Cheshire Cat Computing

Hi Steve,

Just wanted to report another bug related to filtering. It's not a big problem, most people are probably not affected and I found a workaround for it. Maybe you can fix it in your next release.

Both 1.8.3 and 1.7.2 versions are affected:

Here's how to quickly replicate:
Let's say you create only one filter that checks Application log only and if there is an Error event in the Application log(check Error), it reports it back as an Error (DropDown Critical(2)). There are no IDs, match or source strings - a very simple filter.

Now generate an Information Event with ID 0 in your Application Log (not a Warning or Error, just Information event).

It will report it as an Error, when in fact it should not report at all.

Workaround: In the same filter, check Not for Event ID and enter 0 in the text box next to it.

Please let me know if you need more details to replicate.

I was unfortunate enough to have a script that runs every 10 mins and generates an Information event with Event ID 0 when it is succesfully completed and an Error event with a non-zero ID when it fails. Nagios kept reporting Errors any way the script completes,...

Then I saw something related to a fix in ver 1.7.2 for Event ID 0 mentioned in the license/readme text during install...

As always - thanks for looking into this issue and for maintaing the agent

I'll take a look at this soon. This week I'm on holiday

At one point, event ID 0 was being taken as the same as blank. That was later fixed. This seems to be a different problem (since the 'Error' filter should still be in operation no matter what the eventID filter)

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11