Realtime Eventlog Monitoring Hostname is Uppercase

[j.nissen]

Hello,
I have activate Windows Eventlog Realtime Monitoring.

On NCSA I recive Following Error

Warning: Passive check result was received for service 'eventlog_1' on host 'NISSEN3', but the host could not be found!

I believe that the the Hostname must in lowercase.

greetings
Jörg

[mickem]

Humm, interesting...
Technically this is a configuration problem :)
If you name your hosts with upper case names you should do so in Nagios as well :)

But joking aside I guess I should create a lower-case version as well?

Other people had issues with the opposite scenario so the right action is to make it configurable not lowercase...
I shall look into it...

[j.nissen]

Hello ,

thanks for your Reply.

Here my Host and Service definition

define host{

use host-24x7
host_name NISSEN3.silber.rb.de
alias NISSEN3
address 100.100.1.6
notes Nissen PC

# icon_image vmware.gif

}

define service{

use eventlog
host_name NISSEN3.silber.rb.de
service_description eventlog_1
check_command eventlog_1

}

Error
Jun 8 13:56:38 icinga icinga: Warning: Passive check result was received for service 'eventlog_1' on host 'NISSEN3', but the host could not be found!

greetings from germany

Jörg

[mickem]

Humm..
Will passive results match againast alias or host_name?
You can hard code the hostname if you want to try which one "works"...
So might wanna try setting hostname to "NISSEN3.silber.rb.de" just to be sure :)

[j.nissen]

Hello Again,

this configuration works

nsclient.ini
; HOSTNAME - The host name of this host if set to blank (default) the windows name of the computer will be used.
hostname = nissen3

If hostname=auto the Hostname was in Uppercase.

It is possible to create an Option

hostname Lowercase = true

???

#### Test ####
define host{

use host-24x7
host_name nissen3
alias nissen3.silber.rb.de
address 100.100.1.6
notes Nissen PC

# icon_image vmware.gif

}

define service{

use eventlog
host_name nissen3
service_description eventlog_1
check_command eventlog_1

}

Jun  8 14:17:10 icinga icinga: EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;nissen3;eventlog_1;3;error mysource: test
Jun  8 14:17:13 icinga icinga: PASSIVE SERVICE CHECK: nissen3;eventlog_1;3;error mysource: test

Thanks for your hurry up replies.

Jörg

[mickem]

Next build will have a auto-lc option you can use to set lower case version of hostname:

hostname = auto-lc

Michael Medin

[j.nissen]

Hello Michael,

i have installled the Nightly Backup

NSClient 0.4.1.4 2012-06-17

auto-lc doesn´t work.

Jun 18 08:30:15 icinga icinga: Warning: Passive check result was received for service 'eventlog' on host 'auto-lc', but the host could not be found!

Has you fixed it ?

thanks,

Jörg

[mickem]

Humm... are you sure?

It work here with me?

[/settings/NSCA/client]
hostname=auto-lc

Could you past the log from

nscp test

Michael Medin

[j.nissen]

Hello,

nscd.ini

[/modules]
CheckDisk = 1
CheckEventLog = 1
CheckExternalScripts = 1
CheckHelpers = 1
CheckSystem = 1
CheckWMI = 1
NRPEServer = 1
NSCAClient = 1
NSClientServer = 1
[/settings/default]
allowed hosts = X.X.10.21
cache allowed hosts = true
password =
certificate = ${certificate-path}/nrpe_dh_512.pem
timeout = 30
use ssl = false
[/settings/NRPE/server]
allow arguments = true
allow nasty characters = true
port = 5666

[/settings/NSCA/client]
channel = NSCA
hostname=auto-lc

[/settings/NSCA/client/targets/default]
address = nsca://100.100.10.21:5667
encryption = des
timeout = 30
[/settings/NSClient/server]
performance data = true
port = 12489
[/settings/check/system/windows]
default = true
default buffer length = 1h
[/settings/check/system/windows/service mapping]
[/settings/crash]
archive = true
archive folder = ${shared-path}/crash-dumps
restart = true
restart target = NSClientpp
submit = false
submit url = http://crash.nsclient.org/submit
[/settings/eventlog]
buffer size = 131072
debug = true
lookup names = true
syntax =
[/settings/eventlog/real-time]
destination=NSCA
debug = true
enable active = true
enabled = true
log = application
maximum age = 5m
startup age = 30m
[/settings/eventlog/real-time/filters/errors]
filter=id=1000
type='error'
severity = CRITICAL
syntax=The end is neigh: %message%
ok message = Seems we are doing ok
command=eventlog
[/settings/external scripts]
allow arguments = true
allow nasty characters = true
script path =
timeout = 60
[/settings/external scripts/alias]
[/settings/external scripts/scripts]
[/settings/external scripts/wrapped scripts]
[/settings/external scripts/wrappings]
bat = scripts\\%SCRIPT% %ARGS%
ps1 = cmd /c echo scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -
vbs = cscript.exe //T:30 //NoLogo scripts\\lib\\wrapper.vbs %SCRIPT% %ARGS%
[/settings/log]
date format = %Y-%m-%d %H:%M:%S
file name = ${exe-path}/nsclient.log
level = debug
[/settings/log/file]
max size = 0
[/settings/shared session]
enabled = false
[/settings/targets]

d vice\logger_impl.cpp:372  Creating logger: console
d rvice\NSClient++.cpp:374  NSClient++ 0,4,1,4 2012-06-17 x64 Loading settings and logger...
d ngs_manager_impl.cpp:162  Boot.ini found in: C:/Program Files/NSClient++//boot.ini
d ngs_manager_impl.cpp:178  Boot order: ini://${exe-path}/nsclient.ini
d ngs_manager_impl.cpp:181  Activating: ini://${exe-path}/nsclient.ini
d ngs_manager_impl.cpp:73   Creating instance for: ini://${exe-path}/nsclient.ini
d ngs/settings_ini.hpp:268  Reading INI settings from: C:/Program Files/NSClient++//nsclient.ini
d ngs/settings_ini.hpp:234  Loading: C:/Program Files/NSClient++//nsclient.ini from ini://${exe-path}/nsclient.ini
l rvice\NSClient++.cpp:385  NSClient++ 0,4,1,4 2012-06-17 x64 booting...
d rvice\NSClient++.cpp:386  Booted settings subsystem...
d rvice\NSClient++.cpp:453  On crash: restart: NSClientpp
d rvice\NSClient++.cpp:465  Archiving crash dumps in: C:/Program Files/NSClient++//crash-dumps
d rvice\NSClient++.cpp:532  booting::loading plugins
d rvice\NSClient++.cpp:298  Found: CheckDisk
d rvice\NSClient++.cpp:298  Found: CheckEventLog
d rvice\NSClient++.cpp:298  Found: CheckExternalScripts
d rvice\NSClient++.cpp:298  Found: CheckHelpers
d rvice\NSClient++.cpp:298  Found: CheckSystem
d rvice\NSClient++.cpp:298  Found: CheckWMI
d rvice\NSClient++.cpp:298  Found: NRPEServer
d rvice\NSClient++.cpp:298  Found: NSCAClient
d rvice\NSClient++.cpp:298  Found: NSClientServer
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/CheckDisk.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/CheckEventLog.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/CheckExternalScripts.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/CheckHelpers.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/CheckSystem.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/CheckWMI.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/NRPEServer.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/NSCAClient.dll as )
d rvice\NSClient++.cpp:829  addPlugin(C:/Program Files/NSClient++//modules/NSClientServer.dll as )
d rvice\NSClient++.cpp:806  Loading plugin: CheckDisk
d rvice\NSClient++.cpp:806  Loading plugin: Event log Checker.
d rvice\NSClient++.cpp:806  Loading plugin: Check External Scripts
d rvice\NSClient++.cpp:806  Loading plugin: Helper function
d rvice\NSClient++.cpp:806  Loading plugin: CheckSystem
d eventlog_wrapper.cpp:80   Attempting to match: Anwendung with application
d rvice\NSClient++.cpp:806  Loading plugin: CheckWMI
d rvice\NSClient++.cpp:806  Loading plugin: NRPE server
d eventlog_wrapper.cpp:80   Attempting to match: Hardware-Ereignisse with application
d tem\PDHCollector.cpp:91   Loading counters...
d tem\PDHCollector.cpp:94   Loading counter: memory commit limit = \4\30
d eventlog_wrapper.cpp:80   Attempting to match: Microsoft Office Alerts with application
d eventlog_wrapper.cpp:80   Attempting to match: Sicherheit with application
d eventlog_wrapper.cpp:80   Attempting to match: System with application
d erver\NRPEServer.cpp:130  Allowed hosts definition: x.X.10.21(255.255.255.255)
d tem\PDHCollector.cpp:103  Counter status: -1073738823: Der angegebene Leistungsindikator wurde nicht gefunden.


d tem\PDHCollector.cpp:94   Loading counter: cpu = \238(_total)\6
d tem\PDHCollector.cpp:94   Loading counter: memory commit bytes = \4\26
d tem\PDHCollector.cpp:103  Counter status: -1073738823: Der angegebene Leistungsindikator wurde nicht gefunden.


d tem\PDHCollector.cpp:94   Loading counter: uptime = \2\674
d tem\PDHCollector.cpp:103  Counter status: -1073738823: Der angegebene Leistungsindikator wurde nicht gefunden.


d de\socket/server.hpp:97   Attempting to bind to: :5666
d de\socket/server.hpp:107  Bound to: :5666
d rvice\NSClient++.cpp:806  Loading plugin: NSCAClient
d rvice\NSClient++.cpp:806  Loading plugin: NSClient server
d r\NSClientServer.cpp:136  Allowed hosts definition: X.X.10.21(255.255.255.255)
d de\socket/server.hpp:97   Attempting to bind to: :12489
d de\socket/server.hpp:107  Bound to: :12489
d rvice\NSClient++.cpp:604  NSClient++ - 0,4,1,4 2012-06-17 Started!
l ce\simple_client.hpp:32   Enter command to inject or exit to terminate...
d lient\NSCAClient.cpp:411  Connection details: host: X.X.10.21, port: 5667, timeout: 30, buffer_length: 512, time_delta: 0, password: , encryption: des
d lient\NSCAClient.cpp:417  Sending (data): host: auto-lc, service: eventlog, code: 2, time: 1340093027, result: The end is neigh: Name der fehlerhaften Anwendung: %1, Version: %2, Zeitstempel: 0x%3
 Name des fehlerhaften Moduls: %4, Version: %5, Zeitstempel: 0x%6
 Ausnahmecode: 0x%7
 Fehleroffset: 0x%8
 ID des fehlerhaften Prozesses: 0x%9
 Startzeit der fehlerhaften Anwendung: 0x%10
 Pfad der fehlerhaften Anwendung: %11
 Pfad des fehlerhaften Moduls: %12
 Berichtskennung: %13
d de\socket/client.hpp:177  do_process()
d de\socket/client.hpp:177  tcp::start_read_request(132)
d de\socket/client.hpp:177  wait()
d de\socket/client.hpp:177  handle_read_request(132)
d de\socket/client.hpp:177  do_process()
d de\socket/client.hpp:177  tcp::start_write_request(720)
d de\socket/client.hpp:177  handle_write_request(720)
d de\socket/client.hpp:177  do_proces

greatings

Jörg

[mickem]

Wait... you are trying 0.4.1, might wanna try 0.4.0.179 (thats what I tried).

[j.nissen]

Hello,

ok, thats a reason.

Could you changed it in 0.4.1 again ?

Thanks,

Jörg

[mickem]

It will be in next build of 0.4.1.
But this was fixed "after" current 0.4.1 build so 0.4.1 is a bit out of sync currently..

Michael Medin

[mickem]

New build so should be resolved...