Hello, based on the nsclient documentation, you have a “log” field in their apis (either throuh nrpe or rest) to be able to target the source of your logs.

CheckEventLog (Windows) - NSClient++

So i suppose that if you set the log field to Setup, you will be able to monitor this source.

Hello,

thank you for your informaiton, but unfortunately no.

/usr/lib/centreon/plugins//centreon_nsclient_restapi.pl --plugin=apps::nsclient::restapi::plugin --mode=query --hostname='10.112.16.91' --port='8443' --proto='https' --legacy-password='xxx' --timeout=30 --insecure --command=check_eventlog --arg="file=setup" --arg="filter=level in ('information') and (written > -60d)" --arg='top-syntax=${status}: ${count} ${problem_list}' --arg='detail-syntax=${source} ${id} (${message})' --arg="warning=count>0" --arg="critical=count>5" --arg="unique=1"
OK: No entries found | 'count'=0;0;5;;