Hello,
It is generally much much simpler to use the new SQL-like syntax.
Then you end up writing something which looks a bit like this:
generated > -1d AND severity NOT IN ('success', 'informational')
There is some information on the wiki for how to use this here:
http://www.nsclient.org/nscp/wiki/CheckEventLog/CheckEventLog
For instance this could be a good starting point:
CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1
"filter=*generated gt -2d AND severity NOT IN ('success',
'informational')*" truncate=800 unique descriptions "syntax=%severity%:
%source%: %message% (%count%)"
This requires a "modern" (as in 0.3.8) version of NSClient++.
// Michael Medin
2011-02-21 11:27 Tristan Drinkwater skrev:
Morning all (depending where you are in the world..)
I'm trying to catch all error and warning logs from application event
folder but I'm struggling with the filter+generated bit.
In a nut shell all I want is anything red that happened within the
last 24 hours.
Here is my syntax I'm running from the libexec folder till I get it right;
./check_nrpe --H ip --p 5667 --c CheckEventLog --a filter=in
file=application filter.eventType==error filter+generated=\<24h MaxCrit=1
This return's 12 errors. Only 3 of which happened in the last 24 hours.
It seems to be either not using the filter I've detailed or making up
its own one!!
Can anyone see what I'm doing wrong?
Thanks in advance J
------------------------------------------------------------------------
Micro Peripherals Limited.
Registered Office: Shorten Brook Way, Altham Business Park, Altham,
Accrington, Lancs. BB5 5YJ. Tel: (01282) 776776 Fax: (01282) 858790
Micro Peripherals Limited. Registered in England No. 1511931. VAT No.
GB 864 4387 91
DISCLAIMER:
This e-mail and attachments are confidential and are intended solely
for the use of the individual to
whom it is addressed. Any views or opinions presented are solely those
of the author and do not
necessarily represent those of Micro Peripherals Limited.
If you are not the intended recipient, be advised that you have
received this Email in error and that
any use, dissemination, forwarding, printing, or copying of this Email
is strictly prohibited. If this
transmission is received in error please notify the sender immediately
and delete this message from
your E-mail system.
All electronic transmissions to and from Micro Peripherals Ltd are
recorded and may be monitored.
------------------------------------------------------------------------------
The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE:
Pinpoint memory and threading errors before they happen.
Find and fix more than 250 security defects in the development cycle.
Locate bottlenecks in serial and parallel code that limit performance.
http://p.sf.net/sfu/intel-dev2devfeb
_______________________________________________
Nagios-users mailing list
Nagios-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting
any issue.
::: Messages without supporting info will risk being sent to /dev/null
------------------------------------------------------------------------------
The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE:
Pinpoint memory and threading errors before they happen.
Find and fix more than 250 security defects in the development cycle.
Locate bottlenecks in serial and parallel code that limit performance.
http://p.sf.net/sfu/intel-dev2devfeb
_______________________________________________
Nagios-users mailing list
Nagios-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting
any issue.
::: Messages without supporting info will risk being sent to /dev/null
