NSClient++ Help (#1) - I can't seem to understand combining two eventType filters (CheckEventLog) (#857) - Message List

Hello,

I seem to be having trouble combining two severity levels:

CheckEventLog -a truncate=1023 MaxWarn=1 MaxCrit=1 file='DFS Replication' filter=in "filter.eventSource='DFS Replication'" "filter.eventSource='DFSR'" "filter+eventType==error" "filter+eventType==warning" "filter+generated=\<5m" descriptions unique syntax='%message%'

It's true that if i use filter+eventType it should be a requirement since:

+ is AND
. is OR
- is NOT AND

(http://www.nsclient.org/nscp/wiki/CheckEventLog/CheckEventLog/old#Filtermodes)

In order to watch error and warning eventTypes, what should the syntax look like?

The following combos don't work:

"filter.eventType==error" followed by "filter+eventType==warning"

"filter.eventType==error" "filter.eventType==warning" followed by "filter-eventType==information"

I still receive critical when eventType = information.

Thanks,

Matt