Cheshire Cat Computing

Hi !
first, my apologies if my english is poorl, but is not my primary lenguge
I have installed windows EventlogAgent, but i can´t understand how to configure this application
i mean i have received on nagios the test event autogenerated and hearbeat service status
but my doubts are:
How many filters do i should use ? or just one is allowed
can i configure all filters that i want according the events that i want to check ?

At this time i have created only one service on nagios called "check-nteventlog"
and on the Agent i have created a filter to check all logs, with error events
I have checked windows event log and almost two or three error events were logged but no message were
reported by the agent

Someone could explain or write a "Windows Eventog Agent for dummies" because i can´t find
a detailed guide for the configuration
Thanks in advance for any help

You can make as many filters as you want, but you need at least one.

When an eventlog entry arrives, only the first matching filter is used.

The Nagios Servicename defined in the filter must match an defined nagios servicename on your Nagios server.

If you enable 'debug mode' then you will get additional eventlog entries telling you which filter has matches for each eventlog entry that appears. This can help to debug filters.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

thanks for your answers, i will configure filters for my services instead of only one filter for all

i have another question regarding "heartbeat" when the agent is restarted a message or warning
showing that the services is starting remains on nagios and is not cleared
how can i solve that?

the same is happens for services i have received correctly the message if the service is with a warnig, but when
the service is ok the previous warning messajge remains

thanks again for your help

This is how the heartbeat service is supposed to work.

When the agent is running, it will periodically send an 'OK' message to Nagios for the heartbeat service. When it shuts down, it sends a 'critical'. On Nagios, you set the freshness check to set status to 'critical' if no status has been received for a while. This way, it will go critical if the service goes down as no more OK messages will be being received. The critical willbe cleared by the periodic 'ok' that is sent by the heartbeat.

For filter services, how you deal with it is up to you. You can either send a OK message when you get a normal progress message (as with heartbeat), or else use freshness checks to set the status to OK after a period of time.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11