CheckEventLog.dll

The CheckEventLog module checks for problems reported to the windows event log.

• CheckEventLog, Check to find errors in the event log.

Configuration Sections

This is a wrapper page the actual data is on the following page CheckEventLog/config

EventLog?

The [EventLog?] section is used by the CheckEventLog module.

Advanced options:

Option	Default	Description
debug	0	Log all "hits" and "misses" on the eventlog filter chain, useful for debugging eventlog checks but very very very noisy so you don't want to accidentally set this on a real machine.
buffer_size	65536	Sets the buffer memory size used by NSClient++ when processing event log check commands. For details see below.

debug

Used to log all information regarding hits and misses on the filtering,. This has sever performance impact as well as log file will grow so do not use unless you are debugging.

[EventLog]
debug=1

buffer_size

This option was added in version 3.4

This parameter is set in the nsc.ini file and needs to be put under a heading of [EventLog?] (this heading may need to be created). The buffer reserves memory each time an eventlog check is being run when so set the size accordingly (or you will be wasting lots of memory).

To change the default setting of 64KB add (or edit) in the nsc.ini file an entry for buffer size (buffer_size=512000) where the value is in bytes. Often times the buffer size will need to be increased when using the %message% variable in return results. Most often you only need to increase this if you get error reported in the log file from NSClient++

[EventLog]
buffer_size=512000

Complete configuration

This are the default values for the entire EventLog? section

[EventLog]
debug=0
buffer_size=64000