This article explains how to efficiently filter Windows events.
The command check_eventlog returns events from the windows Event log but needs to be filtered thoroughly to not overload the system and point at what matters to you.
By default, if you do not filter, the command can send back a significant number of messages
For instance this does not filter:
/usr/lib/nagios/plugins/check_centreon_nrpe -H 10.10.10.10 -p 5666 -t 60 -u -m 8192 -c check_eventlog -a 'top-syntax=${status}: ${count} ${problem_list}' 'detailsyntax=${source} ${id}' "warning=count>0" "critical=count>5"
CRITICAL: 15692 MSExchangeRepl 2155, MSExchange ADAccess 2114, MSExchange ADAccess 2114, …
Here are some of the most useful filters:
- Event log to read (type of event)
- Date
- Severity of event
- Source that generated the event
- ID of the event
You must use the filter "file" with one of these arguments to specify which Windows event log to query:
- Application
- Security
- System
To filter on the severity, it is necessary to use "level" with one of the following arguments :
- Information
- Warning
- Error
- Critical
Example
Here is a sample command which allows to post the events which :
- Came from the "Application" log
- Happened less than one hour ago
- Have a severity "error" or "warning"
- Are not related to "MSExchange ADAccess" and "MSExchangeIS" sources
/usr/lib/nagios/plugins/check_centreon_nrpe -H 10.10.10.10 -p 5666 -t 60 -u -m 8192 -c check_eventlog -a "file=application" 'top-syntax=${status}: ${count} ${problem_list}' 'detailsyntax=${source} ${id}' "warning=count>0" "critical=count>5" "filter=written > -60m and level in ('error', 'warning') and source not regexp 'MSExchange ADAccess|MSExchangeIS'"
This will return an output such as:
CRITICAL: 162 MSExchangeRepl 3176, MSExchangeTransport 16019, MSExchangeRepl 2155, …
Centreon Support does not actively maintain knowledge articles. If you have questions or require assistance with an article, please create a case or post a comment below.
