I am having issue on servers where the service status is going in Unknown state instead of OK state. I am using nscp local. My Service defination looks like below
filter=start_type = ‘auto’ and state=‘stopped’ and name not in ( ‘RemoteRegistry’ , ‘wuauserv’ , ‘sppsvc’)
Note if I do not remove the above services it becomes red as these services are in auto startup and is currently in stopped state
Why will it report Unknown. Are you saying that if it doesn’t see any issue it will report unknown ?? I can’t report unknown as this will create a ticket for tools team
EDIT:
Understood that if I change my filter to below and remove state=stopped it is behaving normally - and the unknown is gone - but now I am living with a huge list of services as plugin output. When I send this to ticketing -> people will be running after me with a stick
filter=start_type = ‘auto’ and name not in ( ‘RemoteRegistry’ , ‘wuauserv’ , ‘sppsvc’)
Ahh now i got what you like to monitor. Just add the argument empty-state=ok and it should also return ok state if no service found matching your filter.
nscp_service_arguments = [ "filter=start_type = ‘auto’ and state=‘stopped’ and name not in ( ‘RemoteRegistry’ , ‘wuauserv’ , ‘sppsvc’) ", "empty-state=ok" ]
The documentation is not fully correct for this check, but if you see the repeat_key = true in a command you can use either a string or array.
"-a" = {
repeat_key = true
value = "$nscp_service_arguments$"
}
String works if you have only 1 argument, if more then 1 you need to use an array.
Sadly the Director does not import them as an array
Sorry just writing back on the same thread. We want to raise Warning Alert for the service and not critical (default)
My Filter Looks Like Below
nscp_service_arguments=[“filter=start_type = ‘auto’ and state=‘stopped’ and name not in (‘RemoteRegistry’ , ‘wuauserv’ , ‘CDPSvc’ , ‘sppsvc’, ‘WbioSrvc’)” , “empty-state=ok”]
‘C:\Program Files\NSClient++\nscp.exe’ ‘client’ ‘–log’ ‘critical’ ‘–module’ ‘CheckSystem’ ‘–show-all’ ‘-a’ ‘filter=start_type = ‘’‘auto’’’ and state=’’‘stopped’’’ and name not in (’’‘RemoteRegistry’’’ , ‘’‘CDPSvc’’’ , ‘’‘sppsvc’’’, ‘’‘WbioSrvc’’’)’ ‘-a’ ‘empty-state=ok’ ‘-b’ ‘-q’ ‘check_service’
I want to raise all Warning Alert and no Critical. By default it goes Critical.