<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style></style></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1>Cheers for the reply guys.<o:p></o:p><o:p> </o:p>Sadly, as I’m looking after only one of a few sites that each has its own Nagios server and all the windows servers have Nsclient 3.3 installed. I can’t upgrade the version to support the newer commands as EVERY windows server in the business would then need upgrading as well!<o:p></o:p><o:p> </o:p>Unless there is a ‘use old style commands’ switch I can turn on? I didn’t see one in the .ini file so guessed it wasn’t an option.<o:p></o:p><o:p> </o:p>So I’m still struggling with my issue that the filter+generated=\<1d doesn’t seem to work right. If I use =\>1d I get loads of returns so it is filtering something, but only what appears to be the last month, NOT including the last 36 hours.<o:p></o:p><o:p> </o:p>Help?<o:p></o:p><o:p> </o:p>Thanks again<o:p></o:p><o:p> </o:p>Tristan<o:p></o:p><o:p> </o:p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>From: Michael Medin [mailto:michael@medin.name] Sent: 21 February 2011 13:42 To: nagios-users@lists.sourceforge.net; Tristan Drinkwater Subject: Re: [Nagios-users] check event log<o:p></o:p></div></div><o:p> </o:p>Hello, It is generally much much simpler to use the new SQL-like syntax. Then you end up writing something which looks a bit like this: generated > -1d AND severity NOT IN ('success', 'informational') There is some information on the wiki for how to use this here: <a href="http://www.nsclient.org/nscp/wiki/CheckEventLog/CheckEventLog">http://www.nsclient.org/nscp/wiki/CheckEventLog/CheckEventLog</a> For instance this could be a good starting point: CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational')" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)" This requires a "modern" (as in 0.3.8) version of NSClient++. // Michael Medin 2011-02-21 11:27 Tristan Drinkwater skrev: <o:p></o:p>Morning all (depending where you are in the world..)<o:p></o:p> <o:p></o:p>I’m trying to catch all error and warning logs from application event folder but I’m struggling with the filter+generated bit.<o:p></o:p> <o:p></o:p>In a nut shell all I want is anything red that happened within the last 24 hours.<o:p></o:p> <o:p></o:p>Here is my syntax I’m running from the libexec folder till I get it right;<o:p></o:p> <o:p></o:p>./check_nrpe –H ip –p 5667 –c CheckEventLog –a filter=in file=application filter.eventType==error filter+generated=\<24h MaxCrit=1<o:p></o:p> <o:p></o:p>This return’s 12 errors. Only 3 of which happened in the last 24 hours.<o:p></o:p> <o:p></o:p>It seems to be either not using the filter I’ve detailed or making up its own one!!<o:p></o:p> <o:p></o:p>Can anyone see what I’m doing wrong?<o:p></o:p> <o:p></o:p>Thanks in advance J<o:p></o:p> <o:p></o:p><o:p> </o:p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div>Micro Peripherals Limited. Registered Office: Shorten Brook Way, Altham Business Park, Altham, Accrington, Lancs. BB5 5YJ. Tel: (01282) 776776 Fax: (01282) 858790 Micro Peripherals Limited. Registered in England No. 1511931. VAT No. GB 864 4387 91 DISCLAIMER: This e-mail and attachments are confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of Micro Peripherals Limited. If you are not the intended recipient, be advised that you have received this Email in error and that any use, dissemination, forwarding, printing, or copying of this Email is strictly prohibited. If this transmission is received in error please notify the sender immediately and delete this message from your E-mail system. All electronic transmissions to and from Micro Peripherals Ltd are recorded and may be monitored. <o:p></o:p><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>------------------------------------------------------------------------------<o:p></o:p></pre><pre>The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE:<o:p></o:p></pre><pre>Pinpoint memory and threading errors before they happen.<o:p></o:p></pre><pre>Find and fix more than 250 security defects in the development cycle.<o:p></o:p></pre><pre>Locate bottlenecks in serial and parallel code that limit performance.<o:p></o:p></pre><pre><a href="http://p.sf.net/sfu/intel-dev2devfeb">http://p.sf.net/sfu/intel-dev2devfeb</a><o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>_______________________________________________<o:p></o:p></pre><pre>Nagios-users mailing list<o:p></o:p></pre><pre><a href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net</a><o:p></o:p></pre><pre><a href="https://lists.sourceforge.net/lists/listinfo/nagios-users">https://lists.sourceforge.net/lists/listinfo/nagios-users</a><o:p></o:p></pre><pre>::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. <o:p></o:p></pre><pre>::: Messages without supporting info will risk being sent to /dev/null<o:p></o:p></pre><o:p> </o:p></div></body></html>