PowerShell Framework: Windows EventLog Monitoring

[radioactive9 (Anirban)]

Hello

Trying to make hands dirty after @cstein pushed me to powershell framework
telling me this is the way to move forward.

I generated a event ID : 3201

My Single Service Looks Like below

apply Service "XXX-P_MS_P_EvtLogID3201" {
    import "XXX-tmplService-MS-PS_EventLog"
    assign where "XXX-tmplHost-MS" in host.templates
    vars.IcingaCheckEventlog_Array_IncludeEventId = [ "3201" ]
    vars.IcingaCheckEventlog_Object_Warning = "1"
    vars.IcingaCheckEventlog_String_LogName = "Application"
    import DirectorOverrideTemplate
}

My Service Template Looks Like Below

template Service "XXX-tmplService-MS-PS_EventLog" {
    import "XXX-tmplService-Default"

    check_command = "Invoke-IcingaCheckEventlog"
    check_interval = 15m
    command_endpoint = host_name
    vars.IcingaCheckEventlog_Int32_Verbosity = "3"
}

then I generated a event like below on the server

$evt = new-object System.Diagnostics.EventLog("Application")
$evt.Source = "MyEvent"
$infoevent = [System.Diagnostics.EventLogEntryType]::Information
$evt.WriteEntry("My Test Event",$infoevent,3201)

I see the event in the eventLog
But Do not see my alert firing what did I do wrong
I think I am confused with the critical and warning threshold - but not able to understand very clearly - is it like a count ?

[log1c]

The documentation of the plugin says that the warning and critical thresholds are the number of events above which the check exits with a warning or critical.

Icinga/icinga-powershell-plugins/blob/master/doc/plugins/06-Invoke-IcingaCheckEventlog.md

Have you tried checking for any other events to see if the check basically works?
Or try adding the IncludeEntryType option?

Haven’t used the check myself yet, so I can just do fingerpointing

[radioactive9 (Anirban)]

@log1c

The documentation of the plugin says that the warning and critical thresholds are the number of events above which the check exits with a warning or critical.

Exactly So. My requirement is if I see the eventID 3201 even one time or more then one time I should be alerted with a warning.

I was following the document → Icinga Plugins - Icinga for Windows

I changed it to the following

apply Service "XXX-P_MS_P_EvtLogID3201" {
    import "XXX-tmplService-MS-PS_EventLog"


    assign where "XXX-tmplHost-MS" in host.templates
    vars.IcingaCheckEventlog_Array_IncludeEventId = [ "3201" ]
    vars.IcingaCheckEventlog_Object_Warning = "~:1"
    vars.IcingaCheckEventlog_String_LogName = "Application"
    vars.IcingaCheckEventlog_Switchparameter_DisableTimeCache = true

    import DirectorOverrideTemplate
}

Also I disabled the time cache = true so that it looks historical

I am getting the below

But It should be Warning instead of OK. Also strangely and very strangely the plugin do not have information on the message which is very critical in log monitoring to publish the source and the message. Is this normal or am I doing something really silly

EDIT:

Yes i was being silly. To raise alert we need to be more than 0.

But no Message Bad Mojo Bad Mojo - We need the event Log Message as well

[log1c]

@radioactive9

Yes i was being silly. To raise alert we need to be more than 0.

That would have been my next suggestion

@radioactive9

We need the event Log Message as well

Maybe create a feature request for the plugin to add this functionality.
Or think about implementing something like Graylog for log management?

[radioactive9 (Anirban)]

Thanks

Created a new enhancement request

PowerShell EventLog Monitoring Message in Output - Enhancement

But the major problem is different - Why on earth it is raising soft state. My Service Template only has check_interval = 15m not even sampling interval

[log1c]

@radioactive9

Why on earth it is raising soft state

I would suggest you open another thread for this, as it is a different problem which (most likely) has nothing to do with the PowerShell plugins