Cheshire Cat Computing

Hallo stevesh,

i have installed Nagevlog 1.3 on a Windows 2000 Server as service. Then i have create a Filter, but when a new entry was in the eventlog, the NSCA-Daemon send no information and in the eventlog i can't find a entry from NagiosEventLog!

What's wrong? Have you a idea?

Tschau
MiCkEy2002

Hard to say.
You can add some debug messages to your event logs by checknig the appropriate boxes in the nagevlog configuration. This will tell you when it filters and when it sends nsca alerts.

Possible causes -
1) You have your NSCA hosts configured wrong, and the messages are being sent to the wrnog place
2) You have your filters configured wrong, and the messages do not match any of them
3) The nagevlog service is not running, or is installed incorrectly
4) There is a bug in nagevlog

Obviously, (4) is highly unlikely . If you enable the debug logging in nagevlog, you should be able to tell if it is (1) or (3). (2) is a bit harder, but check the filter definitions closely. If you are really stuck, send me a dump of the Nagevlog part of the registry so I can check the filter definitions.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hallo Steve,

thanks for the fast answer!

1) The NSCA host is right configured, because it received messages from another host.
3) The nagevlog Service is running.
4) : OK, no bug.

2) How must configure a new filter when all new entrys with the state "error" are matched and the NCSA-Daemon send a message to the host?

I have enable the debug logging in nagevlog, but there are only entrys that the service are started and stopped! No another entrys from nagevlog.

It's a windows 2000 Server. The language is german, is that a problem?

Tschau
MiCkEy2002

In the nagevlogctrl program, you need to correctly configure the NSCA servers so that the messages are sent to the right place. Check that this has been set up correctly.

Also, since it is German, it is possible that the eventlogs have different names and this is confusing things? I do not have any experience of this, although it should work whatever the eventlogs are called.

You need to set up at least one filter to send the messages. Try defining an 'all logs', all events forwarding with status OK to a service name on the remote machine and send yourself a test message. I'm considering adding (for v1.4) a 'send test nsca message' button, since the current test generates an eventlog instead.

Make sure your filter specifies a valid Service name (it is case-sensitive).

Make sure your NSCA definitions give the correct hostname.

Check your NSCA logs on the nagios server to see if the NSCA message is being sent, but ignored.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hallo Steve,

i have found the error! It was a problem with the NCSA-Host! But now the nagevlog crashed now, when a filter matched!

The entry in the eventlog was:

Quelle: DrWatson
Typ: Information
Ereigis-ID: 4097

Beschreibung:
Die Anwendung "" hat einen Programmfehler verursacht. Datum und Zeit des Fehlers: 18.02.2005 um 07:44:38.250 Ausnahme: c0000005 an Adresse 0040868A (<nosymbols>)

In english:
Description:
The applikation "" has a error. Date and time form the error was: 18.02.2005 at 07:44:38.250 Exception: c0000005 in Adress 0040868A (<nosymbols>)

Have you a idea?

Tschau
MiCkEy2002

This is definitely a bug .

What I need is to have a copy of the appropriate part of the registry defining the filters, and (if possible) some information on what event triggered the crash. Please email these to me on the steve@steveshipway.org address, so that I can attempt to duplicate.

It sounds as if, somewhere, I have something uninitialised. It may be that the filter is not correctly defined, and my code is not catching the problem -- but I need to know how the filter is defined! If you cant give me the registry dump, then a detailed description of how the filter is defined would be the next best thing.

Also -- has anyone else experienced this? It may be something that only affects German Windows...

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hallo Steve,

here are the used information:

Create Filter:

Select Log events to forward
Filter Discreption: New Item 5
Event Log to check: System

Match Rules
Which Events to alert: Error
EventID's: 1106 (the option "Not" was disabled!)

NSCA Alert Message
Service Name: Service Name
Service Status: (0) OK

When now a the filter matched, then the service crashed. First comes a event entry from NagiosEventLog with:
Ereignisinformationen: NSCA: 1 data packet(s) sent to host successfully
Then comes the event entry from DrWatson and the comes a event entry in the system eventlog:
The service "NagiosEventLog" was unexpectedly finished.

I hope this information can you help to find the problem.

Tschau
Michael Lübben

That's a good srart. I can check the code when Im back after the holiday. Sounds as if (from these logs) the match works, and triggers an NSCA send which completes (since the log for this goes OK), and the crash must come at the end, possibly when trying to clean up the temporary data.

I can't see how it would work on our systems (its installed on a few dozen systems here) and not on yours, but this may be down to the different version of Windows?

Hopefully, I'll beable to come back with something at the end of the week.

Would you be willing to try out a modified version for me, since you can apparently reproduce this at will?

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hallo Steve,

when you have modified your version send me a message, then i can try out the new version on my Windows-Server.

Tschau
MiCkEy2002