NSClient++ Help (#1) - checkeventlog for No activity? (#1003) - Message List

checkeventlog for No activity?

I have been working on creating a check to look for NO activity in a Windows event log. I have a couple of servers that I'm troubleshooting. They don't always reboot but sometimes hang. I use Opsview to monitor. The various checks that I have on the servers appear to run along just fine while the server will not respond to anything else. I thought, add a check for no activity to the Application log to notify me when the server is down. Here is what I gleamed from the old checkeventlog page:

-H $HOSTADDRESS$ -c CheckEventLog filter=new file=Application MinWarn=0 MinCrit=0 filter-generated=\>20m filter+eventSource="security" filter+eventType==auditSuccess filter=in filter=all OK: ...

But Opsview only returns Warning and Null. I changed filter-generated=\>20m to filter-generated
ne>20m and get Unknown filter key: (numeric filters have to have an operator as well ie. foo=>5 or bar==5)

Any help would be appreciated.

JT

  • Message #2662

    Which version of NSClient++?

    There is also a warn= and crit= syntax which gives you more flexibility. Using that you can say warn=gt:0 or warn=ne:0 etc etc...

    Michael Medin

    • Message #2663

      The version of NSClient++ - 0.3.8.76 2010-05-27. At least that is what the opsview-agent.log lists as the first entry.

      • Message #2664

        Not sure about that think it was implemented in 0.3.9.

Subscriptions