`CheckEventLog`
Check for errors and warnings in the event log.

# `CheckEventLog` — CheckEventLog

Check for errors and warnings in the event log.

Queries (Overview):

A list of all available queries (check commands)

Command | Description
--- | ---
`check_eventlog` | Check for errors in the event log.
`checkeventlog` | Legacy version of check_eventlog

Commands (Overview):

TODO: Add a list of all external commands (this is not check commands)

Configuration (Overview):

Common Keys:

Path / Section | Key | Description
--- | --- | ---
`/settings/eventlog` | `buffer size` | BUFFER_SIZE
`/settings/eventlog` | `debug` | DEBUG
`/settings/eventlog` | `lookup names` | LOOKUP NAMES
`/settings/eventlog` | `syntax` | SYNTAX
`/settings/eventlog/real-time` | `debug` | DEBUG
`/settings/eventlog/real-time` | `enabled` | REAL TIME CHECKING
`/settings/eventlog/real-time` | `log` | LOGS TO CHECK
`/settings/eventlog/real-time` | `startup age` | STARTUP AGE
`/settings/eventlog/real-time/filters` | `default` | default

Sample keys:

Path / Section | Key | Default Value | Description
--- | --- | --- | ---
`/settings/eventlog/real-time/filters/sample` | `alias` | ALIAS |
`/settings/eventlog/real-time/filters/sample` | `command` | COMMAND NAME |
`/settings/eventlog/real-time/filters/sample` | `critical` | CRITICAL FILTER |
`/settings/eventlog/real-time/filters/sample` | `debug` | DEBUG |
`/settings/eventlog/real-time/filters/sample` | `destination` | DESTINATION |
`/settings/eventlog/real-time/filters/sample` | `detail syntax` | SYNTAX |
`/settings/eventlog/real-time/filters/sample` | `empty message` | EMPTY MESSAGE |
`/settings/eventlog/real-time/filters/sample` | `filter` | FILTER |
`/settings/eventlog/real-time/filters/sample` | `is template` | IS TEMPLATE |
`/settings/eventlog/real-time/filters/sample` | `log` | FILE |
`/settings/eventlog/real-time/filters/sample` | `logs` | FILES |
`/settings/eventlog/real-time/filters/sample` | `maximum age` | MAGIMUM AGE |
`/settings/eventlog/real-time/filters/sample` | `ok` | OK FILTER |
`/settings/eventlog/real-time/filters/sample` | `ok syntax` | SYNTAX |
`/settings/eventlog/real-time/filters/sample` | `parent` | PARENT |
`/settings/eventlog/real-time/filters/sample` | `perf config` | PERF CONFIG |
`/settings/eventlog/real-time/filters/sample` | `severity` | SEVERITY |
`/settings/eventlog/real-time/filters/sample` | `target` | DESTINATION |
`/settings/eventlog/real-time/filters/sample` | `top syntax` | SYNTAX |
`/settings/eventlog/real-time/filters/sample` | `warning` | WARNING FILTER |

## Queries

A quick reference for all available queries (check commands) in the CheckEventLog module.

### `check_eventlog`

`CheckEventLog` `check_eventlog`
Check for errors in the event log.

Usage:

Option | Default Value | Description
--- | --- | ---
`help` | N/A | Show help screen (this screen)
`help-pb` | N/A | Show help screen as a protocol buffer payload
`show-default` | N/A | Show default values for a given command
`help-short` | N/A | Show help screen (short format).
`debug` | N/A | Show debugging information in the log
`show-all` | N/A | Show debugging information in the log
`filter` | level in (‘error’, ‘warning’) | Filter which marks interesting items.
`warning` | count > 0 | Filter which marks items which generates a warning state.
`warn` |  | Short alias for warning
`critical` | count > 5 | Filter which marks items which generates a critical state.
`crit` |  | Short alias for critical.
`ok` |  | Filter which marks items which generates an ok state.
`empty-state` | ok | Return status to use when nothing matched filter.
`perf-config` |  | Performance data generation configuration
`unique-index` |  | Unique syntax.
`top-syntax` | ${status}: ${problem_count}/${count} ${problem_list} | Top level syntax.
`ok-syntax` | %(status): Event log seems fine | ok syntax.
`empty-syntax` | %(status): No entries found | Empty syntax.
`detail-syntax` | ${file} ${source} (${message}) | Detail level syntax.
`perf-syntax` | ${file}_${source} | Performance alias syntax.
`file` |  | File to read (can be specified multiple times to check multiple files.
`scan-range` |  | Date range to scan.
`truncate-message` |  | Maximum length of message for each event log message text.
`unique` | 1 | Shorthand for setting default unique index: ${log}-${source}-${id}.

#### Arguments

`help` (CheckEventLog, check_eventlog)
  Show help screen (this screen)

`help-pb` (CheckEventLog, check_eventlog)
  Show help screen as a protocol buffer payload

`show-default` (CheckEventLog, check_eventlog)
  Show default values for a given command

`help-short` (CheckEventLog, check_eventlog)
  Show help screen (short format).

`debug` (CheckEventLog, check_eventlog)
  Show debugging information in the log

`show-all` (CheckEventLog, check_eventlog)
  Show debugging information in the log

`filter` (CheckEventLog, check_eventlog)
  Filter which marks interesting items.
  Interesting items are items which will be included in the check.
  They do not denote warning or critical state but they are checked use this to filter out unwanted items.
  Available options:

  Key | Value
  category | TODO
  computer | Which computer generated the message
  customer | TODO
  file | The logfile name
  id | Eventlog id
  level | Severity level (error, warning, info, success, auditSucess, auditFailure)
  log | alias for file
  message | The message rendered as a string.
  rawid | Raw message id (contains many other fields all baked into a single number)
  source | Source system.
  type | alias for level (old, deprecated)
  written | When the message was written to file
  count | Number of items matching the filter
  total | Total number of items
  ok_count | Number of items matched the ok criteria
  warn_count | Number of items matched the warning criteria
  crit_count | Number of items matched the critical criteria
  problem_count | Number of items matched either warning or critical criteria
  list | A list of all items which matched the filter
  ok_list | A list of all items which matched the ok criteria
  warn_list | A list of all items which matched the warning criteria
  crit_list | A list of all items which matched the critical criteria
  problem_list | A list of all items which matched either the critical or the warning criteria
  detail_list | A special list with critical, then warning and fainally ok
  status | The returned status (OK/WARN/CRIT/UNKNOWN)

`warning` (CheckEventLog, check_eventlog)
  Filter which marks items which generates a warning state.
  If anything matches this filter the return status will be escalated to warning.
  Available options:

  Key | Value
  category | TODO
  computer | Which computer generated the message
  customer | TODO
  file | The logfile name
  id | Eventlog id
  level | Severity level (error, warning, info, success, auditSucess, auditFailure)
  log | alias for file
  message | The message rendered as a string.
  rawid | Raw message id (contains many other fields all baked into a single number)
  source | Source system.
  type | alias for level (old, deprecated)
  written | When the message was written to file
  count | Number of items matching the filter
  total | Total number of items
  ok_count | Number of items matched the ok criteria
  warn_count | Number of items matched the warning criteria
  crit_count | Number of items matched the critical criteria
  problem_count | Number of items matched either warning or critical criteria
  list | A list of all items which matched the filter
  ok_list | A list of all items which matched the ok criteria
  warn_list | A list of all items which matched the warning criteria
  crit_list | A list of all items which matched the critical criteria
  problem_list | A list of all items which matched either the critical or the warning criteria
  detail_list | A special list with critical, then warning and fainally ok
  status | The returned status (OK/WARN/CRIT/UNKNOWN)

`warn` (CheckEventLog, check_eventlog)
  Short alias for warning

`critical` (CheckEventLog, check_eventlog)
  Filter which marks items which generates a critical state.
  If anything matches this filter the return status will be escalated to critical.
  Available options:

  Key | Value
  category | TODO
  computer | Which computer generated the message
  customer | TODO
  file | The logfile name
  id | Eventlog id
  level | Severity level (error, warning, info, success, auditSucess, auditFailure)
  log | alias for file
  message | The message rendered as a string.
  rawid | Raw message id (contains many other fields all baked into a single number)
  source | Source system.
  type | alias for level (old, deprecated)
  written | When the message was written to file
  count | Number of items matching the filter
  total | Total number of items
  ok_count | Number of items matched the ok criteria
  warn_count | Number of items matched the warning criteria
  crit_count | Number of items matched the critical criteria
  problem_count | Number of items matched either warning or critical criteria
  list | A list of all items which matched the filter
  ok_list | A list of all items which matched the ok criteria
  warn_list | A list of all items which matched the warning criteria
  crit_list | A list of all items which matched the critical criteria
  problem_list | A list of all items which matched either the critical or the warning criteria
  detail_list | A special list with critical, then warning and fainally ok
  status | The returned status (OK/WARN/CRIT/UNKNOWN)

`crit` (CheckEventLog, check_eventlog)
  Short alias for critical.

`ok` (CheckEventLog, check_eventlog)
  Filter which marks items which generates an ok state.
  If anything matches this any previous state for this item will be reset to ok.
  Available options:

  Key | Value
  category | TODO
  computer | Which computer generated the message
  customer | TODO
  file | The logfile name
  id | Eventlog id
  level | Severity level (error, warning, info, success, auditSucess, auditFailure)
  log | alias for file
  message | The message rendered as a string.
  rawid | Raw message id (contains many other fields all baked into a single number)
  source | Source system.
  type | alias for level (old, deprecated)
  written | When the message was written to file
  count | Number of items matching the filter
  total | Total number of items
  ok_count | Number of items matched the ok criteria
  warn_count | Number of items matched the warning criteria
  crit_count | Number of items matched the critical criteria
  problem_count | Number of items matched either warning or critical criteria
  list | A list of all items which matched the filter
  ok_list | A list of all items which matched the ok criteria
  warn_list | A list of all items which matched the warning criteria
  crit_list | A list of all items which matched the critical criteria
  problem_list | A list of all items which matched either the critical or the warning criteria
  detail_list | A special list with critical, then warning and fainally ok
  status | The returned status (OK/WARN/CRIT/UNKNOWN)

`empty-state` (CheckEventLog, check_eventlog)
  Return status to use when nothing matched filter.
  If no filter is specified this will never happen unless the file is empty.

`perf-config` (CheckEventLog, check_eventlog)
  Performance data generation configuration
  TODO: obj ( key: value; key: value) obj (key:valuer;key:value)

`unique-index` (CheckEventLog, check_eventlog)
  Unique syntax.
  Used to filter unique items (counted will still increase but messages will not repeaters:

  Key | Value
  %(category) | TODO
  %(computer) | Which computer generated the message
  %(customer) | TODO
  %(file) | The logfile name
  %(id) | Eventlog id
  %(level) | Severity level (error, warning, info, success, auditSucess, auditFailure)
  %(log) | alias for file
  %(message) | The message rendered as a string.
  %(rawid) | Raw message id (contains many other fields all baked into a single number)
  %(source) | Source system.
  %(type) | alias for level (old, deprecated)
  %(written) | When the message was written to file
  ${count} | Number of items matching the filter
  ${total} | Total number of items
  ${ok_count} | Number of items matched the ok criteria
  ${warn_count} | Number of items matched the warning criteria
  ${crit_count} | Number of items matched the critical criteria
  ${problem_count} | Number of items matched either warning or critical criteria
  ${list} | A list of all items which matched the filter
  ${ok_list} | A list of all items which matched the ok criteria
  ${warn_list} | A list of all items which matched the warning criteria
  ${crit_list} | A list of all items which matched the critical criteria
  ${problem_list} | A list of all items which matched either the critical or the warning criteria
  ${detail_list} | A special list with critical, then warning and fainally ok
  ${status} | The returned status (OK/WARN/CRIT/UNKNOWN)

`top-syntax` (CheckEventLog, check_eventlog)
  Top level syntax.
  Used to format the message to return can include strings as well as special keywords such as:

  Key | Value
  %(category) | TODO
  %(computer) | Which computer generated the message
  %(customer) | TODO
  %(file) | The logfile name
  %(id) | Eventlog id
  %(level) | Severity level (error, warning, info, success, auditSucess, auditFailure)
  %(log) | alias for file
  %(message) | The message rendered as a string.
  %(rawid) | Raw message id (contains many other fields all baked into a single number)
  %(source) | Source system.
  %(type) | alias for level (old, deprecated)
  %(written) | When the message was written to file
  ${count} | Number of items matching the filter
  ${total} | Total number of items
  ${ok_count} | Number of items matched the ok criteria
  ${warn_count} | Number of items matched the warning criteria
  ${crit_count} | Number of items matched the critical criteria
  ${problem_count} | Number of items matched either warning or critical criteria
  ${list} | A list of all items which matched the filter
  ${ok_list} | A list of all items which matched the ok criteria
  ${warn_list} | A list of all items which matched the warning criteria
  ${crit_list} | A list of all items which matched the critical criteria
  ${problem_list} | A list of all items which matched either the critical or the warning criteria
  ${detail_list} | A special list with critical, then warning and fainally ok
  ${status} | The returned status (OK/WARN/CRIT/UNKNOWN)

`ok-syntax` (CheckEventLog, check_eventlog)
  ok syntax.
  DEPRECATED! This is the syntax for when an ok result is returned.
  This value will not be used if your syntax contains %(list) or %(count).

`empty-syntax` (CheckEventLog, check_eventlog)
  Empty syntax.
  DEPRECATED! This is the syntax for when nothing matches the filter.
  Possible values are:

  Key | Value
  %(category) | TODO
  %(computer) | Which computer generated the message
  %(customer) | TODO
  %(file) | The logfile name
  %(id) | Eventlog id
  %(level) | Severity level (error, warning, info, success, auditSucess, auditFailure)
  %(log) | alias for file
  %(message) | The message rendered as a string.
  %(rawid) | Raw message id (contains many other fields all baked into a single number)
  %(source) | Source system.
  %(type) | alias for level (old, deprecated)
  %(written) | When the message was written to file
  ${count} | Number of items matching the filter
  ${total} | Total number of items
  ${ok_count} | Number of items matched the ok criteria
  ${warn_count} | Number of items matched the warning criteria
  ${crit_count} | Number of items matched the critical criteria
  ${problem_count} | Number of items matched either warning or critical criteria
  ${list} | A list of all items which matched the filter
  ${ok_list} | A list of all items which matched the ok criteria
  ${warn_list} | A list of all items which matched the warning criteria
  ${crit_list} | A list of all items which matched the critical criteria
  ${problem_list} | A list of all items which matched either the critical or the warning criteria
  ${detail_list} | A special list with critical, then warning and fainally ok
  ${status} | The returned status (OK/WARN/CRIT/UNKNOWN)

`detail-syntax` (CheckEventLog, check_eventlog)
  Detail level syntax.
  This is the syntax of each item in the list of top-syntax (see above).
  Possible values are:

  Key | Value
  %(category) | TODO
  %(computer) | Which computer generated the message
  %(customer) | TODO
  %(file) | The logfile name
  %(id) | Eventlog id
  %(level) | Severity level (error, warning, info, success, auditSucess, auditFailure)
  %(log) | alias for file
  %(message) | The message rendered as a string.
  %(rawid) | Raw message id (contains many other fields all baked into a single number)
  %(source) | Source system.
  %(type) | alias for level (old, deprecated)
  %(written) | When the message was written to file
  ${count} | Number of items matching the filter
  ${total} | Total number of items
  ${ok_count} | Number of items matched the ok criteria
  ${warn_count} | Number of items matched the warning criteria
  ${crit_count} | Number of items matched the critical criteria
  ${problem_count} | Number of items matched either warning or critical criteria
  ${list} | A list of all items which matched the filter
  ${ok_list} | A list of all items which matched the ok criteria
  ${warn_list} | A list of all items which matched the warning criteria
  ${crit_list} | A list of all items which matched the critical criteria
  ${problem_list} | A list of all items which matched either the critical or the warning criteria
  ${detail_list} | A special list with critical, then warning and fainally ok
  ${status} | The returned status (OK/WARN/CRIT/UNKNOWN)

`perf-syntax` (CheckEventLog, check_eventlog)
  Performance alias syntax.
  This is the syntax for the base names of the performance data.
  Possible values are:

  Key | Value
  %(category) | TODO
  %(computer) | Which computer generated the message
  %(customer) | TODO
  %(file) | The logfile name
  %(id) | Eventlog id
  %(level) | Severity level (error, warning, info, success, auditSucess, auditFailure)
  %(log) | alias for file
  %(message) | The message rendered as a string.
  %(rawid) | Raw message id (contains many other fields all baked into a single number)
  %(source) | Source system.
  %(type) | alias for level (old, deprecated)
  %(written) | When the message was written to file
  ${count} | Number of items matching the filter
  ${total} | Total number of items
  ${ok_count} | Number of items matched the ok criteria
  ${warn_count} | Number of items matched the warning criteria
  ${crit_count} | Number of items matched the critical criteria
  ${problem_count} | Number of items matched either warning or critical criteria
  ${list} | A list of all items which matched the filter
  ${ok_list} | A list of all items which matched the ok criteria
  ${warn_list} | A list of all items which matched the warning criteria
  ${crit_list} | A list of all items which matched the critical criteria
  ${problem_list} | A list of all items which matched either the critical or the warning criteria
  ${detail_list} | A special list with critical, then warning and fainally ok
  ${status} | The returned status (OK/WARN/CRIT/UNKNOWN)

`file` (CheckEventLog, check_eventlog)
  File to read (can be specified multiple times to check multiple files.
  Notice that specifying multiple files will create an aggregate set you will not check each file individually.In other words if one file contains an error the entire check will result in error.

`scan-range` (CheckEventLog, check_eventlog)
  Date range to scan.
  This is the approximate dates to search through this speeds up searching a lot but there is no guarantee messages are ordered.

`truncate-message` (CheckEventLog, check_eventlog)
  Maximum length of message for each event log message text.

`unique` (CheckEventLog, check_eventlog)
  Shorthand for setting default unique index: ${log}-${source}-${id}.

### `checkeventlog`

`CheckEventLog` `checkeventlog`
Legacy version of check_eventlog

Usage:

Option | Default Value | Description
--- | --- | ---
`help` | N/A | Show help screen (this screen)
`help-pb` | N/A | Show help screen as a protocol buffer payload
`show-default` | N/A | Show default values for a given command
`help-short` | N/A | Show help screen (short format).
`MaxWarn` |  | Maximum value before a warning is returned.
`MaxCrit` |  | Maximum value before a critical is returned.
`MinWarn` |  | Minimum value before a warning is returned.
`MinCrit` |  | Minimum value before a critical is returned.
`warn` |  | Maximum value before a warning is returned.
`crit` |  | Maximum value before a critical is returned.
`filter` |  | The filter to use.
`file` |  | The file to check
`debug` | 1 | The file to check
`truncate` |  | Deprecated and has no meaning
`descriptions` | 1 | Deprecated and has no meaning
`unique` | 1 |
`syntax` | %source%, %strings% | The syntax string
`top-syntax` | ${list} | The top level syntax string
`scan-range` |  | TODO

#### Arguments

`help` (CheckEventLog, checkeventlog)
  Show help screen (this screen)

`help-pb` (CheckEventLog, checkeventlog)
  Show help screen as a protocol buffer payload

`show-default` (CheckEventLog, checkeventlog)
  Show default values for a given command

`help-short` (CheckEventLog, checkeventlog)
  Show help screen (short format).

`MaxWarn` (CheckEventLog, checkeventlog)
  Maximum value before a warning is returned.

`MaxCrit` (CheckEventLog, checkeventlog)
  Maximum value before a critical is returned.

`MinWarn` (CheckEventLog, checkeventlog)
  Minimum value before a warning is returned.

`MinCrit` (CheckEventLog, checkeventlog)
  Minimum value before a critical is returned.

`warn` (CheckEventLog, checkeventlog)
  Maximum value before a warning is returned.

`crit` (CheckEventLog, checkeventlog)
  Maximum value before a critical is returned.

`filter` (CheckEventLog, checkeventlog)
  The filter to use.

`file` (CheckEventLog, checkeventlog)
  The file to check

`debug` (CheckEventLog, checkeventlog)
  The file to check

`truncate` (CheckEventLog, checkeventlog)
  Deprecated and has no meaning

`descriptions` (CheckEventLog, checkeventlog)
  Deprecated and has no meaning

`unique` (CheckEventLog, checkeventlog)

`syntax` (CheckEventLog, checkeventlog)
  The syntax string

`top-syntax` (CheckEventLog, checkeventlog)
  The top level syntax string

`scan-range` (CheckEventLog, checkeventlog)
  TODO

### / settings/ eventlog

`/settings/eventlog` (CheckEventLog)

EVENT LOG SECTION

> Section for the EventLog Checker (CheckEventLog.dll).

> Key | Default Value | Description
> --- | --- | ---
> `buffer size` | 131072 | BUFFER_SIZE
> `debug` | 0 | DEBUG
> `lookup names` | 1 | LOOKUP NAMES
> `syntax` |  | SYNTAX

> Sample:

>     # EVENT LOG SECTION
>     # Section for the EventLog Checker (CheckEventLog.dll).
>     [/settings/eventlog]
>     buffer size=131072
>     debug=0
>     lookup names=1
>     syntax=

> `buffer size` (CheckEventLog, /settings/eventlog)

>   BUFFER_SIZE

>   The size of the buffer to use when getting messages this affects the speed and maximum size of messages you can recieve.

>   Path: /settings/eventlog

>   Key: buffer size

>   Default value: 131072

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog]
>       # BUFFER_SIZE
>       buffer size=131072

> `debug` (CheckEventLog, /settings/eventlog)

>   DEBUG

>   Log more information when filtering (useful to detect issues with filters) not useful in production as it is a bit of a resource hog.

>   Path: /settings/eventlog

>   Key: debug

>   Default value: 0

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog]
>       # DEBUG
>       debug=0

> `lookup names` (CheckEventLog, /settings/eventlog)

>   LOOKUP NAMES

>   Lookup the names of eventlog files

>   Path: /settings/eventlog

>   Key: lookup names

>   Default value: 1

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog]
>       # LOOKUP NAMES
>       lookup names=1

> `syntax` (CheckEventLog, /settings/eventlog)

>   SYNTAX

>   Set this to use a specific syntax string for all commands (that don’t specify one).

>   Path: /settings/eventlog

>   Key: syntax

>   Default value:

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog]
>       # SYNTAX
>       syntax=

### … / real-time

`/settings/eventlog/real-time` (CheckEventLog)

CONFIGURE REALTIME CHECKING

> A set of options to configure the real time checks

> Key | Default Value | Description
> --- | --- | ---
> `debug` | 0 | DEBUG
> `enabled` | 0 | REAL TIME CHECKING
> `log` | application,system | LOGS TO CHECK
> `startup age` | 30m | STARTUP AGE

> Sample:

>     # CONFIGURE REALTIME CHECKING
>     # A set of options to configure the real time checks
>     [/settings/eventlog/real-time]
>     debug=0
>     enabled=0
>     log=application,system
>     startup age=30m

> `debug` (CheckEventLog, /settings/eventlog/real-time)

>   DEBUG

>   Log missed records (useful to detect issues with filters) not useful in production as it is a bit of a resource hog.

>   Path: /settings/eventlog/real-time

>   Key: debug

>   Default value: 0

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time]
>       # DEBUG
>       debug=0

> `enabled` (CheckEventLog, /settings/eventlog/real-time)

>   REAL TIME CHECKING

>   Spawns a background thread which detects issues and reports them back instantly.

>   Path: /settings/eventlog/real-time

>   Key: enabled

>   Default value: 0

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time]
>       # REAL TIME CHECKING
>       enabled=0

> `log` (CheckEventLog, /settings/eventlog/real-time)

>   LOGS TO CHECK

>   Comma separated list of logs to check

>   Path: /settings/eventlog/real-time

>   Key: log

>   Default value: application,system

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time]
>       # LOGS TO CHECK
>       log=application,system

> `startup age` (CheckEventLog, /settings/eventlog/real-time)

>   STARTUP AGE

>   The initial age to scan when starting NSClient++

>   Path: /settings/eventlog/real-time

>   Key: startup age

>   Default value: 30m

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time]
>       # STARTUP AGE
>       startup age=30m

### … / real-time / filters

`/settings/eventlog/real-time/filters` (CheckEventLog)

REALTIME FILTERS

> A set of filters to use in real-time mode

> Key | Default Value | Description
> --- | --- | ---
> `default` |  | default

> Sample:

>     # REALTIME FILTERS
>     # A set of filters to use in real-time mode
>     [/settings/eventlog/real-time/filters]
>     default=

> `default` (CheckEventLog, /settings/eventlog/real-time/filters)

>   default

>   Filter for default. To configure this item add a section called: /settings/eventlog/real-time/filters/default

>   Path: /settings/eventlog/real-time/filters

>   Key: default

>   Default value:

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters]
>       # default
>       default=

### … / real-time / filters / sample

`/settings/eventlog/real-time/filters/sample` (CheckEventLog)

REAL TIME FILTER DEFENITION

> Definition for real time filter: sample

> Key | Default Value | Description
> --- | --- | ---
> `alias` |  | ALIAS
> `command` |  | COMMAND NAME
> `critical` |  | CRITICAL FILTER
> `debug` | 0 | DEBUG
> `destination` |  | DESTINATION
> `detail syntax` |  | SYNTAX
> `empty message` | eventlog found no records | EMPTY MESSAGE
> `filter` |  | FILTER
> `is template` | 0 | IS TEMPLATE
> `log` |  | FILE
> `logs` |  | FILES
> `maximum age` | 5m | MAGIMUM AGE
> `ok` |  | OK FILTER
> `ok syntax` |  | SYNTAX
> `parent` | default | PARENT
> `perf config` |  | PERF CONFIG
> `severity` |  | SEVERITY
> `target` |  | DESTINATION
> `top syntax` |  | SYNTAX
> `warning` |  | WARNING FILTER

> Sample:

>     # REAL TIME FILTER DEFENITION
>     # Definition for real time filter: sample
>     [/settings/eventlog/real-time/filters/sample]
>     alias=
>     command=
>     critical=
>     debug=0
>     destination=
>     detail syntax=
>     empty message=eventlog found no records
>     filter=
>     is template=0
>     log=
>     logs=
>     maximum age=5m
>     ok=
>     ok syntax=
>     parent=default
>     perf config=
>     severity=
>     target=
>     top syntax=
>     warning=

> `alias` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   ALIAS

>   The alias (service name) to report to server

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: alias

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # ALIAS
>       alias=

> `command` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   COMMAND NAME

>   The name of the command (think nagios service name) to report up stream (defaults to alias if not set)

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: command

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # COMMAND NAME
>       command=

> `critical` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   CRITICAL FILTER

>   If any rows match this filter severity will escalated to CRITICAL

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: critical

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # CRITICAL FILTER
>       critical=

> `debug` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   DEBUG

>   Enable this to display debug information for this match filter

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: debug

>   Default value: 0

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # DEBUG
>       debug=0

> `destination` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   DESTINATION

>   The destination for intercepted messages

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: destination

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # DESTINATION
>       destination=

> `detail syntax` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   SYNTAX

>   Format string for dates

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: detail syntax

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # SYNTAX
>       detail syntax=

> `empty message` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   EMPTY MESSAGE

>   The message to display if nothing matches the filter (generally considered the ok state).

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: empty message

>   Default value: eventlog found no records

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # EMPTY MESSAGE
>       empty message=eventlog found no records

> `filter` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   FILTER

>   Scan files for matching rows for each matching rows an OK message will be submitted

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: filter

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # FILTER
>       filter=

> `is template` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   IS TEMPLATE

>   Declare this object as a template (this means it will not be available as a separate object)

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: is template

>   Default value: 0

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # IS TEMPLATE
>       is template=0

> `log` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   FILE

>   The eventlog record to filter on (if set to ‘all’ means all enabled logs)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: log

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # FILE
>       log=

> `logs` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   FILES

>   The eventlog record to filter on (if set to ‘all’ means all enabled logs)

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: logs

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # FILES
>       logs=

> `maximum age` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   MAGIMUM AGE

>   How long before reporting “ok”.
>   If this is set to “false” no periodic ok messages will be reported only errors.

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: maximum age

>   Default value: 5m

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # MAGIMUM AGE
>       maximum age=5m

> `ok` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   OK FILTER

>   If any rows match this filter severity will escalated down to OK

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: ok

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # OK FILTER
>       ok=

> `ok syntax` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   SYNTAX

>   Format string for dates

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: ok syntax

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # SYNTAX
>       ok syntax=

> `parent` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   PARENT

>   The parent the target inherits from

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: parent

>   Default value: default

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # PARENT
>       parent=default

> `perf config` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   PERF CONFIG

>   Performance data configuration

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: perf config

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # PERF CONFIG
>       perf config=

> `severity` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   SEVERITY

>   THe severity of this message (OK, WARNING, CRITICAL, UNKNOWN)

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: severity

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # SEVERITY
>       severity=

> `target` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   DESTINATION

>   Same as destination

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: target

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # DESTINATION
>       target=

> `top syntax` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   SYNTAX

>   Format string for dates

>   Advanced (means it is not commonly used)

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: top syntax

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # SYNTAX
>       top syntax=

> `warning` (CheckEventLog, /settings/eventlog/real-time/filters/sample)

>   WARNING FILTER

>   If any rows match this filter severity will escalated to WARNING

>   Path: /settings/eventlog/real-time/filters/sample

>   Key: warning

>   Default value:

>   Sample key: This key is provided as a sample to show how to configure objects

>   Used by: `CheckEventLog`

>   Sample:

>       [/settings/eventlog/real-time/filters/sample]
>       # WARNING FILTER
>       warning=

comments powered by Disqus