Cheshire Cat Computing

Hi

I've just configured and used Nagios Windows EventLog agent to monitor for services that have stopped or terminated by matching the string in system events. This is working fine and an alert is sent to the Nagios server when a service stops or is restarted.

However I need to be able to tell the application that the "Service Name" that is sent to the Nagios server should match the actual service name of the service that is stopped or started on the Windows server. Is there an environment variable I can put in the "Service Name" box under the NSCA Alert Message option that will return the actual name of the serivce?

Thanks
Tony

Not unless you set up a separate Nagios service for each Windows service you are monitoring.

The Nagios plugin can be passed the NAGIOS Service Description, Hostname, and status text. The EventLog agent, being restricted by the Nagios status format and the NSCA protocol, can only submit a status value and text to a Nagios Host/ServiceDescirption pair. There is no way for a generic piece of metadata (eg, the windows service name) to be passed through NSCA or stored against a Nagios service status.

This means you have 2 options -
1) You can have the Nagios service being a generic ('EventLog') and all messages go here. You notification plugin should then parse the status string to identify the Windows service name.
2) You can set up separate Nagios Services for each Windows service you are monitoring, and have a set of EventLog Agent rules that send the alerts to the appropriate service (by regexp matching in the message content). Then the Nagios service description would match the windows service name.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hi Steve

I was hoping not to have to do that.
We have a requirement from our IT department who have about 100 Windows servers each with about 30 services/processes they want monitored. I know I could use the standard NT agents, check_nt and check_nrpe and even SNMP to monitor services/processes are running but they want to know as soon as possible if a service or process has stopped. Which made your bit of software ideal for the purpose, although the not passing the service name for the event is a problem.

Having one check for each host for services on a box isn't ideal as if a service gets alerted and the check is acknowledged then if another service dies no alerts would be sent out because there would not be a state change of the check.

Configuring 100 servers each with 30 services to be monitored would be a real pain to do, so I'd rather avoid this. I've got the software reporting on event IDs 7034, 7035 and 7036 which about covers services stopping, processes terminating and also services/processes restarting and to set this up on 100 servers isn't that bad to do.

I did think about getting NSCA to dump any messages it receives into a separate log file, and I could run a process that monitors the file grabs the new alert formats it to find out the service name and then pipe the command into the Nagios command file. This is pretty simple to do and I've done it before for something similar.

I also thought about running a process as a listener and grabbing the data sent by your software by changing the port number in the software. But for some reason its not catching any data and I'm not sure why. If I could get it to catch the data then the process can do all the formatting and sending the alert to the Nagios command file. Do you have any ideas on this and/or what might be causing a problem?

Thanks in advance

Tony

Sounds like you're best off with the one Nagios service per Windows service method.

However you should be able to configure this easily using templates.

On the Windows box, set up all the filters once, then just do a registry dump of the Cheshire Cat tree to get all the filter definitions and copy it to all the other hosts, very fast. That does the windows side (this is how we do standard filters here)

Then, for the Nagios side, set up a template for the configuration of one service name, duplicate it for all the other services (just a little scripting). With luck you might be able to use hostgroups to define this over a whole hostgroup at once, if you have the same service name sets on all the hosts, otherwise use a bit of scripting to have a list of hostnames/windows-servicenames and spit out the Nagios config. Again, this is roughly what we do, although we have a huge homegrown config generator that does filesystems and all as well.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11