Hi all!
I’ve got Nagios running on Ubuntu and using Opsview on top of this.
Now I’ve been testing a bit with 2 servers (In the end it’s going to be around 150 servers) and I’m having these Unknown Errors popping up from both servers:
Windows Application Events
EvenlogBuffer is too small (set the value of buffer_size): 122: The data area passed to a system call is too small
Both servers have the same unknown problem so I’m wondering if there is a simple way to fix it.
Thanks in advance! 
looks like you are using nsclient++ too…
google helps… lists.opsview.org/lurker/message … 2d.ca.html
Alrighty thanks for the info!
Sorry that I’m so lazy 
Problem tho… I did what they said there, but no luck.
Changed the value but still the same unknown problem
i’m not using nsclient so i can’t check… don’t you have any extra info in the logs?
well, in the opsview agent map the log file gives nothing more than this
2010-02-04 12:03:04: error:.\CheckEventLog.cpp:705: EvenlogBuffer is too small (set the value of buffer_size): 122: The data area passed to a system call is too small.
2010-02-04 12:08:04: error:.\CheckEventLog.cpp:705: EvenlogBuffer is too small (set the value of buffer_size): 122: The data area passed to a system call is too small.
2010-02-04 12:13:04: error:.\CheckEventLog.cpp:705: EvenlogBuffer is too small (set the value of buffer_size): 122: The data area passed to a system call is too small.
2010-02-04 12:18:04: error:.\CheckEventLog.cpp:705: EvenlogBuffer is too small (set the value of buffer_size): 122: The data area passed to a system call is too small.
2010-02-04 12:23:04: error:.\CheckEventLog.cpp:705: EvenlogBuffer is too small (set the value of buffer_size): 122: The data area passed to a system call is too small.
this goes on for a few hours. Already changed the value to 1000000000 and adding a 0 now and then to see the result.
try using the settings in that post.
[EventLog]
buffer_size=256000
could be that the number you used is way too big and overflows
Okido, this is what my config file looks like:
[modules]
;# NSCLIENT++ MODULES
;# A list with DLLs to load at startup.
FileLogger.dll
CheckSystem.dll
CheckDisk.dll
NRPEListener.dll
;SysTray.dll
CheckEventLog.dll
CheckHelpers.dll
;CheckWMI.dll
[Settings]
allowed_hosts=
;# USE THIS FILE
; Use the INI file as opposed to the registry if this is 0 and the use_reg in the registry is set to 1
; the registry will be used instead.
use_file=1
[log]
;# LOG DEBUG
; Set to 1 if you want debug message printed in the log file (debug messages are always printed to stdout when run with -test)
;debug=1
;# LOG FILE
; The file to print log statements to
file=opsview-agent.log
[NSClient]
;
;# CPU BUFFER SIZE
; Can be anything ranging from 1s (for 1 second) to 10w for 10 weeks. Notice that a larger buffer will waste memory
; so don’t use a larger buffer then you need (ie. the longest check you do +1).
;CPUBufferSize=1h
;# CHECK RESOLUTION
; The resolution to check values (currently only CPU).
; The value is entered in 1/10:th of a second and the default is 10 (which means ones every second)
;CheckResolution=10
[NRPE]
;# NRPE PORT NUMBER
; This is the port the NRPEListener.dll will listen to.
port=5666
;# COMMAND ARGUMENT PROCESSING
; This option determines whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed.
allow_arguments=1
;# COMMAND ALLOW NASTY META CHARS
; This option determines whether or not the NRPE daemon will allow clients to specify nasty (as in |`&><’"]{}) characters in arguments.
allow_nasty_meta_chars=1
;# USE SSL SOCKET
; This option controls if SSL should be used on the socket.
use_ssl=1
[EventLog]
buffer_size=256000
[NRPE Handlers]
; The old plugins we’ll deprecate
check_disk=scripts\deprecated\diskspace_nrpe_nt.exe $ARG1$
check_cpuload=scripts\deprecated\cpuload_nrpe_nt.exe $ARG1$
check_memload=scripts\deprecated\memload_nrpe_nt.exe $ARG1$
win_service=scripts\deprecated\service_nrpe_nt.exe $ARG1$
check_sysinfo=scripts\deprecated\check_sysinfo.exe
; The new NSClient++ checks
nsc_checkdrivesize=inject CheckDriveSize $ARG1$
nsc_checkfilesize=inject CheckFileSize $ARG1$
nsc_checkfile=inject CheckFile $ARG1$
nsc_checkeventlog=inject CheckEventLog $ARG1$
nsc_checkcpu=inject CheckCPU $ARG1$
nsc_checkuptime=inject CheckUpTime $ARG1$
nsc_checkservicestate=inject CheckServiceState $ARG1$
nsc_checkprocstate=inject CheckProcState $ARG1$
nsc_checkmem=inject CheckMem $ARG1$
nsc_checkcounter=inject CheckCounter $ARG1$
I’m probably doing something wrong, but I have no idea what.
I suck at Ubuntu and this, so any tip whatsoever hand it over 
A small update:
I’ve tried increasing and decreasing the amount of bytes, but no luck so far.
[EventLog]
debug=0
buffer_size=700000000
This is what I have now, and still the same problem.
Started at the default size, wich is 64kb and increased it each time the error came in the log again.
(buffer size is in bytes)
Anyway, still didn’t find a way to get rid of the problem…
I’ve tried getting help from the website nsclient.org/nscp/wiki/CheckEventLog/config
But the one I could talk to was on vacation… so I’m really stuck on this
If anyone has some advice for me, please let me know!
Okay… :roll:
I forgot to restart the NSClient service :oops:
Thanks anyway for the help!
which means it’s now working? or not?
Sorry, yes it is working!
I was completely sure that the [Eventlog] part was wrong, but that part was fine.
I just forgot to restart the service in services.msc… Quite stupid, I know :oops:
coul dyou please post a working config? is anything above 0 ok?
This is what I am using now:
[modules]
;# NSCLIENT++ MODULES
;# A list with DLLs to load at startup.
FileLogger.dll
CheckSystem.dll
CheckDisk.dll
NRPEListener.dll
;SysTray.dll
CheckEventLog.dll
CheckHelpers.dll
;CheckWMI.dll
[Settings]
allowed_hosts=
;# USE THIS FILE
; Use the INI file as opposed to the registry if this is 0 and the use_reg in the registry is set to 1
; the registry will be used instead.
use_file=1
[log]
;# LOG DEBUG
; Set to 1 if you want debug message printed in the log file (debug messages are always printed to stdout when run with -test)
;debug=1
;# LOG FILE
; The file to print log statements to
file=opsview-agent.log
[NSClient]
;
[Check System]
;# CPU BUFFER SIZE
; Can be anything ranging from 1s (for 1 second) to 10w for 10 weeks. Notice that a larger buffer will waste memory
; so don’t use a larger buffer then you need (ie. the longest check you do +1).
;CPUBufferSize=1h
;# CHECK RESOLUTION
; The resolution to check values (currently only CPU).
; The value is entered in 1/10:th of a second and the default is 10 (which means ones every second)
;CheckResolution=10
[NRPE]
;# NRPE PORT NUMBER
; This is the port the NRPEListener.dll will listen to.
port=5666
;# COMMAND ARGUMENT PROCESSING
; This option determines whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed.
allow_arguments=1
;# COMMAND ALLOW NASTY META CHARS
; This option determines whether or not the NRPE daemon will allow clients to specify nasty (as in |`&><’"]{}) characters in arguments.
allow_nasty_meta_chars=1
;# USE SSL SOCKET
; This option controls if SSL should be used on the socket.
use_ssl=1
[Eventlog]
debug=0
buffer_size=512000
[NRPE Handlers]
; The old plugins we’ll deprecate
check_disk=scripts\deprecated\diskspace_nrpe_nt.exe $ARG1$
check_cpuload=scripts\deprecated\cpuload_nrpe_nt.exe $ARG1$
check_memload=scripts\deprecated\memload_nrpe_nt.exe $ARG1$
win_service=scripts\deprecated\service_nrpe_nt.exe $ARG1$
check_sysinfo=scripts\deprecated\check_sysinfo.exe
; The new NSClient++ checks
nsc_checkdrivesize=inject CheckDriveSize $ARG1$
nsc_checkfilesize=inject CheckFileSize $ARG1$
nsc_checkfile=inject CheckFile $ARG1$
nsc_checkeventlog=inject CheckEventLog $ARG1$
nsc_checkcpu=inject CheckCPU $ARG1$
nsc_checkuptime=inject CheckUpTime $ARG1$
nsc_checkservicestate=inject CheckServiceState $ARG1$
nsc_checkprocstate=inject CheckProcState $ARG1$
nsc_checkmem=inject CheckMem $ARG1$
nsc_checkcounter=inject CheckCounter $ARG1$
If you mean buffer_size anthing above 0, then no.
I haven’t tested what size is enough, but 512000 works for me.
If you set it at 1, the log will give the error again.
If you want, I’ll test different sizes.
Meh, already started testing with different sizes
buffer_size=64000 - Too small for Windows Application Events and Windows System Events.
buffer_size=128000 - Too small for Windows Application Events and Windows System Events.
buffer_size=256000 - Too small for Windows Application Events, System Events is now ok.
buffer_size=512000 - Windows Application Events showing up as ok.
So I’ll keep it at 512000 and increase it if it will pop up again.
great thank you !