Cheshire Cat Computing

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

I've also been experimenting with the NOT filtering and have seen some strange results.

I've mostly been dealing with using the NOT filter with Event ID's as it is easiest, and have a server with the follow string in the Event ID field:

6161,1111,5723,12061,5805,14,28

Now, on this server I see all these event regularly, and the following actually do get filtered out:

1111,12061,5805,5723

These don't get filtered:
28,14,6161

I've even tried using a regex in the match string for the ones that don't get filtered and i've had no luck. Example:

The 6161 error looks something like this -

System [error] [print #6161]: The document work orders owned by USER failed to print on printer PRINTER#1. Data type: NT EMF 1.008. Size of the spool file in bytes: 0. Number of bytes printed: 0. Total number of pages in the docu

And I've used a simple string of - failed to print - to try and catch it but that also does not filter this mesage out. I have had success filtering out other messages with much longer regex strings like:

secure session|failed to print|KRB_AP_ERR_MODIFIED|\\Device|ntmssvc|session setup|synchronization

This string does filter out a lot of the events but not all.

I've tried this with just one filter defined, or 2 filters defined. I don't use the All Logs scope ever but limit it to Application Logs and System logs individually.

Hope this helps. I'm more than willing to test out anything you might need to test as well.

-Patrick

_________________
-Patrick

Hi Folks,

Any news on this problem?
I am using the EvenLog agent for a big customer of mine an i love the ease-of-use of it.
So you can imagine that i can't wait till it works properly again so i can do a big rollout.

Thanks for any update.

Grz. Johan

This problem is causing me major headaches. Every time I try to test it here, it works. Since correcting the error with the not flag in the matchstring back at v1.5, I've not been able to duplicate any of these errors, even when copying the definitions as posted here.

Of course this is not to say that there is no problem. Clearly there is something going amiss since several people have reported difficultied when using NOT with the eventID list. However I just can't duplicate it! And, if I can't duplicate it, I cant track down why things are going wrong or test fixes.

I've even posted the code up here for people to take a look at, but to no avail. So, I'm still trying to find out if the problem is in the code, or in the way that people are using it (ie, a documentation error).

I'll have another fight with MSVC again today...

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

On thing people might like to try which will help me out a lot is to enable *both* debug flags in the agent. This will log lots of things, including the name of which filter matched when sending an alert. This will help catch cases when it matches a different filter to the one you expected.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Please be certain that you restart the NagiosEventLog agent service after making any changes to the configuration. The config tool tells you to do this in any case.

If you make changes to the filters, they are not picked up until the agent is restarted. Maybe future versions can check a timestamp in the registry and force a reload, but currently, it is only on initialisation.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

I've added even more debugging output. I am still unable to duplicate the problem, even using the exact filters and events detailed above - it stubbornly works for me each time I test it.

I can send a copy of my development 1.6.4 version to anyone who wants a beta copy, although all this has different is simplified logic in the NOT tests and lots more debugging enabled by the debug flag.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11