NSClient++ Help (#1) - NSClient++ - EventLog? - Problem: "failed to load: .....DLL" (#454) - Message List

Please don't take this the wrong way... but I am wondering a bit how you were thinking...

You are on an English site, with English text, for a program in English, with English documentation and English source code with English comments. On the site you find an English wiki, with English articles, English guides, and English videos. It features and English forum with English forum posts and... and, and, and... you ask a question in German?

Ich spreche nicht Deutsch :)

But I do speak English... pretty well...

BTW, since I assume you are from German, feel free to bump into me at the netways conference in nuremberg next month... After a few beers I can usually understand German :P

Michael Medin

Well I'll translate it ;-)

Thought because of the huge german nagios community to get an answer too :-)

I have big troubles getting a pretty working plugin for filtering the event log on windows server 2003. I tried shipways event logger but didn't really succeed..

That's why I'm trying out NSClient+++. I'll use the NSCA daemon later, but for checking out the configuration I'm working with NRPE at the moment. But doesn't make a difference.

My command: command[WinEventLog??]=inject CheckEventLog file=application filter=new filter=out MaxCrit=1 filter-generated=>5m truncate=780 unique descriptions syntax=Application[%type%]_(%source%:%id%)_(%written%)%message%

The %message% should get me the EventLog? description, but I often get an error:

failed to load: C:\Program Files (x86)\someFolders\FALogMsg.DLL( reson: 193

"some folders" means about 5 folders, but should be the problem. the information about the path to these dll's is somewhere in the eventlog I guess. Now I have these errors, but I really need the description, otherwise the notifications aren't that helpful.

..or does any of you have an other well working tool?

thanks for your help.

@Michael: Only translated because of your health, wouldn't be that good drinking a lot of beer to support me :-)

I installed the latest nightly but there's still the same error with the dll-path...

on my win xp it runs properly, but unfortunately not on win 2k3 server.

Depending on the exact issue you are having my guess would be that the evenlog providers are invalid (as in registred incorrect).

Does the messages get rendered properly in windows event viewer?

ANd if so could you export (and or copy) the registry entries for this so I can see if I can add support for it.

The "data" (ie. where the logfile is located) comes from:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\<log file name>\<provider identifier>\*

So try to find the "provider" in question and see what the registry keys say: Usually something like:

EventMessageFile=%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\Drivers\acpiec.sys

I can on my end lookup exactly how I extract the info.

Michael Medin

I'll have a look in the afternoon.. I got it now work on Win 2k3 Server 32bit without problems.

So it seems to be a problem of 64bit or there are any special things on our server..

....afternoon is coming soon :-)

OK, I found the path. All right.

I tried copying the path and pasted into the browser, then windows asked about opening the dll. The path is OK.

There has to be an other problem...

There's something strange: (%type%)

Windows Event Log says: Type:None an your Script: Type:256

So I have a problem filtering.. In fact it appears as an Information in Windows Computer Management. But if the single event is opened, there Type:None.

Source, EventID, date and time (%generated%) are all correct.

...there are some %messages% working.. but not the important ones :-)

for the source MsiInstaller? the same problem:

MsiInstaller?(#1013) (Tuesday, September 15, 2009 10:02:53) failed to load: C:\WINDOWS\SysWOW64\msi.dll( reson: 193

Humm...

An interesting thing is that it is under SysWOW64 which means it is a 32-bit DLL living in a 64-bit "world". I am to be honest not sure how windows (and thus I) handle that.

And since I am "working away from home" this week I wont have time to investigate it till I get home (weekend). But it sounds reasonable that maybe 32bit dlls wont load properly from w64?

I shall have to investigate it...

Michael Medin

Well but the Windows Event Log shows me a description... Means that WIN can handle it anyway...

Hope you'll find a way :-)