /install [gui] [start] [service name] [description] NSClient++ /uninstall [gui] [stop] [service name] NSClient++ /start [gui] [service name] NSClient++ /stop [gui] [service name]

2009-01-28 MickeM

• Slightly improved error handling around socket creation
• Fixed some pretty minor issues with the SysTray module (uncreation as well as new boost build).

2009-01-25 MickeM

• Fixed issue with checkVersion (#242)
• Fixed spelling error (#244)
• Fixed crash in CheckFile when a file was locked in exclusive mode (#254) + Improved error handling in all CheckDIsk/CheckFile checks. Should report errors better now.
• Updated the config file a bit: remving "beta" from a bunch of modules no longer in beta. (#270) + Added more filter operatos to all numeric filters so they accept eq:, ne:, gt:, lt: in addition to =, >, <, <>, !, !=, in: (#269)

2009-01-23 MickeM

+ Added better support for numerical hit matching in the eventlog module. You can now use exact and detailed matching.

You can now use the following syntax:
CheckEventLog ... warn=ne:1 crit=eq:0 ...
To generate a warning if the number of hits are != 1 and a critical if the number of hits are = 0.
Other operators avalible are: =, >, <, <>, !, !=, eq:, ne:, gt:, lt:

Location:

modules/CheckEventLog

Files:

• CheckEventLog.cpp (modified) (2 diffs)
• Jamfile (added)

modules/CheckEventLog/CheckEventLog.cpp

@@ -622 +622 @@
     //GetOldestEventLogRecord(hLog, &dwThisRecord);
 
-    while (ReadEventLog(hLog, EVENTLOG_FORWARDS_READ|EVENTLOG_SEQUENTIAL_READ,
-      0, buffer.getBufferUnsafe(), buffer.getBufferSize(), &dwRead, &dwNeeded))
-    {
+    while (true) {
+      BOOL bStatus = ReadEventLog(hLog, EVENTLOG_FORWARDS_READ|EVENTLOG_SEQUENTIAL_READ,
+        0, buffer.getBufferUnsafe(), buffer.getBufferSize(), &dwRead, &dwNeeded);
+      if (bStatus == FALSE) {
+        DWORD err = GetLastError();
+        if (err == ERROR_INSUFFICIENT_BUFFER) {
+          NSC_LOG_ERROR_STD(_T("EvenlogBuffer is too small change the value of ") + EVENTLOG_BUFFER + _T("=") + strEx::itos(dwNeeded+1) + _T(" under [EventLog] in nsc.ini : ") + error::lookup::last_error(err));
+        } else if (err == ERROR_HANDLE_EOF) {
+          break;
+        } else {
+          NSC_LOG_ERROR_STD(_T("Failed to read from eventlog: ") + error::lookup::last_error(err));
+          message = _T("Failed to read from eventlog: ") + error::lookup::last_error(err);
+          CloseEventLog(hLog);
+          return NSCAPI::returnUNKNOWN;
+        }
+      }
       EVENTLOGRECORD *pevlr = buffer.getBufferUnsafe(); 
       while (dwRead > 0) { 
@@ -719 +732 @@
       } 
     }
-    DWORD err = GetLastError();
-    if (err == ERROR_INSUFFICIENT_BUFFER) {
-      NSC_LOG_ERROR_STD(_T("EvenlogBuffer is too small (set the value of ") + EVENTLOG_BUFFER + _T("): ") + error::lookup::last_error(err));
-      message = std::wstring(_T("EvenlogBuffer is too small (set the value of ")) + EVENTLOG_BUFFER + _T("): ") + error::lookup::last_error(err);
-      return NSCAPI::returnUNKNOWN;
-    } else if (err != ERROR_HANDLE_EOF) {
-      NSC_LOG_ERROR_STD(_T("Failed to read from eventlog: ") + error::lookup::last_error(err));
-      message = _T("Failed to read from eventlog: ") + error::lookup::last_error(err);
-      return NSCAPI::returnUNKNOWN;
-    }
     CloseEventLog(hLog);
     for (uniq_eventlog_map::const_iterator cit = uniq_records.begin(); cit != uniq_records.end(); ++cit) {