CheckEventLog /W2K3 server


#1

Hello

I can check eventlog for certain eventid from system and security. But can not get it to work with Application.

check_nrpe -H xxx.xx.xx.xx -c checkEventLog -a filter=new filter=in file=system MaxWarn=1 MaxCrit=1 filter+generated=\<2d filter+eventID==40 truncate=1022

works great, but

check_nrpe -H xxx.xx.xx.xx -c checkEventLog -a filter=new filter=in file=Application MaxWarn=1 MaxCrit=1 filter+generated=\<2d filter+eventID==40 truncate=1022

does not work. Always OK. If change Application to “anythingyoucanfigure” the result is same, OK. What I am missing here? Is it some windows related user right shit?