Monitoring event log in Windows server


#1

Hello,

I have Windows Servers installed (for example a Windows Server 2003 machine) which I monitor.
I want to add monitoring for the event log (for example if it gets over its space limit – for example many logs generated and fill the empty space which can cause the server to be restarted etc) and maybe get some of the messages to the Nagios admin htm page (Nagios installed on a linux machine which gets the monitoring messages).
I have NSClient++ installed on my windows servers (version 0.3.5.2), I would like to have a tip which will not make me install more utilities just for the event log monitoring (and if it could be not with NSCA daemon/passive checks).
What is the best way to implement it?

Btw, Does the following applies for what I need?
nsclient.org/nscp/wiki/CheckEven … ckEventLog

Did someone used it? Tried it? Configure it?

Thankssssss.


#2

Hi there,

yup, that will do the trick and indeed it can be configured to run in both nrpe and nsca modes.

I know that you don’t want to install any additional applications but there can be real benefits in doing so. You may find that using the following eventlog to nsca agent alongside nsclient++ provides better results and is far easier to manage due to it’s configuration GUI.

steveshipway.org/software/

And if you want to collect all of your windows eventlogs consider using an Eventlog to syslog service. Something like

engineering.purdue.edu/ECN/Reso … IX/evtsys/

Ensure that you have a syslogd server on your nagios box (syslog-ng is nice) and configure windows servers to send all messages to it. Then use one of the various Nagios log checking tools to search for errors in the resultant log file(s)

The first option has the advantage of being easier to setup. The second provides centralisation of all eventlogs which opens up the potential for data mining using a tool like Splunk. Bank on needing to read a few howtos first.

Again, I know that you don’t want to use additional tools but we found that it was worth it…

Regards,

Matthew


#3

If you don’t want to install tools on every server you could also look into using nagios web service checker (http://nagios-wsc.sourceforge.net/). I am only starting to get it set up so have yet to use the feature but according to the documentation (section 3.15 of the pdf) you can check for events in the logs.


#4

Thanks guys! keep the good work!
coming with those suggestions make this forum so great.
I’ll try it and if you have more ideas…well… let me know…