CheckEventLog returns bad syntax

[sr_dev]

nsclient 0.3.8:

Query:

-c CheckEventLog -a file=application filter+eventType==error MaxWarn=100 MaxCrit=1000 filter=id=xxxx truncate=800 "filter+generated=<24h" unique descriptions

Returns:

success: xxxx: (93)|'eventlog'=93;100;1000;

When altered filter-id it returns the expected:

Eventlog check ok|'eventlog'=0;100;1000;

[mickem]

Not sure I understand what the problem is.

Eventlog check ok|'eventlog'=0;100;1000; 

means "no problems where found"

success: xxxx: (93)|'eventlog'=93;100;1000; 

Means something was found.

And if you change the filter you will mot likely get different results.

Michael Medin

[sr_dev]

Replying to mickem:

Not sure I understand what the problem is.

Eventlog check ok|'eventlog'=0;100;1000; 

means "no problems where found"

success: xxxx: (93)|'eventlog'=93;100;1000; 

The problem is that the syntax is confusing because it refers to the
technical filter result, not the real result. For example the query above which returns following to Nagios:

Mysoftware, CRITICAL, success: My app is out of diskspace.

The examples in the Nagios API docs use:

DISK OK - free space: / 3326 MB (56%); | /=2643MB;5948;5958;0;5968

which in Nagios translates to

Disk util, OK, OK: C: 7.81G, D: 200M

See my point? :)

David Lundberg

[mickem]

Not really...

The "real result" is returned in the "result code" which Nagios parses into a state, you would want that result to be repeated in the message as well?

That could easily be achieved via scripting.

But I shall see might be something to consider in the future...

Michael Medin

[mickem]

can be configured in 0.4.1