NSClient++ Help (#1) - CheckEventLog filtering out by message string (#691) - Message List

I'm enjoying using the new syntax for CheckEventLog thanks. Unfortunately I'm stuck trying to monitor some MYSQL events.

I'm trying the following:

alias_CheckEventLog_MSSQL=CheckEventLog file=application debug=true MaxWarn=1 MaxCrit=1 "filter=source like 'MSSQL' AND generated gt -30m AND severity NOT IN ('success', 'informational') AND message NOT LIKE 'Overdue FTP Manager Jobs'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"

Granted, the documentation doesn't say it's possible to do "NOT LIKE", but is there some way I can do this?

If I run the check_nrpe command from the command line on the Nagios server like sot:

$ /usr/local/nagios/etc/objects$ /usr/local/nagios/libexec/check_nrpe \

-H 10.37.1.5 -c alias_CheckEventLog_MSSQL

I get:

(6), eventlog: 6 > critical|'eventlog'=6;1;1; State: 1 DB_NAME: Acme-AppStatusReport?

Which is nearly right, but it's still picking up the messages I want to filter out.

The content of the message in the error log is:

Error: 1000000 Severity: 16 State: 1 DB_NAME: Acme-AppStatusReport? Check 1 - Overdue FTP Manager Jobs

For more information, see Help and Support Center at ​http://go.microsoft.com/fwlink/events.asp.

---

I've worked around this by using the old syntax, but if it's possible to use the new syntax that would be nice as it's more intuitive.

Using the old syntax: Event_MSSQL=inject CheckEventLog filter=new file=application MaxWarn=1 MaxCrit=2 filter+generated=<30m filter+eventSource=substr:MSSQL filter-message=substr:Overdue filter+eventType==error truncate=64 descriptions "syntax=%severity%: %source%: %message% (%count%)"

thanks in advance,

Jim