#382 closed defect (worksforme)
Incorrect Eventlog event status
|Reported by:||hiker_42||Owned by:||mickem|
I am using the new 3.8 client. I am monitoring event logs for error level severity. However, "Informational" events are being flagged as error level events for some reason.
Below is my command:
check_nrpe -c CheckEventLog -H 126.96.36.199 -p 5666 -a file="Application" MaxWarn=1 MaxCrit=1 "filter=generated gt -30m AND severity='error'" unique descriptions "syntax=%severity%:%source%: (%count%)"
error:Winlogon: (1), eventlog: 1 > critical|'eventlog'=1;1;1;
The Winlogon error that is being reported is actually an Informational event and not an error level status in Windows.
"The Windows logon process has failed to terminate the currently logged on user's processes."
So either nsclient is not reporting the status correctly or Windows is not displaying an error level when it actually is (which I suppose could be the case).